> TritonInfoSec News
Home / Oct 31, 2026 / Story
0
#9 The Hacker News general October 30, 2026 at 07:45 UTC

Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw

By [email protected] (The Hacker News)

AI Summary

Drupal issued an emergency warning that CVE-2026-118539, a 'highly critical' missing authorization flaw in Commerce Core (versions 0.0.0–2.41 and 3.0.0–3.3.13), is being actively exploited in the wild, allowing attackers to bypass access controls on e-commerce sites running Drupal. Store owners are urged to audit orders immediately and update to patched versions, as the vulnerability impacts the shopping cart and checkout systems used by thousands of online stores. Active exploitation makes this a high-priority patch for any Drupal Commerce operator.

Read full article → https://thehackernews.com/2026/10/hackers-actively…

Relevance score: 80.0/100

# More from October 31

  1. 1
    Binance links $6.3 billion crypto theft to compromised DevOps laptop BleepingComputer
  2. 2
    CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV The Hacker News
  3. 3
    Malicious Claude Code extension on Cursor planted SSH backdoors BleepingComputer
  4. 4
    Critical Linux kernel flaw allows remote root attacks on MPTCP servers BleepingComputer
  5. 5
    Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide The Hacker News
  6. 6
    Trezor warns of suspected crypto-theft implant in hardware wallet BleepingComputer
  7. 7
    $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack SecurityWeek
  8. 8
    Florida warns that 4.9 million people had Social Security numbers leaked in financial aid site breach The Record
  9. 10
    Hackers leak personnel data of 41,000+ Homeland Security staff, including ICE and border agents Graham Cluley