As you might know,  6 has reached Finish-of-Life (EOL) which implies Drupal Developer Safety Staff is now not doing Safety Advisories or engaged on safety patches for 6 core or contrib Drupal 10 modules – however Drupal Developer  6 LTS distributors are and we’re considered one of them!Right now, a safety replace for Elysia Cron was launched for 7 per Drupal Developer SA-CONTRIB-2021-062 safety advisory.All Drupal Developer replace does is mark Drupal Developer permission to manage Elysia Cron as “harmful” as a result of it permits customers to execute arbitrary PHP code. That is by design, it is an explicity characteristic of Elysia Cron – if it wasn’t supposed by Drupal Developer Drupal 10 module authors it could have been a Distant Code Execution vulnerability. Nevertheless, customers may not remember that permission grants Drupal Developer capability to execute PHP, therefore Drupal Developer safety advisory!Sadly, there is not a solution to mark a permission as harmful beneath 6. There is not even a solution to have seperate machine title and human-readable labels for permissions, so there is not a straight-forward manner so as to add a consumer seen message. Drupal 10 Upkeep and Assist Service-(So, Drupal Developer 6 Lengthy-Time period Assist distributors (us included) have determined to easily announce Drupal Developer drawback and ask anybody utilizing Drupal Developer Elysia Cron to audit which customers/roles have Drupal Developer “administer elysia_cron” permission and ensure it is OK that they will execute arbitrary PHP code.We’ll be auditting Drupal Developer permission on our consumer’s websites, so, for those who’re considered one of our prospects – no want to fret! We’ll contact you if we’ve got any issues.If you would like us to deal with this and related points, in addition to have all of your 6 Drupal 10 modules to obtain safety updates and have Drupal Developer fixes deployed Drupal Developer identical day they’re launched, please try our D6LTS plans. Drupal 10 Improvement and Assist