Yesterday's batch (SA-CONTRIB-2026-254 to 292) included a Highly critical Commerce Core issue that's already being exploited, eight advisories for the AI module and three projects marked unsupported.

Contrib advisories have more than doubled this year, and with AI speeding up both discovery and exploitation, the window between an advisory and a working exploit is basically gone.

https://preview.redd.it/lsqgggvu6dyh1.png?width=1500&format=png&auto=webp&s=aba7d9d7012c92ddf49f74d9bdae277b4d1c75c1

https://preview.redd.it/0hu0t8mv6dyh1.png?width=1500&format=png&auto=webp&s=6cd765f74cf72a35b25459439a15d2c46daedb21

I wrote up the numbers and how I'm changing my maintenance routine because of it: https://menetray.com/en/blog/every-wednesday-drupalgeddon-and-were-getting-used-it

Curious how others are handling this. Are you applying critical patches the same day?

Yesterday's batch (SA-CONTRIB-2026-254 to 292) included a Highly critical Commerce Core issue that's already being exploited, eight advisories for the AI module and three projects marked unsupported.

Contrib advisories have more than doubled this year, and with AI speeding up both discovery and exploitation, the window between an advisory and a working exploit is basically gone.

https://preview.redd.it/lsqgggvu6dyh1.png?width=1500&format=png&auto=webp&s=aba7d9d7012c92ddf49f74d9bdae277b4d1c75c1

https://preview.redd.it/0hu0t8mv6dyh1.png?width=1500&format=png&auto=webp&s=6cd765f74cf72a35b25459439a15d2c46daedb21

I wrote up the numbers and how I'm changing my maintenance routine because of it: https://menetray.com/en/blog/every-wednesday-drupalgeddon-and-were-getting-used-it

Curious how others are handling this. Are you applying critical patches the same day?