Bibliography
Sources.
Every document cited anywhere on this site, grouped by type. Retrieval dates are when we read them, not when they were published.
Drupal primary documents#
- PSA-2026-11-02: Security support for Drupal core minor versions reduced to 8 months8 Nov 2026
- 256 advisories in five months: results from the Drupal AI Security Initiative8 Nov 2026
- Drupal Association: 2025 audit and financial overview8 Nov 2026
- PHP2Shell incident recap: upstream PHP RCE vulnerabilities and Drupal.org response8 Nov 2026
- Drupal Security Team·members8 Nov 2026
- Security risk levels defined (the 25-point scale)8 Nov 2026
- PSA-2026-10-12: pre-announcement of the core security release8 Nov 2026
- PSA-2014-003: SA-CORE-2014-005 (“assume compromised”)8 Nov 2026
- SA-CORE-2026-014: critical remote code execution8 Nov 2026
- SA-CORE-2026-004: highly critical SQL injection8 Nov 2026
- Core security advisories feed·contributed-project feed8 Nov 2026
Funding and capacity#
Exploitation and measurement#
- CISA: Known Exploited Vulnerabilities catalog (v2026.11.06)6 Nov 2026
- NIST National Vulnerability Database8 Nov 2026
- The Hacker News: Drupal patches critical core RCE flaw8 Nov 2026
- The Hacker News: hackers actively exploit highly critical Drupal flaw8 Nov 2026
- W3Techs: Drupal usage statistics, November 2026 (version shares used for the 48.3% derived figure)8 Nov 2026
- HTTP Archive analysis: Drupal on 23.8% fewer homepages than in 20248 Nov 2026
Not cited, but relevant#
Documents we read and did not use for any claim, listed so the record is complete.