Drupal Commerce Flaw Under Active Attack: Online Shops Urged to Update

Drupal has issued a warning that attackers are exploiting a "highly critical" vulnerability in Commerce Core, the module used to sell goods and services through a shopping cart and checkout form, or through API-driven applications. The flaw is tracked as CVE-2026-118539 and no CVSS score has been given. It affects Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.

According to Drupal's advisory, the module does not sufficiently protect certain routes and entity fields. This allows an access bypass that may financially impact the vendor. Drupal confirmed the flaw is being "actively exploited in the wild", but it has not shared details about the activity or how widespread the campaign is. Users are recommended to update to the latest version. Drupal credited researchers Dan Puccetti, Marcus Johansson and Robert Snyder with reporting the issue.

The news comes as two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2), collectively called PHP2Shell, also face exploitation attempts. Wiz reports that as of October 25 the share of organisations significantly affected has fallen to 52.1%. Its researchers observed attempts matching public proof-of-concept exploits, plus unrelated PHP2Shell-branded tools using other weaknesses. They noted that differences in PHP builds and settings can stop attacks from completing.