-1

I have updated various Drupal 7 sites to version 7.59 (and included all relevant updates) because of the security update. However I've still experienced issues with sites being hacked, there were also no warnings or issues reported on the site report when the update was completed. Yesterday an attack lead to malicious phishing code being inserted into a website, Google has now flagged this site. The malicious code has now been removed.

Are there any other known security vulnerabilities or patches that are available for Drupal 7?

closed as too broad by Kevin, leymannx, Shawn Conn, Елин Й., Yusef Mohamadi May 30 '18 at 21:23

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • No good way to answer this without full access to the entire application. – Kevin May 29 '18 at 18:29
  • Probably your site was hacked before you done the updates. When did you update your sites? Immediately after they were published? If not, according to Drupal.org, "[s]ites not patched by Wednesday, 2018-04-11 may be compromised. This is the date when evidence emerged of automated attack attempts. It is possible targeted attacks occurred before that." FAQ: groups.drupal.org/security/faq-2018-002 If your site got hacked: drupal.org/docs/develop/security/… – Елин Й. May 30 '18 at 13:16
  • @ЕлинЙ. Yes the site was hacked before the updates were done. The clean site went back up though. Could there be a further vulnerability? – user1532669 May 30 '18 at 14:53
  • If the site was hacked before, my advice is that you install your backups to a new server. The once hacked server is contaminated and you cannot be sure that the attacker has installed any backdoors. You should also make sure that your backups are clean. Please read this page: drupal.org/docs/develop/security/… – Елин Й. Jun 1 '18 at 9:55
3

Most likely there are still hacked/inserted files in your code base thats leaving an opening for the attacker to rexploit. After updating to 7.59 you need to go through the files/code and remove anything that's not supposed to be there. Very hard if you're not using git. Also also includes the /sites/default/files folder and subfolders as well as all other directories

Not the answer you're looking for? Browse other questions tagged or ask your own question.