Accountability
Nobody sabotaged Drupal.
That is the problem.
There is no villain in this story, no embezzlement, no cover-up. There is an allocation table. Money went to features, and the security bill was handed to volunteers who were told, in writing, to do more with less. This page names who chose what, and links the document for each line.
The Drupal Security Team
~30 unpaid volunteers
Answered 223 of the last 256 advisories with grant-funded help, while several members also carry core commit rights and full-time jobs at consultancies.
Drupal core maintainers
The people who ship the fixes
Shipped 16 core security releases in 2026, more than any previous full year. That was on eight funded hours a week, down from forty in 2022.
The Drupal Association
Steward of the project's finances
Missed a plan to triple revenue to $10.5M. Ran a $1.15M combined deficit across 2024–25. Drupal.org infrastructure up 61% with “no direct funding mechanism”. Reserves now 2.3 months against a three-month policy minimum.
The commercial ecosystem
Vendors, hosts, agencies: the beneficiaries
Committed more than $1.5M in cash and in-kind to the AI Initiative in 2026 across 28 organisations. The person who ships core security releases lists six sponsors and eight funded hours a week. Two decade-long sponsorships of that work ended in 2022 and 2026.
Enterprise site owners
The demand side
48.3% of Drupal sites run a major version with no security support. 168,734 sites still report Drupal 7, end-of-lifed in January 2025. When the October core RCE was fixed, 28.5% of reporting sites had no patched branch to move to.
Agencies and integrators
The build layer
The business model bills for builds and retainers, not for the shared maintenance that keeps the platform patchable. Security coverage for contributed projects is opt-in, and the only remedy the project offers for an abandoned module is “uninstall it”.
The 12-to-8-month decision
October 2026
Cut security support per minor release by a third to protect a volunteer team that was already at capacity, and said in the same announcement that fixes will now take longer.
Alpha-Omega and the SEIR grant
The funders who did show up
Paid for the fixers and reviewers behind 87% of the last five months of advisories. Drupal's own write-up: the team “could not have handled this volume without the grant.”
Verdicts are our editorial judgement. Every fact in the record column is linked below. “Structural” means no single party decided it and every party sustains it.
First, the people who are not to blame
The security team is not slow. It is thirty people.#
Accusing the Drupal Security Team of negligence is the lazy version of this story, and it is wrong. They published 256 advisories in five months. They cut backport work by 30% and shortened support windows because they were drowning, and they said so in public rather than quietly letting patches slip.
The team is an all-volunteer group. Its public roster lists people who do this alongside full-time jobs at Drupal shops and end-user organisations across roughly nine countries. Several of them (catch, longwave, alexpott, larowlan and xjm) are simultaneously core committers. When you read that core had its worst advisory year on record, you are reading the output of the same small group of people twice.
we argue The team's fault, if it has one, is transparency: it documented its own capacity limit in a way that makes this site possible.
The volunteer ledger
- Security team members
- ~30 all-volunteer
- Advisories involving grant-funded staff
- 223 of 256 87%
- Advisories June–October 2026
- 256 vs 250 in the prior 30 months
- Core security releases in 2026
- 16 prior all-time high: 15
- Sites reporting a core version
- 531,499 the estate they answer for
The chain
Six links from a spreadsheet to an unpatched server.#
- 01
The revenue plan failed.
The Association set out to triple revenue from $3.49M in 2022 to $10.5M in 2026. Actual cash revenue grew about 5% while out-of-pocket costs rose 27%. 3
- 02
Security funding was the flexible line.
Core release management, the job that turns a patch into a release, is funded at 8 hours a week, down from 40 in 2022, described by its incumbent as the lowest level since 2012. 4
- 03
The report volume multiplied.
AI-assisted discovery took Drupal from 8.3 advisories a month to 106 in October 2026. Discovery got cheap; review did not. 1
- 04
Capacity was rationed, in public.
Support per minor version dropped from 12 months to 8, and Drupal stated the consequence: fixes take longer, giving attackers more time. 5
- 05
The window between advisory and exploit collapsed.
In 2014 Drupal told administrators to assume compromise if they had not patched within seven hours. In 2026 a working exploit was reportedly built from the public patch in 51 minutes. 6
- 06
The estate did not move.
Nearly half of all Drupal sites still run a major version with no security support, and a quarter of reporting sites had no fixed branch to move to in October. 7
The allocation
Follow the money and the story stops being about code.#
Raised in 2026
$1.5M+
Drupal AI Initiative: 28 organisations, 23 FTE, 50+ people, for agents, page generation and AI features.
Funded in 2026
8 hrs/wk
Core release management: the person who ships the security releases, down from 40 hours a week in 2022.
