All news
Drupal Commerce Core: access bypass exploited without login – update, then audit your orders
On October 28, Drupal's security team warned of active attacks on a highly critical access bypass in Commerce Core, the module that adds carts and checkout to Drupal sites. An attacker needs no account. Fixed releases are out; Drupal asks shops to go through their orders and warns the flaw may cost the seller money.