The **Drupal** project has issued an urgent warning regarding a critical security vulnerability in its **Commerce Core** component, which is actively being exploited in the wild. The flaw, tracked as **CVE-2026-118539**, is an authorization bypass that affects **Commerce Core** versions ranging from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.  ### The Critical Flaw in Commerce Core **Drupal** describes the module as enabling users to "sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs." The core issue lies in insufficient protection of certain routes and entity fields, leading to an access bypass that could severely impact vendors financially. While **Drupal** confirmed active exploitation, specific details regarding the nature or scale of the attacks have not been disclosed. ### Immediate Action Required To mitigate the risk, users are strongly advised to update their **Commerce Core** installations immediately: * For **Commerce Core** 3.x, upgrade to version 3.3.13. * For earlier versions, upgrade to **Commerce Core** 8.x-2.41. **Drupal** has credited researchers **Dan Puccetti** (dpuccetti), **Marcus Johansson** (marcus_johansson), and **Robert Snyder** (rsnyd) for responsibly reporting the vulnerability. ### Broader Threat Landscape: PHP2Shell Exploitation Continues This disclosure comes as the cybersecurity community grapples with ongoing active exploitation of two critical vulnerabilities in **PHP**, collectively known as **PHP2Shell**. These flaws, **CVE-2026-109618** and **CVE-2026-109619**, both carry a CVSS score of 9.2. Cloud security firm **Wiz**, owned by **Google**, reported that as of October 25, the percentage of organizations significantly affected by **PHP2Shell** had slightly declined to 52.1%. **Wiz** researchers **Yaara Shriki**, **Shahar Dorfman**, **Alma Blachsan**, and **Yaron Samuel** have observed two primary types of exploitation activity: 1. Attempts using the **PHP2Shell** exploit mechanism that align with publicly available proof-of-concept (**PoC**) exploits. 2. Activities involving "PHP2Shell-branded tools unrelated to the vulnerabilities that instead relied on session poisoning and a separate local file inclusion (**LFI**) vulnerability in the application." **Wiz** emphasizes the challenges for attackers in reliably weaponizing these vulnerabilities, noting, "Our observations show that triggering memory exhaustion alone is not enough to complete the exploit chain. Differences in PHP builds, memory limits and worker behavior can prevent subsequent stages from working. The challenge for opportunistic attackers is turning currently available public PoCs into similarly reliable operational tooling or developing it on their own." The active exploitation of both **Drupal Commerce Core** and **PHP2Shell** underscores the critical need for prompt patching and robust vulnerability management practices across web infrastructure.