Drupal published more advisories in 2026 than all of 2025 — finding got cheap, fixing didn't
I can't prove why my security inbox got louder this year. But I can count, and the count is stark: Drupal has published more contrib security advisories in 2026 so far than in all of 2025. On its own that number means almost nothing — a count of advisories isn't a measure of danger. What makes it worth a post is a thing two separate organisations said out loud this month, in near-identical words: finding bugs got cheap, and fixing them didn't.
The counting
I walked the SA-CONTRIB advisory IDs by hand. SA-CONTRIB-2026-001 is dated 14 Jan; -100 is 19 Aug; -150 is 9 Sep; and the newest on the listing when I checked was -219, dated 14 Oct. So roughly 100 advisories across the first seven-plus months, then about 119 more in the following eight weeks. The 2025 series, for comparison, reached about -100 on 27 Aug and petered out around -126 in mid-December (the last ID I could actually open; -127 and -128 404'd, so call it "roughly 126"). Put bluntly: ~219 in 2026 to date against ~126 for all of 2025, and the curve bent upward in September. One batch on 7 Oct alone carried 26 advisories; 50 landed between 23 Sep and 14 Oct.
Every one of those caveats matters, so let me be explicit: these are counts of IDs I could load, "roughly 126" is a probe not an official tally, and nothing here says the 2026 surge was caused by AI-found bugs. I'm not asserting that, because none of the primary sources assert it for these specific advisories.
What the people doing the work said
The Drupal Association's post on its AI Security Initiative (Tiffany Farriss, late July) is candid about where the pain is. "Bandwidth among the security engineers has always been the limiting constraint." They deliberately staffed the role fractionally, reasoning that a single full-time engineer "would generate findings faster than volunteers could review them" and the findings "would queue." An engineer can't mark their own fix complete. And the money line: the harder challenge isn't finding vulnerabilities, it's adapting the review process to the volume and quality of AI-generated reports.
Then, on 8 Oct, Anthropic launched OSS Scanner — an opt-in service, inspired by Google's OSS-Fuzz, that scans open-source projects and sends maintainers model-generated vulnerability reports with no human review. Anthropic's own words: "some will contain inaccuracies, such as a wrong severity rating," while "we expect a true-positive rate above 90%." Enrolment is a pull request; reports carry no 90-day disclosure clock while unvalidated; and — the honest guardrail — it's "built for projects that are already able to keep up with verified high/critical vulnerability reports." Brand-new projects don't qualify. Anthropic says it had put over 6,000 human-reviewed reports through its disclosure process by October (its number, not independently checked).
Both sides are describing the same machine from opposite ends. The scanner makes finding nearly free; the maintainer still has to verify, prioritise and fix by hand. "Above 90% true positives" is a forecast, not a measurement — which means the other ~10% is a human's afternoon, every time.
The consequence for the rest of us
Two things follow, and neither is "Drupal is less secure." First, advisory count is now a broken health signal. If finding got cheap, a rising number of advisories for a module might mean it's being looked at harder, not that it's rotting — so stop reading the count as a verdict on either the module or the project. Second, the triage cost moved onto you, the site owner, as much as onto the maintainers. On a 26-advisory day, a solo operator can't read every line. The only question that scales is the narrow one: how many of these touch a module I actually run? I keep a list of my installed contrib precisely so a big batch becomes a two-minute grep instead of an afternoon.
And the fair counterpoint, because there is one: a flood of correct reports reaching maintainers is a better world than the same bugs found first by someone who won't tell you. The Association's team is resolving these, not drowning. The cost is real and it's shifted, but the direction is defensible.