Method

How this site works.

This is an advocacy site. It is also a site where every number can be checked in one click. Those two things are not in tension. The bias is in what we choose to publish and how we frame it, never in whether the figure is right.

Three registers, always labelled#

stated

Quoted verbatim from a primary document, with the exact passage and a link. We do not paraphrase a quote into something stronger than the original.

derived

Our arithmetic on published figures. The inputs and the operation are shown; you can redo it. Examples: 48.3% of Drupal sites on end-of-life branches (W3Techs version shares, summed); 41.7% of reporting sites on branches losing coverage in December 2026.

we argue

Our conclusion, in our own voice. Clearly marked, never presented as a fact. If a sentence is scary and unmarked, it should be one of the first two.

Sourcing tiers#

Tier 1primaryDrupal.org (advisories, PSAs, usage page, audits, blog), CISA KEV, CVE.org / NVD, PHP.net, W3Techs, HTTP Archive.

Tier 2pressThe Register, The Hacker News, BleepingComputer, The Guardian, established Drupal-ecosystem press. Used for events, not for numbers we can get from Tier 1.

Tier 3derivedCommunity analysis and our own arithmetic, permitted only when the inputs are Tier 1 and the calculation is shown.

Excluded–AI-generated vulnerability aggregators, SEO “CVE database” sites and anything that cites another aggregator. Research for this site found several recycling each other's errors, including a widely repeated claim about Drupal's KEV ranking that the catalogue does not support.

Known limitations, stated up front#

Usage snapshots are not live

The 28.5%-unfixed figure comes from a usage snapshot for the week ending 10 October 2026, before the 14 October fixes shipped. It also excludes 168,734 reporting Drupal 7 sites, which would make the proportion larger on the wider base. “Affected with no fix available” is a category from the advisory; it is not proof that every such site was reachable.

KEV is an editorial list, not a count of incidents

CISA's catalogue records vulnerabilities with evidence of exploitation in the wild that matter for federal remediation. Inclusion is a judgement. We report KEV counts as they are and do not treat them as a ranking of CMS insecurity.

Some months are derived

Drupal published 256 advisories from June to October 2026 and gave monthly figures for June (28), September (74) and October (106). July and August are not broken out, so the chart shows their combined 48, marked with an asterisk.

We are not ranking platforms

We do not claim Drupal is less secure than WordPress, Joomla or anything else. On CISA's catalogue WordPress has more entries than Drupal. Our claim is about funding, capacity and the patch window, not about comparative code quality.

Corrections#

If a figure here is wrong, we will change it and say so at the bottom of the affected page, with the old value, the new value and the date. Corrections are not an embarrassment; they are the only evidence that anything else on the site was checked. Send them to corrections@isdrupalsecure.org.

Corrections log

No corrections issued. First publication 2026-11-08.

Right of reply

The Drupal Association, the Drupal Security Team and any named organisation may respond to anything on this site. A response will be published verbatim, dated, and linked from the top of the page it addresses. We will not edit it.

Independence

This site takes no money from Drupal vendors, Drupal competitors, or agencies selling migrations. There is no advertising and no sponsored content. If that changes, it will be disclosed on the about page before it changes anywhere else.