The U.S. Cybersecurity and Infrastructure Security Agency has issued a mandate requiring federal agencies to patch an actively exploited SQL injection vulnerability in Drupal by Wednesday evening.
CISA's directive targets a critical security flaw in Drupal, a widely used open-source content management system deployed across government and private sector infrastructure. The SQL injection vulnerability allows attackers to access or manipulate databases on affected servers.
The agency classified the vulnerability as actively exploited, meaning threat actors are already leveraging it in real-world attacks. This designation elevates the urgency for all federal civilian agencies to apply patches immediately.
Government agencies have until the end of business Wednesday to deploy the necessary security updates. CISA typically enforces such deadlines through its Binding Operational Directive (BOD) authority, which compels compliance across federal information systems.
SQLi vulnerabilities remain among the most dangerous attack vectors. Successful exploitation grants attackers direct access to backend databases, potentially exposing sensitive information including personal data, authentication credentials, and classified government information.
Drupal is maintained by a community-driven project and released its patches for the vulnerability before CISA's announcement. Organizations running Drupal installations are advised to update to patched versions immediately, regardless of whether they receive federal directives.
The vulnerability is not limited to U.S. government systems. Private sector organizations, educational institutions, and international entities using vulnerable Drupal versions face similar risks. Security researchers recommend treating this as a priority patch.
CISA regularly flags actively exploited vulnerabilities to accelerate patching timelines. The agency maintains a catalog of known exploited vulnerabilities and publishes regular advisories to help organizations prioritize remediation efforts.
Administrators unable to patch immediately should implement compensating controls such as web application firewalls, network segmentation, and enhanced monitoring for suspicious database activity.
U.S. federal prosecutors have unsealed charges against three Russian nationals accused of operating a bulletproof hosting service that supported ransomware gangs responsible for over $62 million in damages worldwide.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that attackers are actively exploiting three vulnerabilities in Internet-exposed on-premises SharePoint Server instances. Organizations running affected versions must patch immediately.
Tailscale disclosed a critical vulnerability in its SSH implementation that allowed attackers to gain root access through insecure argument handling. The flaw has been patched in recent versions.
A new study found that social media platforms referred over 5.7 million visits to nonconsensual deepfake pornography sites between December 2025 and March 2026, with YouTube and X accounting for the majority of traffic.