The file · verified 2026-11-08
NO
Drupal's security team says, in a public service announcement, that the volume of vulnerability reports “has created more work than the Drupal Security Team, especially with its current levels of funding, can sustain.” Their remedy was to cut security support for every core release from twelve months to eight.
That team is roughly thirty unpaid volunteers. The person who ships the security releases has eight funded hours a week, down from forty in 2022. Nearly half of all Drupal sites run a version that no longer receives security fixes at all.
315 contributed-project advisories in 2026 · 5 CISA KEV entries · 48.3% of Drupal sites on end-of-life branches
01 · The flood
It went from eight advisories a month to one hundred and six.#
In May 2026 Drupal published about eight security advisories a month. That had been the rhythm for two and a half years. In October it published 106. On 28 October alone it published 39.
The cause is not a sudden collapse in code quality. Finding vulnerabilities stopped being the expensive part. A model can read a patch, a diff or a module in minutes. Drupal's own write-up says it plainly: discovery is no longer the slow step; intake and review are. 1
The last fifty entries in Drupal's contributed-project security feed cover eight calendar days. 2 That is not a metaphor for a backlog. That is a backlog.
we argue A hundred and six fixes in a month does not mean more attackers. It means more people reading the code, and the team reading it is the same size it was in 2022.
The economics of the flood02 · In their own words
For site owners, this introduces risks that security fixes will take longer to release, which gives more time for malicious actors armed with LLMs to find attacks.
They told you the patch will be late
The same announcement sets out the new calendar: 11.3 until December 2026, 11.4 until April 2027, 11.5 and 12.0 until August 2027. Every window is shorter than the one before it. 3
They told you why
“The AI Security Initiative has created more work than the Drupal Security Team, especially with its current levels of funding, can sustain.” That is the project describing its own capacity, not a critic. 3
04 · The estate
Nearly half of all Drupal sites run a version nobody is patching.#
Share of Drupal sites by major version, W3Techs, 8 Nov 2026. Red = no security fixes. 5
Drupal 7 reached end of life on 5 January 2025. Drupal.org's own usage page still counts 168,734 reporting sites on it. Drupal 10 ends on 9 December 2026, along with 10.6.x and 11.3.x, which between them carry 41.7% of reporting sites.
The October core vulnerability is the clean illustration. When the fix shipped, 151,442 of 531,499 reporting sites (28.5%) were on branches the advisory listed as affected with no fix available. 6
we argue An advisory with no fix is a notice that the process ran out of road.
05 · Consequences
This is in the federal catalogue.#
Exploit attempts against the May 2026 SQL injection were detected within 48 hours; CISA added it to the Known Exploited Vulnerabilities catalogue on 22 May. Reporting credits a security firm with building a working exploit from the public patch, using a model, in 51 minutes. 7
07 · Live
Latest receipts#
Pulled from Drupal's own security feed. 100 advisories indexed and filterable in the ledger.
Sources for this page
1Drupal.org: 256 advisory in five months: results from the Drupal AI Security Initiative
The Security Team could not have handled this volume without the grant.www.drupal.org/blog/256-advisories-in-five-months-results-from-the-drupal-ai-security-initiative retrieved 8 Nov 2026
2Drupal.org: contributed-project security advisory feed
Latest 50 items span 28 October 2026 to 4 November 2026.www.drupal.org/security/contrib/rss.xml retrieved 8 Nov 2026
3Drupal PSA-2026-11-02: Security support for core minor versions reduced to 8 months
this has created more work than the Drupal Security Team, especially with its current levels of funding, can sustain. For site owners, this introduces risks that security fixes will take longer to release, which gives more time for malicious actors armed with LLMs to find attacks.www.drupal.org/psa-2026-11-02 retrieved 8 Nov 2026
4Drupal.org: Security Team members
The Drupal Security Team is an all-volunteer group.www.drupal.org/drupal-security-team/security-team-members retrieved 8 Nov 2026
5W3Techs: Drupal usage statistics
Drupal 7: 28.8% · Drupal 9: 9.4% · Drupal 8: 8.0% · Drupal 6: 1.9% · 5 and 4: 0.2%w3techs.com/technologies/details/cm-drupal retrieved 8 Nov 2026
6The Hacker News: Drupal patches critical core RCE (151,442 of 531,499 reporting sites unfixed)
7CISA Known Exploited Vulnerabilities catalog, v2026.11.06
CVE-2018-7600 and CVE-2018-7602 are flagged as known to be used in ransomware campaigns. CVE-2026-9082 was added on 22 May 2026.www.cisa.gov/known-exploited-vulnerabilities-catalog retrieved 6 Nov 2026
8Drupal Association: 2025 audit and financial overview
Unrestricted reserves of approximately $960,000 represent 2.3 months of operating expenses, below the board's three-month minimum.www.drupal.org/association/blog/drupal-association-2025-audit-and-financial-overview retrieved 8 Nov 2026
For your file
If you run Drupal, this is your risk register.
Twelve questions to put to your agency, with the answers that should worry you. Printable, dated, sourced.
Get the vendor kit