I’m not sure how this slipped under the radar but check this out.

The Drupal Association has been given a grant, and we know from the credits on symfony vulnerabilities that Mythos has scanned them.

This is huge and reassures us that once again, Drupal is, and will remain, the most secure open-source CMS out there.

https://thephp.foundation/blog/2026/05/18/announcing-ecosystem-security-team/

Edit - reworded para 2 based on rereading the context.