02 · The flood
Eight a month
became a hundred and six.
Nothing about Drupal's code changed in 2026. What changed is that reading it became cheap. A model will scan a contributed module, diff a patch, or brute-force a threat model for the price of a coffee, and the results land in the same queue that thirty volunteers work through by hand.
Why it happened
Finding vulnerabilities stopped being the expensive step.#
Drupal's own write-up says the quiet part directly: the bottleneck moved. The cost of discovery collapsed; the cost of intake, triage, review and coordinated release did not, because those are human processes with a fixed number of humans.
That is why the number of advisories can rise tenfold while the number of people who can approve one stays flat. It is also why the 256-advisory figure is not evidence of a sudden collapse in code quality. The vulnerabilities were probably always there. Nobody was looking before; now something always is.
Drupal is not special in this. curl suspended all vulnerability reports for July 2026 and shut down its HackerOne bounty over AI-generated submissions. Google suspended its open-source vulnerability reward programme on 1 October 2026. The Linux kernel's networking maintainers and Intel's bounty programme reported the same pattern. 2
we argue The industry-wide version of this story is "AI broke vulnerability disclosure". Drupal's version is narrower and worse: the flood arrived at a project that had already cut its security staffing to eight funded hours a week.
The AI Security Initiative has created more work than the Drupal Security Team, especially with its current levels of funding, can sustain.
The Security Team could not have handled this volume without the grant.
The busiest days
What a release day now looks like#
Counts from Drupal's core and contributed security feeds, retrieved 2026-11-08. 1 2
Thirty-nine advisories in a day is a queue emptied in public, because the alternative is a backlog nobody can audit. Every one of those advisories required a patch, a review, a backport, a CVE request and a coordinated publication date. Drupal does that with volunteers and a grant.
The consequence
The fix for the flood was to promise slower fixes.#
Read the sequence in order, because each step is documented and each one made the next inevitable:
- 01 Report volume multiplied. The team said publicly it could not sustain the pace. 3
- 02 Support per minor version was cut from 12 months to 8, starting 2027, with a 30% reduction in backport work. 3
- 03 Drupal stated the consequence in the same document: fixes take longer, which gives attackers more time. 3
- 04 In October, the pre-announcement for a critical core RCE warned that exploits might appear "within hours or days". 4
- 05 The window between patch and working exploit is now measured in minutes by the people who build them. 5
Slower fixes and faster exploits is not a trade-off. It is a subtraction.
Who decided this, and who could have paid for the alternative
Sources for this page
1Drupal.org: contributed-project security advisories feed
2Drupal.org: 256 advisories in five months: results from the Drupal AI Security Initiative
3Drupal PSA-2026-11-02: security support reduced to 8 months
4Drupal PSA-2026-10-12: pre-announcement of the core security release
exploits might be developed within hours or days.www.drupal.org/psa-2026-10-12 retrieved 8 Nov 2026