A critical SQL injection flaw in Drupal Core (CVE-2026-9082, CVSS 9.5) moved from patch release to confirmed active exploitation in under 48 hours. According to vendor telemetry reports, attackers have made over 15,000 documented attempts against approximately 6,000 sites across 65 countries, with gaming and financial services organizations accounting for roughly half of observed targets. Current attack patterns indicate adversaries are in active reconnaissance and initial access phases, meaning organizations running unpatched Drupal instances have a narrowing window to remediate before data extraction or privilege escalation attempts begin.