Drupal Commerce vulnerability is actively exploited
A Drupal Commerce vulnerability caused by missing authorization checks is being actively exploited, according to Drupal. Authorization checks are the rules that determine whether a visitor or account is allowed to access a function or change information. The flaw is tracked as CVE-2026-118539, a standard identifier used to catalogue publicly disclosed security vulnerabilities. No Common Vulnerability Scoring System (CVSS) rating is listed, although Drupal classifies the issue as highly critical.
The vulnerability affects Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13. Commerce Core adds online-selling functions to Drupal, including a shopping cart and checkout form. It can also support separate applications through application programming interfaces (APIs), which let different software systems exchange information and commands.
Drupal says Commerce Core does not adequately protect some routes and entity fields. A route is a path within a web application that leads to a particular page or function, while an entity field is a stored piece of information associated with an item such as a product, order or customer record. The resulting access bypass could have a financial effect on the merchant operating the store. Drupal has not described what attackers are doing with the flaw or how broad the exploitation activity is, so the exact consequences observed in affected stores remain unconfirmed.
The version information requires particular care. Drupal recommends that sites on the 3.x branch upgrade to Commerce Core 3.3.13, while earlier installations should move to Commerce Core 8.x-2.41. However, those releases are also the endpoints of the affected ranges as stated. Because the affected ranges and recommended upgrade targets overlap as written, administrators should consult the current Drupal advisory before deciding that an installation is no longer exposed. Drupal credited three researchers with reporting the vulnerability.
For website owners, the immediate task is to establish whether the site uses Commerce Core and identify its installed version. Stores within either stated range should be treated as potentially affected while the version discrepancy is checked. Site owners who do not manage Drupal components themselves should ask their developer or hosting administrator to confirm the installed release and apply Drupal's current guidance. Because the reported weakness concerns access to routes and stored fields, operators should also review store activity and financial records for changes they do not recognize.
Separately, two critical PHP vulnerabilities called PHP2Shell are also seeing active exploitation attempts. PHP is software widely used to run dynamic websites and web applications. The flaws are CVE-2026-109618 and CVE-2026-109619, and each has a CVSS score of 9.2. CVSS is a numerical scale used to describe the technical severity of a vulnerability.
Cloud security company Wiz reported that, as of October 25, the proportion of organizations significantly affected by PHP2Shell had fallen to 52.1%. Wiz identified two kinds of activity. One involved attempts using the PHP2Shell exploitation method that matched publicly available proof-of-concept (PoC) code, which is demonstration code showing that a vulnerability can be triggered.
The second category consisted of tools using the PHP2Shell name even though they were unrelated to the two vulnerabilities. Wiz said these tools instead depended on session poisoning, which manipulates information stored for a user's website session, and a separate local file inclusion (LFI) flaw in an application. LFI is a weakness that can let an application load a local file it should not expose.
Wiz also found that causing memory exhaustion, meaning consuming the memory available to PHP, was not by itself sufficient to complete the PHP2Shell attack chain. Differences among PHP builds, configured memory limits and the behavior of worker processes could stop later stages. According to the company, opportunistic attackers would still need to turn public PoC code into more reliable operational tools or develop their own methods.
For organizations that need help managing this kind of website and infrastructure risk, AEU-I provides security-first IT, infrastructure and consulting. Regardless of provider, Drupal Commerce operators should verify their version promptly, follow the current advisory and investigate unexplained store or financial activity rather than assuming that an update target is safe without confirmation.