Funding for essential roles is falling, when we need it more than ever.

Here's the hard truth: Funding for Drupal core's stability and security is at its lowest since 2012,** **while our needs (especially for core security) are at an all-time high.

Some quick facts:

- Core release management funding is currently at less than half its 2013-2023 levels.
- In 2022 and 2026, respectively, two organizations that had each sponsored a Drupal core release manager for a decade ended their respective sponsorships.
- Release timelines for Drupal 11.4, 11.5, and 12.0 have all slipped well past their planned schedules. This is the first time this has happened since Drupal 8 development in 2013-2015*.*
- Before 2026, the all-time maximum of Drupal core security advisories in a single year was 15. The Drupal Security Team has issued 16 already this year… and there will likely be more.
- In August, September, and October 2026 alone, we issued 198 contributed project security advisories. This is more advisories than any entire year before 2026… and there will absolutelybe more.