Drupal Issues Emergency Update to Close Two Critical Remote‑Code Execution Flaws

Drupal’s security team released an emergency update today that fixes two high‑severity vulnerabilities capable of granting attackers the ability to run arbitrary code on any site using a supported version of the platform. The patches address flaws that affect the core software, meaning the risk extends across the millions of websites that rely on Drupal for content management, from small blogs to large enterprise portals.

The vulnerabilities, classified as remote‑code execution (RCE) issues, were discovered by security researchers and reported to the Drupal project before public disclosure. Because the bugs can be exploited without authentication, an attacker could potentially take full control of a vulnerable site, alter content, steal data, or use the server as a foothold for further attacks.

Drupal maintains a policy of supporting its major releases for several years, and the advisory notes that the patches apply to all currently supported versions. Site administrators are urged to apply the updates immediately, as the project’s own testing indicates that exploitation could become widespread once details are made public. The advisory also warns that proof‑of‑concept exploits may appear in the near future.

Historically, Drupal has faced high‑profile security incidents, most notably the 2018 breach that impacted a large number of U.S. government sites. Those events have underscored the importance of rapid patch deployment and rigorous security hygiene. Experts recommend that organizations using Drupal implement automated update mechanisms, conduct regular vulnerability scans, and follow the principle of least privilege for any third‑party modules.

While the immediate threat is being mitigated through the released patches, the Drupal community continues to monitor for any emerging exploit attempts. Administrators who cannot update instantly should consider temporary mitigations such as disabling vulnerable modules or restricting access to affected entry points. The situation highlights the ongoing challenge of balancing feature‑rich, open‑source platforms with the need for robust security practices.