The advisory I can't read yet: living inside Craft's 30-day disclosure window
Here's a small thing that changes how update day feels. You bump Craft, read the changelog, and see a line like "Fixed a potential RCE vulnerability (GHSA-xxxx)." That's it. No write-up, no attack description, no "here's what an attacker could do." The full advisory shows up about a month later, in a batch. I've been living inside that gap, and it's worth talking about — not as a complaint, but as a working practice.
The policy, in Craft's own words
From the security policy: "We wait 30 days after the Craft or Commerce release that has a fix before we make the security advisory public." It's refreshingly honest that this isn't secrecy — the same page warns the window "should not be taken as a guarantee that the vulnerability will remain secret," because anyone can diff the old and new code. The severity table doubles as your action guide: Critical = "Update ASAP," High = "Update within 30 days," Moderate = "Update within 90 days," Low = "at your convenience." And the pull-quote that sums up the whole stance: "The most secure version of Craft or Commerce is the latest one."
On Oct 17 Craft published a blog post, "Why Craft is Publishing More Security Advisories" (by Brad), getting ahead of the obvious worry: the advisory count has climbed sharply over the past year. Their explanation is that AI has made vulnerability discovery faster and cheaper — and that the Linux kernel, Google, Microsoft and plenty of open-source projects are seeing the same curve. More advisories, they argue, don't mean less secure software.
The numbers, measured not vibed
I didn't want to take "more advisories" on faith, so I counted. Scraping GHSA IDs out of the Craft 5.x changelog from 5.8.21 (Dec 2025) through 5.11.5 (Oct 7 2026), I get 128 unique advisory IDs in about ten months. By month: 5 in December, then 22, 18, 6, 6, 7, 11, 15, 12, and 23 in September alone, with 6 more in the first week of October. September's spike is real — 5.11.0 carried 11 and 5.11.2 carried 12.
Two honest caveats on that figure. The changelog only started naming GHSA IDs around December 2025; older entries just said "Fixed an RCE vulnerability," so I cannot claim the real volume was lower before then — I can only count what's labeled. And a raw advisory count tells you almost nothing about security on its own, which is exactly what the vendor says too. I'm reporting the number because it's concrete, not because it's a verdict.
The AI-discovery explanation is plausible. It's also the vendor's own account of its own numbers, not something anyone measured independently. Both things can be true: the trend is real, and "AI found them" is still a claim, not a finding.
What you can and can't know on update day
This is the practical core. When 5.11.2 shipped on Sep 17, it listed twelve GHSA IDs — including, by the changelog's own descriptions, a SQL injection, three permission escalations, and two RCEs rated High. On that day, all you get is the IDs and one-line severities. The write-ups land ~30 days later. I measured the actual release-to-advisory gaps on a few: 28 days for one, 34 for another, and 53 for an older one — so "30 days" is a floor, and batching makes the real delay wander.
Which means the changelog line is the alarm. You don't get to wait for the detailed advisory to decide whether to act, because by design it isn't there yet — and the policy's "High = within 30 days" is calibrated to exactly that delay. The honest operational takeaway: treat "security fix (GHSA-…)" with no further detail as a High until proven otherwise, and update. With 128 IDs in ten months, "stay current" stops being advice and becomes the only strategy that works.
The Drupal reflex, hedged
My instinct, coming from years of Drupal, is that drupal.org security advisories go public with the fixed release — the write-up and the patch land together on a Wednesday. But I'm reporting that from memory, not from a fresh check of drupal.org/security, so take it as my recollection and the contrast as a question, not a scoreboard. If it holds, the difference is interesting: Drupal tells you what the hole was as it hands you the patch; Craft hands you the patch and tells you the shape of the hole a month on. Neither is obviously wrong. They're different bets about how much a published write-up helps attackers versus defenders.
The takeaway
Living under a 30-day window is fine once you stop expecting the advisory to arrive with the fix. Make updates routine, keep to a supported branch (Craft even backported fixes to 4.x — 4.18.9 on Sep 17), and read the changelog's severity line as the thing it's meant to be: the only signal you'll have for a month, and enough of one.