The counter-case
What Drupal gets right.
This page exists because the rest of the site would be worthless without it. If the only thing you can say about a project's security is that it is bad, you are not analysing, you are marketing. What follows is the strongest honest case for Drupal, and what it does and does not change.
-
Coordinated disclosure, done properly
Drupal publishes advisories on a fixed schedule, with affected version ranges, a severity rating, a numeric risk score out of 25 and a CVE. Critical releases are pre-announced so administrators can plan a window. Most open-source projects still do not manage this. Many commercial products do it worse.
-
Twenty years of doing it in public
The Security Team has run this process since the Drupal 4 era. Two incidents were severe enough to earn nicknames: Drupalgeddon in 2014, Drupalgeddon2 in 2018. In both cases the project shipped a fix, published the advisory and told administrators the truth about the risk. The 2014 advisory's instruction to assume compromise if you had not patched within seven hours was, at the time, unusually blunt.
-
It says the uncomfortable things out loud
The 8-month support cut is bad news for site owners. It was also published with the reason attached, the consequence spelled out, a table of exact end dates, and an explanation of why the alternative was worse. Quietly letting patches slip would have been easier and less damaging to the brand.
-
The code is not the weak point
Core is reviewed by a small group of experienced maintainers with a formal committer process. Most of the vulnerabilities published in 2026 are in contributed modules, the long tail, not in core. When core does have a critical flaw, the fix arrives within days of the report.
-
The ecosystem is trying
Steward gives the security team a way to ship virtual patches the moment an advisory publishes. The AI Security Initiative is a deliberate attempt to use the same tools that caused the flood to find the vulnerabilities first. Alpha-Omega funded the work that carried 87% of the last five months. These are the actions of a project fighting, not one in denial.
And yet
None of this changes the arithmetic. A well-run process with eight funded hours a week and a thirty-person volunteer team is still a process that has told you it will be slower next year.
Competence is not capacity. Drupal's problem in 2026 is that it does security well, at a scale nobody is paying for, while the volume of work multiplies and the support window shrinks.
isdrupalsecure.org · 2026-11-08
Sources