Drupal Vulnerability: Mass Scans & Targeted Exploitation

Summary: A critical SQL injection vulnerability in Drupal 7 was disclosed on October 15, 2014 by Stefan Horst in SA-CORE-2014-005, allowing anonymous users to send specially crafted requests that result in arbitrary SQL execution, privilege escalation, or arbitrary PHP execution. Proof-of-concept exploit code appeared online within hours, and Volexity observed mass scanning and multiple confirmed breaches, including IP addresses associated with APT attackers targeting its customers' websites.
Why it matters: The published patch itself became the exploit roadmap: PoC code was posted within hours, and attackers were running the exact posted code unchanged against targets, with Volexity confirming breaches at multiple organizations before many had patched.

Read the original at Volexity Blog ↗

Topics: Supply Chain & AppSec
Related: Kitesurf is now open source Cyber Risks · Nov 13, 2026
Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026
ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026