PHP and Drupalgeddon2: why CVE-2018-7600 still matters

A flaw that went far beyond Drupal alone

Drupal official advisory SA-CORE-2018-002 rated CVE-2018-7600 as a highly critical remote code execution vulnerability. Soon after, Drupal also published a public service announcement stating that sites not patched in time should be considered at risk of compromise.

That official response alone shows how serious the issue was.

Why this CVE is still a landmark

Drupalgeddon2 became a landmark because it affected a mature CMS used in demanding environments and highlighted the danger of delayed patching on feature-rich administrative platforms.

This was not just a technical issue. It was also an operational one: how many sites could patch immediately, how many were delayed, and how many were simply forgotten.

What this says about PHP risk

When people criticize PHP, they often focus on the language itself. In practice, many major incidents come from the CMS, plugin, module, and maintenance layer around the language. Drupalgeddon2 fits that pattern perfectly.

A powerful PHP CMS becomes very sensitive when it concentrates content, workflows, privileged accounts, and extensions inside one exposed web surface.

The useful lesson in 2026

For teams still operating rich CMS platforms, the right questions are not only is the core well designed. They are also:

Our view

Drupalgeddon2 still matters because it captures a very practical risk: when a critical flaw hits a business-central CMS, the gap between disclosure and exploitation becomes very small.

In the PHP ecosystem, the first thing to judge is therefore not the language. It is the admin surface, the active modules, and the patch discipline around exposed platforms.