Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw

Drupal's Commerce Core module has a critical authorization bypass vulnerability (CVE-2026-118539) actively exploited by hackers, risking financial harm to vendors. Users should update to versions 3.3.13 or 8.x-2.41. Separately, PHP vulnerabilities known as PHP2Shell continue to see exploitation attempts, though impact is declining.