fidzu : cms

The Netherlands has committed to greater open-source collaboration. But what will it take to turn that commitment into shared digital services that governments can develop and maintain together?

30 Oct 2026 1:28pm GMT

Why it is a migration, not an upgrade Drupal 10 or Drupal 11? The steps of a Drupal 7 migration The risks to keep under control What makes a migration cost more or less What if I don't migrate yet? Drupal migrations with Omitsis Drupal 7 reached its end of life on 5 January 2025. Since then it gets no security fixes from the community, and every month there are more abandoned modules, more incompatibilities with new PHP versions and more risk. If your website still runs on Drupal 7, the question is no longer whether to migrate, but how to do it without losing content, Google...

30 Oct 2026 10:08am GMT

This post is being published in consultation with the Drupal Security Team.

As the maintainers of Drupal Commerce, we are advising users to upgrade immediately to the recently published releases of Commerce Core to protect against a vulnerability that may have financial impact.

We received two reports of attempts by malicious users to place fraudulent orders using a vulnerability patched in Commerce Core 3.3.13 and 8.x-2.41 (SA-CONTRIB-2026-254). Centarro and the Drupal Security Team looked for broader abuse of this issue. As of now we do not believe it was scripted or exploited beyond the initial sites.

We analyzed the issue in private with the Drupal Security Team, who coordinated the testing, packaging, and release of the module updates on October 28, 2026.

Attempted exploits have been observed on live sites

Those who reported the issue were merchants who observed suspicious activity on live sites, not merely security researchers evaluating the platform for vulnerabilities. Given that merchants observed this behavior, we highly recommend every user evaluate recent orders to determine whether or not any were fraudulently placed.

This vulnerability impacts both full-stack and headless sites, with attack vectors that differ based on the site's architecture.

Identifying potential exploits

To determine if any of your recent orders were fraudulently placed or otherwise manipulated, evaluate them according to the following rubric organized according to exploits of increasing sophistication. Every Drupal Commerce site is unique, so you should evaluate the results of each item based on your knowledge of the legitimate behaviors your site supports.

Read more

29 Oct 2026 10:31pm GMT