Hackers are dropping malicious payloads on vulnerable sites after releasing proof-of-concept code for a major Drupal security flaw. Attackers have been steadily infecting servers with malware (coinminers) and backdoors. The vulnerability affects all Drupal CMS versions released in the past decade. The number of exploitation attempts is still small, compared to other ongoing malware campaigns, but numbers are rising. Users are advised to update Drupal sites to versions 7.5858-58, abd 8.5.1, the ones containing fixes for Drupalgeddon 2.1.
Source: https://www.bleepingcomputer.com/news/security/drupalgeddon-2-vulnerability-used-to-infect-servers-with-backdoors-and-coinminers/