Some weeks the Drupal security team publishes a tidy handful of advisories. This week it published 39 in a single batch, which is less "patch notes" and more "extended director's cut with bonus features." If your site sells things, handles logins, or runs the AI module, pour a coffee: it's your turn.
A Highly Critical Hole in the Checkout
The headliner is SA-CONTRIB-2026-254, an access bypass in Commerce Core rated Highly critical at 21 out of 25. According to the advisory, the module doesn't sufficiently protect certain routes and entity fields, which "can financially impact the vendor" — and the Drupal Security Team says the flaw is being actively exploited in the wild.
The fix is Commerce Core 3.3.13 for 3.x sites, or 8.x-2.41 for older branches. The advisory also tells store owners to audit their orders for inconsistencies, which is security-speak for "check whether someone has already helped themselves to the discount aisle."
Payments, Logins, and AI Got the Most Homework
The breadth of the batch is the real story. The contributed AI module alone picked up eight advisories, mostly cross-site scripting with one rated Critical, alongside access bypass and information disclosure issues. OAuth Login (OAuth OIDC SSO) got a Critical authentication bypass, Single Content Sync a Critical remote code execution, and Commerce Stripe a Critical cross-site request forgery fix. In other words, the modules businesses bolt on for payments, sign-on, and shiny AI features are exactly where the bugs clustered.
The part most people will scroll past: three modules — GroupEx PRO, PayUmoney for Drupal Commerce, and CacheFlush — were marked unsupported with known, unfixed issues. No patch is coming for those, so "we keep our updates current" means nothing if your site depends on a project nobody maintains anymore. Your composer.json may be quietly hosting a few ghosts.
Drupal's security process remains one of the most disciplined in open source; it just can't run the update for you.
If you'd rather not spend tonight cross-referencing 39 advisories against your module list and combing through order history, our team can triage, patch, and audit your Drupal site before the exploit traffic finds it.
Source: Drupal.org Security Advisories