Once again, the developers of Drupal are releasing an emergency patch for a critical vulnerability in the popular CMS. The critical security advisory issued on Monday indicates another patch will be released between 16:00 – 18:00 UTC on April 25th, 2018.
Following the remote code execution vulnerability discovered in all versions of Drupal released prior to 28th March 2018, and patched in Drupal 7.58 and Drupal 8.5.1, websites may have been hacked if they have not been updated to Drupal 7.58 (or 8.5.1) by Wednesday, 11th April 2018, may have been hacked after the Drupal security team became aware of automated attacks attempting to compromise Drupal 7 and 8 websites using the vulnerability.
Security releases for Drupal (Drupal 8 version 8.3.4 and Drupal 7 version 7.56) which contain fixes for security vulnerabilities are now available and it's advisable that any websites using earlier Drupal versions are upgraded as soon as possible to keep them secure and prevent hacks and unauthorised access, including information disclosure.
Files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur. This can result in files uploaded to your website being publicly accessible.
The Drupal security team has received reports that this vulnerability is being exploited for spam purposes, similar to the scenario discussed in PSA-2016-003 for the public file system. This could result in your website being used to host images and malicious software that would be damaging to not only visitor computers but also to business reputation and search engine ranking.
We can upgrade your Drupal website for you with our cost effective Drupal upgrade service. Contact us for more details or if you're an O'Brien Media website hosting customer you can view your Drupal version information and request an upgrade via Client Connect, just log in and access the "My products" section for more information.
Previously, we've covered why it's essential to keep your WordPress website, plugins and themes up to date and the same rules apply to sites running any content management system (Drupal, Zencart, Joomla!, etc) but what if you don't? What, aside from the security implications, are there for your website?
First of all, you're going to have to update your website software at some point, let me explain. You can’t keep running an old version of your site software forever. Some day you’re going to want to use a new theme, and your new theme is going to require the latest version. Or you’re going to install a new plugin or module, and it will require an update before you can even start the process.
We’re always trying out new ways to speed up websites to improve user experience and help to reduce waiting times for visitors (and improve conversion
Drupal 7.50, the latest release in the Drupal 7 series as of 8th July 2016, is now available for installation on websites running the 7 series of Drupal. Drupal 7.50 contains a variety of new features, performance improvements, security-related enhancements, and bug fixes – the 7.50 release itself includes no security fixes (although if you haven't installed previous updates the 7.50 release will include previous security fixes).
