# CERT-FR Warns of Drupal Core Vulnerabilities

Published: 2026-10-15 · Severity: routine
Canonical: https://vorant.io/reports/716430d3-17e4-5887-977d-443b63be3ee9/cert-fr-warns-of-drupal-core-vulnerabilities

> CERT-FR advisory covers multiple Drupal core flaws enabling remote code execution and XSS; patch to 10.6.19, 11.3.19 or 11.4.10.

CERT-FR has published an advisory detailing multiple vulnerabilities in Drupal core affecting versions 10.6.x prior to 10.6.19, 11.3.x prior to 11.3.19, and 11.4.x prior to 11.4.10. The vulnerabilities, tracked as CVE-2026-108097, CVE-2026-108514, and CVE-2026-108515, correspond to Drupal security bulletins SA-CORE-2026-014, SA-CORE-2026-015, and SA-CORE-2026-016, all published on 14 October 2026.

The flaws allow an attacker to achieve remote arbitrary code execution and indirect remote code injection (cross-site scripting). No detail on exploitation in the wild is provided in this advisory. Defenders running affected Drupal installations should apply the vendor patches referenced in the Drupal security bulletins as soon as possible and confirm their core version meets or exceeds the fixed releases (10.6.19, 11.3.19, 11.4.10).

## Mentioned in this report

- Vulnerabilities: CVE-2026-108097, CVE-2026-108514, CVE-2026-108515

## Detection guidance (public sample)

### Web Server or PHP Process Spawning Shell with Post-Exploitation Commands

ATT&CK: T1190

Detects a web server or PHP-FPM process (for example one hosting Drupal) spawning a shell that runs download, reverse-shell or recon commands, a typical post-exploitation pattern after web application RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server or PHP Process Spawning Shell with Post-Exploitation Commands
description: Detects Apache, nginx, httpd or PHP-FPM parent processes spawning a shell
  whose command line contains download, reverse-shell, encoding or recon commands.
  Behavioural indicator of remote code execution against a PHP web application such
  as Drupal core. The advisory gives no exploit specifics, so this rule covers post-exploitation
  behaviour only.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - /php-fpm
    - /apache2
    - /httpd
    - /nginx
    - /php-cgi
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - curl
    - wget
    - whoami
    - /dev/tcp/
    - base64
    - chmod +x
    - nc -e
    - python -c
    - perl -e
    - uname -a
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Web applications or admin panels that legitimately shell out to curl or wget for
  update or health checks
- Deployment or monitoring scripts triggered through the web server user
level: medium
id: 35960b8b-ec12-5f59-83a2-98fe5f8e4039
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1321
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1321

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/716430d3-17e4-5887-977d-443b63be3ee9/cert-fr-warns-of-drupal-core-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup