News

"This Public Service Announcement is a follow up to SA-CORE-2014-005 - Drupal core - SQL injection. This is not an announcement of a new vulnerability in Drupal." If you read my newsletter every week you already knew about this and should have already taken action. 163

Did you know you can request json and xml from Drupal.org entities? Well, you can. Check out the work the Drupal.org team are doing. 162

"Drupal 7 includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks. A vulnerability in this API allows an attacker to send specially crafted requests resulting in arbitrary SQL execution. Depending on the content of the requests this can lead to privilege escalation, arbitrary PHP execution, or other attacks. This vulnerability can be exploited by anonymous users." 161

Since I compose the newsletter on Tuesdays by the time you read this I hope you will in the process of updating you Drupal installations because I hear this security update is going to be a big one. 160