Damn! You have to update your Drupal websites.

Yes, of course once again—literally it’s the third time in last 30 days.

As notified in advance two days back, Drupal has now released new versions of its software to patch yet another critical remote code execution vulnerability, affecting its Drupal 7 and 8 core.

Drupal is a popular open-source content management system software that powers millions of websites, and unfortunately, the CMS has been under active attacks since after the disclosure of a highly critical remote code execution vulnerability.

The previously disclosed critical vulnerability, dubbed Drupalgeddon2 (CVE-2018-7600), was patched on March 28, but possibly the changes made to fix this flaw might have opened another critical loophole in the core software, forcing the Drupal team to release a follow-up patch.

According to a new advisory released by the team, the new remote code execution vulnerability (CVE-2018-7602) could also allow attackers to take over vulnerable websites completely.

Since the previously flaw has derived much attention and motivated attackers to target websites running over Drupal, the company has urged all website administrators to install new security patches as soon as possible.

• If you are running 7.x, upgrade to Drupal 7.59.
• If you are running 8.5.x, upgrade to Drupal 8.5.3.
• If you are running 8.4.x, which is no longer supported, you need first to update your site to 8.4.8 release and then install the latest 8.5.3 release as soon as possible.

"We are not aware of any active exploits in the wild for the new vulnerability," a drupal spokesperson told The Hacker News. "Moreover, the new flaw is more complex to string together into an exploit."

Though the technical details of the flaw have not been released in the advisory, it does not mean you can wait until next morning to update your website, believing it won't be attacked.

We have seen how attackers developed automated exploits and successfully launched attacks, leveraging Drupalgeddon2 vulnerability, within few hours after it's detailed went public and injected cryptocurrency miners, backdoors, and other malware into websites.

Besides these two flaws, the team also patched a moderately critical cross-site scripting (XSS) vulnerability last week, which could have allowed remote attackers to pull off advanced attacks including cookie theft, keylogging, phishing and identity theft.

Therefore, Drupal website admins were highly recommended to update their websites as soon as possible.