The comparison is not an accusation of bad faith. The AI Initiative is real work with real funders, and Drupal's leadership can point to it as evidence the ecosystem can organise money when it wants something. That is precisely the point: it can. 8
The same ecosystem's operating account shrank. The 2025 audit shows a $451,000 operating loss on top of a restated $923,000 loss in 2024; unrestricted reserves of about $960,000, or 2.3 months of expenses, against a board policy of a six-month target and a three-month floor; cash reserves down roughly 60% since 2022; and Drupal.org infrastructure costs up 61% to $2.1M, nearly half of it covered by donated or in-trade services rather than cash. 3
we argue An organisation covering 48% of its core infrastructure with donated services is not one bad quarter from recovery. It is structurally underfunded, and has been for three years.
The beneficiaries
The companies that earn a living on Drupal are not accused of stinginess. They are accused of a spreadsheet.#
The commercial ecosystem is the reason Drupal exists at scale: Acquia, the hosts, the hundreds of agencies building and maintaining sites. They also benefit most directly from a security release landing on time, because they are the ones explaining an outage to a client.
What the record shows is a funding pattern, not a motive. Core release management, the most load-bearing volunteer role in the project, lists six sponsors on its public page: Acquia, Agileana, HeroDevs, Salsa Digital, Zoocha and QED42, at eight funded hours a week. Two decade-long sponsorships of that same work ended in 2022 and 2026. 4
The AI Initiative, by contrast, found 28 organisations and more than $1.5M in under a year. Both numbers are true at the same time. That is the indictment. 8
If I cannot find funding for 2027, I will need to leave funded open source work entirely.
Funding for Drupal core stability and security is at its lowest level since 2012.
The uncomfortable part
If you run Drupal and you do not fund it, you are the funding model.#
What the estate looks like
- 48.3%of Drupal sites on a major version with no security support
- 168,734sites still reporting Drupal 7, end-of-lifed January 2025
- 28.5%of reporting sites with no fixed branch when the October core RCE shipped
- 41.7%of reporting sites on 10.6.x or 11.3.x, which lose coverage in December 2026
What funding would look like
- Sponsor a maintainer directly. The release manager publishes exactly what is missing: 7 more hours a week now, 12–16 to restore the role.
- Join the Drupal Association as an organisation member, at a level that reflects your dependency, not your marketing budget.
- Buy the vendor support or WAF tier if you need it, and read what it does not cover before you sign.
- Pay an agency for an audit of your contributed-module inventory, not just a rebuild.
- Fund the contributed projects you actually depend on, or accept that you are running unmaintained code.
None of these are our inventions. They are the funding routes the project itself documents.
we argue The most defensible sentence on this site is also the least comfortable: Drupal's security problem is a procurement problem. It is solved by invoices, not by blog posts.
What we are not saying
Three accusations we are not making.#
Nobody stole anything.
There is no public evidence of misappropriation at the Association, and its audited accounts are published in unusual detail. A deficit is not a scandal. It is a deficit.
Nobody hid a breach.
Drupal discloses vulnerabilities with version ranges, risk scores and CVE IDs on a fixed schedule, and pre-announces critical fixes. That is better practice than most of the industry.
Drupal is not the worst.
By CISA's catalogue Drupal has 5 known-exploited entries; WordPress has 8. We do not claim Drupal is uniquely insecure. We claim it is uniquely under-resourced for what it is asked to defend.
Every one of these is verifiable. That is why they are on the page.
Sources for this page
1Drupal.org: 256 advisories in five months
The Security Team could not have handled this volume without the grant.www.drupal.org/blog/256-advisories-in-five-months-results-from-the-drupal-ai-security-initiative retrieved 8 Nov 2026
2Drupal.org: Security Team members roster
3Drupal Association: 2025 audit and financial overview
Unrestricted reserves of approximately $960,000, or 2.3 months of operating expenses, below the board's three-month minimum.www.drupal.org/association/blog/drupal-association-2025-audit-and-financial-overview retrieved 8 Nov 2026
4xjm: Core security funding
I am currently funded for 8 hours per week. In 2022, I was funded for 40.xjm.drupal.org/blog/core-security-funding retrieved 8 Nov 2026
5Drupal PSA-2026-11-02
For site owners, this introduces risks that security fixes will take longer to release, which gives more time for malicious actors armed with LLMs to find attacks.www.drupal.org/psa-2026-11-02 retrieved 8 Nov 2026
6CISA KEV catalog + reporting on SA-CORE-2026-004
CVE-2026-9082 added to KEV on 22 May 2026, two days after the patch.www.cisa.gov/known-exploited-vulnerabilities-catalog retrieved 6 Nov 2026
7The Hacker News: Drupal patches critical core RCE
8Drupal.org: AI Initiative: from strategy to execution
28 organizations, $1.5M+ in cash and in-kind commitments, 23 FTE, 50+ people.www.drupal.org/about/starshot/initiatives/ai/blog/from-strategy-to-execution-how-the-drupal-ai-initiative-is-scaling-delivery-for-2026 retrieved 8 Nov 2026