When we first started using Drupal as Baylor’s CMS, I signed up for the Drupal security news email updates. I’ve gotten these emails for more than seven years: 929 since February 2019, if Gmail’s count is correct.
But last month, I saw a surge of emails that surprised even me.
So what changed?
I’ll wait for you to guess.
Got it?
I’ll surprise you now. This is clearly another example of AI reshaping cybersecurity: it’s supercharging the discovery of security bugs and the rapid speed with which developers are expected to must fix them.
The Drupal Association confirms 256 published security advisories from June through October, with monthly volume jumping from an average of 8 early in the year to 106 in October. Their explanation: AI-assisted analysis has made finding latent bugs cheap, fast and automatable. As they put it, “Most of these reports came from volunteers and outside researchers, many of them using AI tools.”
Drupal has credited 134 reporters since June 1. There were only 68 in all of 2025.
And it isn’t just Drupal. The New York Times reported on October 28 that Silicon Valley is scrambling to patch a flood of AI-discovered bugs. OpenAI’s Fouad Matin said AI “really opens this Pandora’s box of vulnerabilities.” Platformatic’s Matteo Collina was even less comforting: “This is the first trickle that is coming through and it is going to get 10 times worse.”
Is this bad news? Not exactly. These bugs were already there, and they clearly needed to be resolved. But the volume and complexity of some of these fixes, like the recent PHP bug, concerns me in general. Yes, AI can help fix bugs, but sadly, attackers can use it to devastating effect. Is it a coincidence that Canvas was hacked in 2026 after AI tools exploded in capabilities?
Drupal frames the surge as “an increase in automated discovery velocity,” not worse code. But when Drupal patched a core SQL injection bug in May, Miggo Security used Claude to build a working exploit in only 51 minutes.
This is the water we all swim in these days, and it looks like a wild ride. As Ray Arnold says in Jurassic Park, “Hold on to your butts.”