Drupal security advisories have more than doubled in 2026. Here is how we keep pace.

A record year, and it isn't over yet

By 21 October 2026, the Drupal Security Team had published around 269 security advisories. That is more than twice the 121 published in the whole of 2025, and roughly 50% above the previous all-time record of 179, set in 2015.

Almost all of the growth is in contributed modules: 253 advisories so far, against 113 last year. Drupal core advisories doubled too, from 8 to 16.

Why now? AI is finding the vulnerabilities

Drupal did not become less secure overnight. What changed is who is looking, and with which tools. Security researchers and module maintainers now use AI-assisted code analysis to review code at a scale that manual audits never reached, including the long tail of contributed projects that used to get little attention.

That is good news. Every advisory is a vulnerability fixed before it can be exploited. But it moves the work to everyone who runs Drupal sites: every advisory has to be checked against every site, and fixed wherever it applies. The same tools are also available to attackers, so the time between disclosure and exploitation keeps shrinking.

An agency that maintains dozens of Drupal sites cannot answer twice as many advisories with twice as many people. The only way to keep pace with AI-assisted discovery is AI-assisted remediation.

How we keep pace: automation from advisory to pull request

At BRAINSUM, we built our own internal tool to take the mechanical part of security patching off our developers' desks. It covers the whole path from an advisory to a reviewed fix:

• Security monitoring. Our tool checks the drupal.org advisory feed every 30 minutes and runs a full composer audit on every project we maintain every six hours. It works from each project's lock file, so it knows within minutes which sites are affected and which are not.
• Ticket creation. For each affected project, it opens a Jira ticket with the advisory, the CVE, the smallest safe version bump and the exact update steps. It prefers a patch release and never crosses a major version automatically. Anything that needs a human decision is flagged as such.
• Automatic resolution. An AI coding agent picks up the ticket in its own copy of the project. It applies the update, runs the database updates, exports any configuration they change and keeps every patch the project depends on. Each package goes into its own commit.
• Test environments and automated tests. Every fix gets a live preview environment. The project's automated test suites and the Drupal status report run before and after the change, so the pull request shows exactly what, if anything, changed. The agent can also check pages in a real browser.
• Pull request and human review. A pull request is only opened when verification passes. The Jira ticket gets the results and the preview link, and a developer reviews and merges. AI does the legwork; people make the decision.

What this means for the sites we maintain

AI helps find vulnerabilities, and AI helps fix them. Combining the two is what lets us keep up with a year like 2026. For our clients, it means:

• Shorter security patching. A tested fix is ready for review within hours of an advisory, as the numbers above show.
• More reliable updates. Every update follows the same rules on every project: the smallest change that closes the vulnerability, no silently dropped patches, and tests run before and after the change.
• Developers focused where they matter. Our team reviews the fixes and handles the hard cases, such as major upgrades and dependency conflicts, instead of repeating the same routine steps across dozens of sites.
• Lower maintenance costs. Automating the routine work keeps maintenance costs down for our clients, even as the number of advisories keeps growing. That is why we now offer flat-rate security maintenance: predictable costs for keeping your Drupal site patched and secure.

The number of advisories is unlikely to drop. AI-assisted discovery is here to stay, and so is the automation that answers it.

Is your Drupal site keeping up?

If you are not sure how quickly security updates reach your Drupal site, or you want maintenance that keeps pace with AI-era disclosure, talk to BRAINSUM. We are happy to review your current update process and show you how our automated security workflow works.