Drupal's security team calls itself "an all-volunteer group." Thirty people for thousands of projects. Their own PSA now admits fixes will ship slower, giving attackers "more time armed with LLMs," while the community debated banning AI contributions.

Meanwhile security firm reportedly built working exploit from a published patch in 51 minutes.

I'm not saying Drupal is insecure. I'm saying nobody is on the hook for enterprise security.

Read more : https://tanay.co.in/blog/your-drupal-security-is-running-on-volunteer-hours