Advisories in Five Months: Results from the Drupal AI Security Initiative

From June through October 2026, Drupal published 256 security advisories, more than the 250 published across the previous 30 months combined, with monthly volume rising from an average of 8 in early 2026 to 106 in October. The Drupal Association attributes the surge to cheaper AI-assisted vulnerability discovery rather than a change in Drupal's attack surface, and says the Alpha-Omega-funded SEIR team participated in 223 of the 256 advisories. The post describes Phase 1 lessons (intake and review are now the bottleneck), upstream fixes such as an Opengrep PHP parser bug, and Phase 2 plans to extend Triagebot to the GitLab API.