importantSYS.SOURCE: The Hacker News• 2026-10-30T13:15:30+05:30

Drupal Commerce Core Authorization Bypass Vulnerability Exploited by Hackers

#vulnerability #security #drupal

Drupal Commerce Core versions 0.0.0-2.41 and 3.0.0-3.3.13 are affected by a critical authorization bypass vulnerability (CVE-2026-118539) being actively exploited by threat actors. The flaw allows unauthorized access to shopping cart functionalities, posing significant risks to e-commerce platforms.

Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component.

The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.

"This module enables you to sell goods and services to customers through an included shopping cart

Read original article

*** END OF TRANSMISSION ***

> SECURITY BREACH AT ANTHROPIC: REMOTE ACCESS TROJAN TARGETING CLAUDE DEVELOPERS > ANTHROPIC SECURITY BREACH INVOLVES REMOTE ACCESS TROJAN DELIVERY > TECHNIQUES FOR IMAGING BLACK HOLES USING THE EVENT HORIZON TELESCOPE > ELECT.HORSE: DAILY GERRYMANDERING PUZZLE GAME > COMPROMISE OF OFFICIAL CLAUDE CODE VS CODE EXTENSION ENABLES PERSISTENT SSH BACKDOOR > DRUPAL COMMERCE CORE AUTHORIZATION BYPASS VULNERABILITY EXPLOITED BY HACKERS > CISA UPDATES KEV WITH ACTIVELY EXPLOITED GITLAB AND CISCO VULNERABILITIES > WAYMO COLLABORATES WITH TOYOTA TO SUPPLY AUTONOMOUS TOYOTA BZ4X VEHICLES FOR JAPAN AND U.K. ROBOTAXI SERVICES > SENIOR OPERATING SYSTEMS/HYPERVISOR ENGINEER POSITION AT WASMER (YC S19)> BINANCE SECURITY INCIDENT IMPACTS $6.3 BILLION IN ASSETS, WITH $3 BILLION FROZEN ON-CHAIN> SECURITY BREACH AT ANTHROPIC: REMOTE ACCESS TROJAN TARGETING CLAUDE DEVELOPERS > ANTHROPIC SECURITY BREACH INVOLVES REMOTE ACCESS TROJAN DELIVERY > TECHNIQUES FOR IMAGING BLACK HOLES USING THE EVENT HORIZON TELESCOPE > ELECT.HORSE: DAILY GERRYMANDERING PUZZLE GAME > COMPROMISE OF OFFICIAL CLAUDE CODE VS CODE EXTENSION ENABLES PERSISTENT SSH BACKDOOR > DRUPAL COMMERCE CORE AUTHORIZATION BYPASS VULNERABILITY EXPLOITED BY HACKERS > CISA UPDATES KEV WITH ACTIVELY EXPLOITED GITLAB AND CISCO VULNERABILITIES > WAYMO COLLABORATES WITH TOYOTA TO SUPPLY AUTONOMOUS TOYOTA BZ4X VEHICLES FOR JAPAN AND U.K. ROBOTAXI SERVICES > SENIOR OPERATING SYSTEMS/HYPERVISOR ENGINEER POSITION AT WASMER (YC S19)> BINANCE SECURITY INCIDENT IMPACTS $6.3 BILLION IN ASSETS, WITH $3 BILLION FROZEN ON-CHAIN