CERT-FR Warns of Drupal Core Vulnerabilities
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CERT-FR advisory covers multiple Drupal core flaws enabling remote code execution and XSS; patch to 10.6.19, 11.3.19 or 11.4.10.
CERT-FR has published an advisory detailing multiple vulnerabilities in Drupal core affecting versions 10.6.x prior to 10.6.19, 11.3.x prior to 11.3.19, and 11.4.x prior to 11.4.10. The vulnerabilities, tracked as CVE-2026-108097, CVE-2026-108514, and CVE-2026-108515, correspond to Drupal security bulletins SA-CORE-2026-014, SA-CORE-2026-015, and SA-CORE-2026-016, all published on 14 October 2026.
The flaws allow an attacker to achieve remote arbitrary code execution and indirect remote code injection (cross-site scripting). No detail on exploitation in the wild is provided in this advisory. Defenders running affected Drupal installations should apply the vendor patches referenced in the Drupal security bulletins as soon as possible and confirm their core version meets or exceeds the fixed releases (10.6.19, 11.3.19, 11.4.10).
Mentioned in this report
Detection guidance
Web Server or PHP Process Spawning Shell with Post-Exploitation Commands
Detects a web server or PHP-FPM process (for example one hosting Drupal) spawning a shell that runs download, reverse-shell or recon commands, a typical post-exploitation pattern after web application RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server or PHP Process Spawning Shell with Post-Exploitation Commands
description: Detects Apache, nginx, httpd or PHP-FPM parent processes spawning a shell
whose command line contains download, reverse-shell, encoding or recon commands.
Behavioural indicator of remote code execution against a PHP web application such
as Drupal core. The advisory gives no exploit specifics, so this rule covers post-exploitation
behaviour only.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- /php-fpm
- /apache2
- /httpd
- /nginx
- /php-cgi
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- curl
- wget
- whoami
- /dev/tcp/
- base64
- chmod +x
- nc -e
- python -c
- perl -e
- uname -a
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Web applications or admin panels that legitimately shell out to curl or wget for
update or health checks
- Deployment or monitoring scripts triggered through the web server user
level: medium
id: 35960b8b-ec12-5f59-83a2-98fe5f8e4039
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1321
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1321
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs