Drupal and PHP stack breach guide
Published 4 Nov 2026 · Updated 2026-11-04
If your website runs Drupal 10, plan the upgrade to Drupal 11 now: Drupal 10 reaches end of life on 9 December 2026 and gets no security releases after that. Whatever version you run, confirm you are on a patched release for CVE-2026-9082, a core SQL injection that CISA lists as exploited in the wild, and keep PHP on a supported branch.
Who this is for: Australian government agencies, charities, universities and member organisations running a Drupal or GovCMS website, usually maintained by an agency or internal web team. Written by our collective of Melbourne web and app developers; facts checked against NVD, the CISA KEV catalog and vendor advisories on 2026-11-04. Free to use and share.
Book a free stack check Already breached? First steps
Supported versions
Drupal
Drupal core gets security releases for the current and previous minor branches only. Drupal 10 reaches end of life on 9 December 2026, the same week Drupal 12.0.0 and 11.5.0 ship; 11.3.x and 10.6.x security support also ends that week. Drupal 7 ended on 5 January 2025.
| Branch | Active support | Security support until |
|---|---|---|
| 11.4 | Current minor | 21 April 2027 |
| 11.3 | — | Week of 7 December 2026 |
| 10.6 (last Drupal 10 minor) | — | 9 December 2026 (Drupal 10 end of life) |
| 10.5, 11.2 and older | — | Ended |
| 7 | — | End of life (5 January 2025) |
Source: Drupal official lifecycle (checked 2026-11-04).
PHP
| Branch | Active support | Security support until |
|---|---|---|
| 8.1 and older | — | End of life |
| 8.2 | 2024-12-31 | 2026-12-31 |
| 8.3 | 2025-12-31 | 2027-12-31 |
| 8.4 | 2026-12-31 | 2028-12-31 |
| 8.5 | 2027-12-31 | 2029-12-31 |
Source: PHP official lifecycle (checked 2026-11-04).
Drupal 10 end of life on 9 December 2026
What the issue is
Drupal 10.6 is the last Drupal 10 minor release. On 9 December 2026 Drupal 10 stops receiving security releases, so any vulnerability found after that date will not be fixed for Drupal 10 sites.
Why it matters
Drupal advisories are scanned for and exploited quickly. A site left on an unsupported major version builds up known, unfixable issues, and for public-facing government or charity sites that hold form submissions or donor details, that is a direct breach and compliance risk.
How to fix it
- Confirm your exact core version in Reports > Status report.
- Run the Upgrade Status module to list contributed modules and custom code that are not yet Drupal 11 compatible.
- Update everything to the latest Drupal 10.6 release first, then upgrade to Drupal 11 in a staging environment.
- Check that your hosting runs a PHP version Drupal 11 supports.
- Schedule the production upgrade before 9 December 2026 and keep a rollback plan.
Sources: Drupal core release schedule · Drupal: Security in Drupal
CVE-2026-9082: exploited SQL injection in Drupal core
What the issue is
A flaw in Drupal core's database abstraction API allows SQL injection. NVD lists it as affecting Drupal 8.9.0 onward until the fixed releases 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12 and 11.3.10.
Why it matters
CISA added CVE-2026-9082 to its Known Exploited Vulnerabilities catalog on 22 May 2026 and says it could allow privilege escalation and remote code execution. Attackers who reach the database can read user accounts and stored submissions.
How to fix it
- Update Drupal core to the latest release on a supported branch (composer update drupal/core-* --with-dependencies).
- Clear caches and confirm the new version in the Status report.
- Review administrator accounts and recent content changes for anything unexpected.
- Check web server and database logs from May 2026 onward for unusual requests if you patched late.
- Subscribe to Drupal core security advisories so the next release is applied within days.
Sources: NVD: CVE-2026-9082 · Drupal: SA-CORE-2026-004 · CISA KEV catalog
Key high and critical CVEs for this stack
These are recent high or critical vulnerabilities. "KEV" means CISA lists it as known to be exploited in the wild.
| CVE | Component | Affected | Fixed in | CVSS | KEV |
|---|---|---|---|---|---|
| CVE-2026-9082 | Drupal: SQL injection in the core database abstraction API that may allow privilege escalation and remote code execution | 8.9.0 before 10.4.10; 10.5.0 before 10.5.10; 10.6.0 before 10.6.9; 11.0.0 before 11.1.10; 11.2.0 before 11.2.12; 11.3.0 before 11.3.10 | 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10 (or any later release) | See NVD | Yes (added 2026-05-22) |
| CVE-2018-7600 | Drupal: "Drupalgeddon 2" remote code execution in Form API (historic, still exploited against unpatched Drupal 7 and 8 sites) | Drupal 7.x before 7.58, 8.x before 8.3.9 / 8.4.6 / 8.5.1 | 7.58, 8.3.9, 8.4.6, 8.5.1 | 9.8 (CVSS 3.1, NVD) | Yes (added 2021-11-03) |
| CVE-2026-109618 | PHP: Out-of-memory handling memory corruption leading to unauthenticated remote code execution | 5.x/7.3 up to 8.2.34, 8.3.0–8.3.35, 8.4.0–8.4.26, 8.5.0–8.5.11 (7.3.0+ per NVD) | 8.2.35, 8.3.36, 8.4.27, 8.5.12 | 9.2 (CVSS 4.0, PHP) | Yes (added 2026-10-26) |
| CVE-2026-109619 | PHP: Stale internal request state leading to unauthenticated remote code execution | 5.4.0 up to 8.2.34, 8.3.0–8.3.35, 8.4.0–8.4.26, 8.5.0–8.5.11 | 8.2.35, 8.3.36, 8.4.27, 8.5.12 | 9.2 (CVSS 4.0, PHP) | Yes (added 2026-10-26) |
| CVE-2024-4577 | PHP: PHP-CGI argument injection on Windows (Apache + PHP-CGI, certain code pages) | 8.1 before 8.1.29, 8.2 before 8.2.20, 8.3 before 8.3.8 | 8.1.29, 8.2.20, 8.3.8 | 9.8 (CVSS 3.1, PHP) | Yes (added 2024-06-12) |
How attacks on this stack typically work
- Automated scanners look for unpatched Drupal core and contributed modules within days of an advisory; the Drupalgeddon issues were mass-exploited.
- SQL injection in core can expose user tables and form submissions, and can lead to a full site takeover.
- Phished administrator or editor credentials let attackers insert malicious scripts or change published information.
- End-of-life sites stop receiving fixes, so every later advisory becomes a permanent open door.
Patch and hardening steps
- Find your exact versions. Ask your agency or web team for the exact drupal/core version (Reports > Status report in the admin, or composer.lock) and the PHP version. Many sites only show the major version, such as 'Drupal 10', in the page source, which is not enough to know if you are patched.
- Back up first (files and database), and keep the backup off the server.
- Update Drupal to at least: 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10 (or any later release); 7.58, 8.3.9, 8.4.6, 8.5.1. Move off any end-of-life branch.
- Update PHP to at least: 8.2.35, 8.3.36, 8.4.27, 8.5.12; 8.1.29, 8.2.20, 8.3.8. Move off any end-of-life branch.
- Remove unused plugins, apps, themes and accounts, and turn on automatic updates for minor and security releases where available.
- Lock down admin: Require multi-factor authentication for every administrator and editor (the TFA module or your identity provider), remove old agency and staff accounts, keep contributed modules updated, and subscribe to Drupal security advisories.
- Check for signs of compromise after patching a KEV-listed flaw: unknown admin users, unexpected new files on the server, changed checkout or header scripts.
- Follow a patching cadence. The ACSC's Essential Eight treats patching applications as a core mitigation.
What this means for your industry
Healthcare clinics, allied health, legal and accounting practices often run a CMS such as WordPress or Silverstripe for bookings and enquiry forms, which collect sensitive personal information. A compromise can become a notifiable data breach: see data breach help for Australian businesses. Industry-specific guides are coming.
Melbourne or Victorian public-sector supplier? See Melbourne and Victorian breach contacts. We will cover reported incidents involving these technologies in our Australian breach news.
Want a second pair of eyes on your stack?
Book a short call and one of our developers will talk through your versions and patch plan. No pressure, no scare tactics.
Frequently asked questions
When does Drupal 10 stop getting security updates?
Drupal's release managers say Drupal 10 reaches end of life on 9 December 2026, the same week Drupal 12 is released, and no new Drupal 10 releases will be made after that date. Source
Which versions fix CVE-2026-9082?
NVD lists the fixed releases as 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12 and 11.3.10. Anything older in those branches may be affected. CISA added the issue to its Known Exploited Vulnerabilities catalog on 22 May 2026. Source
We use GovCMS. Does this apply to us?
GovCMS is a Drupal distribution, so the same core advisories and end-of-life dates apply. The GovCMS platform team handles many core updates on its hosted platform, but you should still confirm with them which version your site is on and when the Drupal 11 move is scheduled. Source
I think our site was compromised. What first?
Contain it, keep logs, reset administrator passwords, report to the ACSC and assess whether the Notifiable Data Breaches scheme applies. Source
Related stack guides
- Adobe Commerce (Magento) and PHP stack breach guide
- Next.js, React and Node.js stack breach guide
- PHP + WordPress stack breach guide
- Shopify store security guide
- Silverstripe CMS, PHP and jQuery stack breach guide
- Webflow and hosted CMS security guide
- WordPress, PHP and Node.js stack breach guide
- WooCommerce, WordPress and PHP stack breach guide
- All stack security guides
Sources
- www.drupal.org/about/core/policies/core-release-cycles/schedule
- nvd.nist.gov/vuln/detail/CVE-2026-9082
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9082
- www.drupal.org/sa-core-2026-004
- nvd.nist.gov/vuln/detail/CVE-2018-7600
- www.drupal.org/sa-core-2018-002
- www.php.net/supported-versions.php
- nvd.nist.gov/vuln/detail/CVE-2026-109618
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618
- github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
- www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
- nvd.nist.gov/vuln/detail/CVE-2026-109619
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619
- github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- nvd.nist.gov/vuln/detail/CVE-2024-4577
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4577
- www.php.net/ChangeLog-8.php
- www.drupal.org/docs/administering-a-drupal-site/security-in-drupal
- www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight
General information only, not legal or professional advice. Versions and CVEs change quickly; always confirm against the vendor before acting.