Active Exploitation of Drupalgeddon2 Exposes Drupal Sites to Remote Code Execution
Active Exploitation · 3 sources · Updated 1mo ago · First seen Apr 23, 2018
CERT-UA warned that attackers were actively exploiting Drupalgeddon2 (CVE-2018-7600), a highly critical Drupal core vulnerability that allows arbitrary code execution and website compromise. Drupal released security updates on March 28, 2018, but a working exploit subsequently became widely used. The warning advised that websites not updated by April 11, 2018, should be considered potentially compromised, making incident investigation—not just patch installation—a priority for affected operators.
The notice also highlighted an April 23 announcement concerning additional updates for CVE-2018-7602. Its historical remediation guidance recommended Drupal 7.59, 8.5.3, or 8.4.8; operators on the unsupported 8.4.x branch were advised to migrate to 8.5.x or apply the referenced patches. These versions are historical fixes, not current upgrade targets. Organizations still operating affected legacy deployments should move to a currently supported, fully patched release and investigate possible compromise, because updating Drupal alone does not remove attacker access or malicious changes already introduced.
