The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Drupalgeddon2 is the name commonly used for CVE-2018-7600, a critical remote code execution flaw disclosed in March 2018. It affected Drupal 6, 7 and 8, and a remote attacker did not need an account to exploit it. The flaw was fixed in historical Drupal releases, but an unpatched site still running an affected version can remain at risk—and patching a site that was already compromised does not necessarily remove an attacker’s backdoor.
What is Drupalgeddon2?
Drupalgeddon2 is CVE-2018-7600, a Drupal vulnerability that could let an unauthenticated attacker execute code on an affected website. SecurityWeek’s March 29, 2018 report said a successful attack could give the attacker full control of the site, including access to non-public data and the ability to modify or delete system data.
The word “Drupalgeddon” can also refer to a different incident from 2014. That earlier flaw was CVE-2014-3704, a SQL injection vulnerability in Drupal 7. The two vulnerabilities have different identifiers, technical causes and fixes.
Is CVE-2018-7600 still dangerous?
The vulnerability remains a concern for sites that still run an affected, unpatched release. The listed fixes were released in 2018, so the issue is not new; however, an old or abandoned installation may never have received them. A site’s age or appearance alone cannot show whether it is vulnerable.
#1 Best Overall
The releases listed as fixes below are historical security updates, not a recommendation to run those old versions today. Site owners should use a currently maintained Drupal release and follow the applicable upgrade guidance. If a site is on an affected release and cannot be safely updated immediately, do not leave it serving vulnerable pages to visitors: Drupal developers told SecurityWeek in 2018 that temporarily replacing a site with a static HTML page was an effective mitigation.
Which Drupal versions were vulnerable?
The two incidents are easy to confuse because both were severe and both became known as Drupalgeddon. Their key differences are:
Rank #2
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
| Incident | Vulnerability and affected versions | Authentication | Fixes reported | Exploitation and recovery |
|---|---|---|---|---|
| Drupalgeddon2, disclosed in 2018 | CVE-2018-7600; remote code execution affecting Drupal 6, 7 and 8 (SecurityWeek, March 2018) | No authentication required (SecurityWeek, March 2018) | Drupal 7.58, 8.5.1, 8.3.9 and 8.4.6; Drupal 6 also received a fix despite being end-of-life. The specific Drupal 6 fix release is not stated in SecurityWeek’s report. | The report describes potential exposure, not a verified number of compromises. It does not state an exploitation timeline. Patching alone should not be treated as proof that a previously compromised site is clean. |
| Original Drupalgeddon, disclosed in 2014 | CVE-2014-3704; SQL injection in Drupal 7’s database abstraction API (Drupal Security Team advisory) | Anonymous users could exploit it (Drupal Security Team advisory) | Drupal 7.32, or the temporary database.inc patch described by Drupal | Drupal reported automated attacks compromising unpatched Drupal 7 sites within hours of disclosure. Its later PSA warned that updating did not remove backdoors. |
Drupal’s 2014 advisory rated CVE-2014-3704 25/25, “Highly Critical.” That rating belongs to the 2014 SQL injection flaw; it should not be used as a rating for CVE-2018-7600.
How many Drupal websites were affected?
SecurityWeek described the 2018 flaw as putting more than one million Drupal websites at risk of being hacked. That figure was an estimate of possible exposure, not a count of confirmed compromises. The available reporting does not establish an authoritative number of sites actually breached through CVE-2018-7600.
Numbers reported about the separate 2014 incident also require care. Drupal’s Security Team said it did not know the total number of affected sites, rejected press claims of 12 million, and estimated that the specifically vulnerable Drupal 7 population was more likely under one million. Those figures concern CVE-2014-3704, not Drupalgeddon2.
How can you tell whether a Drupal site was hacked?
Knowing that a site ran a vulnerable version tells you it may have been exposed; it does not prove that it was compromised. Conversely, a site that looks normal is not necessarily clean. The cited advisories do not provide a definitive checklist of indicators that can confirm or rule out compromise.
- Check the site’s exact Drupal version and update history against the affected releases and fixes in the table.
- Have a qualified administrator or incident responder review server, Drupal and hosting logs, files, database contents, user accounts and configuration for unauthorized changes.
- Preserve a copy of the site and relevant logs before making changes, so evidence is not lost during cleanup.
- Ask the server administrator to assess the wider hosting environment; Drupal’s 2014 PSA warned that other applications on the same server could also be exposed.
Because hidden changes may be difficult to find, a version check or a quick visual inspection cannot substitute for a security investigation when compromise is suspected.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Does patching Drupal remove a backdoor?
No. A security update closes the vulnerability addressed by that update; it does not reliably remove malicious files or other changes an attacker may already have made. In its October 2014 PSA about CVE-2014-3704, the Drupal Security Team put it plainly: “Simply updating to Drupal 7.32 will not remove backdoors.” That warning is a recovery lesson for compromised sites, not a claim that every site affected by the 2018 flaw was breached.
Quick Recap
What should you do if compromise is suspected?
- Limit access. Take the site offline or stop it from serving the vulnerable application while you assess it. Drupal developers described a static HTML replacement as an effective temporary mitigation in SecurityWeek’s March 2018 report.
- Notify the server administrator. Ask them to assess the host and any other applications sharing it.
- Preserve evidence. Keep a copy of the site and relevant logs for analysis before attempting cleanup.
- Restore from a trustworthy point. Use a backup known to predate the suspected compromise, then apply security updates before returning the site to service. Drupal’s specific October 15, 2014, backup guidance applied to the original Drupalgeddon incident; it is not a universal cutoff date for CVE-2018-7600.
- Audit before reopening. Review restored files, merged code and configuration for unauthorized changes. If you cannot establish that the site is clean, rebuilding from a trusted source may be safer than trying to remove every backdoor; Drupal warned that finding them all may be impossible.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
