The Drupal Association said on 29 October 2026, reporting results from the Drupal AI Security Initiative it launched with Alpha-Omega in June, that Drupal published 256 security advisories from June through October 2026, more than the 250 published across the previous 30 months combined.

It says monthly volume rose from an average of 8 advisories in early 2026 to 28 in June, 74 in September and 106 in October, peaking at 39 advisories on 28 October, and that 134 different people have been credited as reporters since 1 June, against 68 in all of 2025.

The Association says the surge is driven by a shift in the economics of vulnerability discovery, not a change in Drupal's attack surface: the issues are mainly latent bugs in mature core and contributed code that AI-assisted analysis has made cheap, fast and automatable to find, and most reports came from volunteers and outside researchers, many using AI tools.

It says discovery is now cheap and intake is the bottleneck; a Trail of Bits report against one contributed module through the Patch the Planet programme (run by Trail of Bits and OpenAI) led to the critical core fix SA-CORE-2026-014 released on 14 October; Opengrep's PHP parser silently skipped valid PHP 8 code in about 350 files across 176 contributed projects and every supported core branch (fixed upstream on 1 September); and its Triagebot tool, which posts one message per new report with a suggested classification and likely duplicates, has flagged roughly 20% of reports as probable duplicates since mid-August.

The Association says release capacity is the next constraint and that it is writing a working standard for what a useful AI-assisted security report must contain. (source: Drupal Association)