Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

New Drupal Hook attribute

In the new version announcement something has caught my eye. From the title you know it is the Hook attribute. For the people who are not familiar with php attributes, I wrote a post about it a while ago. The way you needed to add hooks…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

In the new version announcement something has caught my eye. From the title you know it is the Hook attribute.

For the people who are not familiar with php attributes, I wrote a post about it a while ago.



The way you needed to add hooks was an eyesore for me since Drupal 8 moved to a object-oriented way of structuring the code.

Using the module name to prefix the functions and using the .module file to add all the functions had a very spaghetti code feel for me.



And now they almost fixed it. Almost because there are a bunch of hooks that are still procedural. The plan is to remove the procedural hooks in Drupal 12, so in the next minor Drupal versions we will see those hooks disappearing.





What are the benefits?



Instead of adding functions to the .module file, the hooks are in the src directory of the module.

I suggest to use a Hooks subdirectory for easier identification. Or add the Hooks suffix to the class name.



Because it is an attribute you can bind multiple hooks to the same method.




// module.module

function module_comment_insert(CommentInterface $comment) {
module_comment_manipulation($comment);
}

function module_comment_update(CommentInterface $comment) {
module_comment_manipulation($comment);
}

function module_comment_manipulation(CommentInterface $comment) {
// do something
}

// with Hook attribute
class CommentHooks {

#[Hook('comment_insert')]
#[Hook('comment_update')]
public function commentInsertOrUpdate(CommentInterface $comment) {
// do something
}
}






For the people that maintain modules for Drupal versions before 11.1 there is an extra attribute, LegacyHook. This allows you to move the code of the hook to the class with hook attribute. And the old versions of Drupal will execute the function in the .module file, but the newer versions will only execute the class method.




// module.module
#[LegacyHook]
function module_comment_insert(CommentInterface $comment) {
new CommentHooks()->commentInsertOrUpdate($comment);
}

#[LegacyHook]
function module_comment_update(CommentInterface $comment) {
new CommentHooks()->commentInsertOrUpdate($comment);
}









How to use the Hook attribute



As you can see from the previous code examples the attribute is added to the method.



But you can also add the method to the class.




#[Hook('comment_insert')]
#[Hook('comment_update')]
class CommentManipulationHook {
public function __invoke(CommentInterface $comment) {
// do something
}
}






As I show in the example I suggest to make the class name more descriptive. And use the suffix Hook instead of Hooks.



You can add the Hook attributes to the class and add the method as the second parameter. I don't recommend this, In that case it is cleaner to add the attribute to the method.



There is a third Hook parameter, module. And this allows you to execute a hook class from another module. For example #hook('comment_insert', 'commentInsert', 'my_comment_module').

I have been thinking about a use case for this, but i couldn't find any.

If you know one, let me know.





Conclusion



I love to see Drupal code moving in the right direction.



The one thing that bothered me is that the hooks are magic constants. But the plan is to all the hooks attributes with as base class the Hook attribute. So instead of #[Hook('comment_insert')] it will be #[CommentInsert].

Another way they could do it is by using enums, grouped by module.




enum CommentHooks {
case Insert;
case Update;
}






The information in this post is based on the documentation and the quick look i had of the implementation. When I have tested the feature there will be updates to post or an additional post.

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Vulnerability Remediation & Verification
Syntax validiert (0 Fehler)
title: Detect Exploitation - New Drupal Hook attribute
id: 6f52ccfd-ba05-4cc9-a81d-55f4c38d7619
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-26
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-26"
        description = "YARA Signature for "
    strings:
        $str = "New Drupal Hook attribute" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("New Drupal Hook attribute")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*New Drupal Hook attribute*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "New Drupal Hook attribute"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich New Drupal Hook attribute.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten New Drupal Hook attribute

Thematisch verwandte Begriffe: Drupal, Hook, attribute · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-86066 | Horilla is an HR and CRM software. Prior to 2.0.0, approve_validate_atte…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag