A flaw in Drupal's form handling let anyone run code on millions of Drupal sites. It is still scanned for today.
Publicly disclosed: 28 March 2018
On 28 March 2018 the Drupal security team released an urgent update for a vulnerability in Drupal core, later called Drupalgeddon2. Because of how Drupal processed certain form data, an unauthenticated attacker could execute code on the server. Working exploits appeared about two weeks later, followed by mass attacks installing cryptominers and backdoors.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2018-7600 | Critical (remote code execution) | Drupal 6, 7 and 8 before the fix | 7.58, 8.3.9, 8.4.6, 8.5.1 and later |
Sources: Drupal SA-CORE-2018-002, NVD CVE-2018-7600.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.
