Selling through Drupal Commerce means the patch window closed before you heard about it.
Drupal has warned that threat actors are actively exploiting a "highly critical" flaw in its Commerce Core component, tracked as CVE-2026-118539. It is a missing authorization issue, and the affected range is wide: Commerce Core from 0.0.0 to 2.41, and from 3.0.0 to 3.3.13. The Hacker News reported it on 30 October, with six independent sources covering it.
Missing authorization is the failure mode that leaves the quietest trail. Nothing crashes. The request is well formed, the response looks normal, and the only evidence is an order, a price or an account change that nobody with the right permissions would have made. So patching is the first of two steps. The second is asking what already ran: orders moved to states nobody approved, discounts applied outside any campaign, carts and accounts edited across user boundaries.
We do security review of payment and account flows. That means reading the order lifecycle, pricing rules and permission checks against what the logs actually show, then telling you whether the activity before the patch was normal. A focused review of one checkout path takes days, not months, and you get cost and timeline within a day of describing the setup.
Patch first. Then, if you want a second pair of eyes on the order and pricing endpoints, send us the stack and the version you were running, and we will tell you what is worth auditing and what is not.
For teams who have been through this, we would like to hear what you checked first after an authorization bug, the data or the logs.