Loading story…
Drupal released security updates for CVE-2026-9082, a highly critical SQL injection flaw in Drupal core that affects websites using PostgreSQL databases. The vulnerability stems from improper neutralization of special characters in user input within Drupal's database API, allowing an unauthenticated remote attacker to send crafted requests that can trigger SQL injection.
Successful exploitation could lead to information disclosure, privilege escalation, and in some environments potentially remote code execution. Drupal and downstream defenders urged administrators to upgrade to fixed versions 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, or 11.3.10, while manual patches were also issued for unsupported 8.9 and 9.5 branches; the flaw's severity was raised to CVSS 9.8 after initial scoring understated the risk.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The vulnerability CVE-2026-9082 was initially assigned a CVSS score of 6.5, which was later increased to 9.8. Drupal classified the issue as highly critical.
Drupal developers released security updates for CVE-2026-9082, a highly critical SQL injection vulnerability in Drupal core affecting sites that use PostgreSQL. Fixed versions listed include 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, and 11.3.10, with manual patches also provided for unsupported 8.9 and 9.5 branches.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical SQL injection flaw tracked as **`CVE-2026-12076`** has been disclosed in **Raytha CMS**, with confirmed impact on version **1.5.2**. The vulnerability resides in the platform’s **OData filter parsing pipeline** and allows a remote, unauthenticated attacker to execute arbitrary SQL statements against the underlying **PostgreSQL** database. Successful exploitation could lead to full database compromise, including extraction of stored credentials and other sensitive data. The issue has been rated **CVSS 4.0 9.3 (Critical)** and is considered remotely exploitable. **CERT Polska** coordinated disclosure and credited **Arkadiusz Marta** for the report, but said attempts to contact the vendor were unsuccessful, leaving uncertainty over whether additional versions are affected. Published guidance recommends upgrading to a patched release when available, applying SQL injection defenses, restricting database privileges, and monitoring database logs for suspicious activity.
Jun 30, 2026
Drupal has warned administrators to prepare for an emergency core security release affecting all supported branches, saying the undisclosed flaw is **highly critical**, easy to exploit, and could be weaponized within hours or days of disclosure. According to Drupal and follow-on reporting, the vulnerability requires no privileges and may let attackers expose non-public data or modify or delete site content, although it appears limited to certain uncommon configurations rather than every deployment. A related advisory from dCERT also flagged a Drupal Core vulnerability enabling an unspecified attack. Security updates are scheduled for supported branches `11.3.x`, `11.2.x`, `10.6.x`, and `10.5.x`, with best-effort fixes also planned for older `11.1.x` and `10.4.x` releases. Sites running `8.9` and `9.5` are expected to receive manual patch files only, with warnings about possible regressions and renewed pressure to upgrade to supported versions such as Drupal `10.6` or later; **Drupal 7 is not affected**. Drupal Steward customers were said to be protected against known attack vectors, but Drupal still urged all organizations to reserve maintenance time and apply the patch immediately once released.
Jun 29, 2026
PostgreSQL released security updates for supported branches to fix multiple high-severity vulnerabilities affecting versions before **14.23**, **15.18**, **16.14**, **17.10**, and **18.4**. The most serious issues include **CVE-2026-6473**, an integer wraparound bug that can cause undersized allocations and out-of-bounds writes, and **CVE-2026-6637**, a flaw in the `refint` module that can lead to a stack buffer overflow. In both cases, an unprivileged database user may be able to achieve arbitrary code execution as the operating system account running PostgreSQL. The `refint` issue also exposes a separate SQL injection path when applications use a user-controlled column as a `refint` cascade primary key and allow user-controlled updates, potentially enabling arbitrary SQL execution as the database user performing the update. Debian issued security advisories for **postgresql-15** and **postgresql-17**, and the Canadian Centre for Cyber Security urged administrators to review PostgreSQL’s advisory and deploy the patched releases **14.23**, **15.18**, **16.14**, **17.10**, and **18.4**.
Jun 29, 2026