Drupal Association Reports First Six Weeks of AI Security Initiative

Funded security engineers are working alongside Drupal’s volunteer Security Team through a six-month programme that covers vulnerability discovery, patch development, independent review, and Drupal.org infrastructure. In a 24 July 2026 blog post, Tiffany Farriss, interim CEO of the Drupal Association, reported on the first six weeks of the Drupal AI Security Initiative. The Alpha-Omega Security-Engineer-in-Residence programme funds the work through a fractional team rather than a single full-time engineer.

The Association identifies review capacity, rather than discovery alone, as the emerging constraint because AI-assisted analysis can produce findings faster than volunteers can validate and resolve them. It says the team contributed to more than ten published advisories and CVEs, filed more than 30 issues, and resolved ten security issues in six weeks. The work included SA-CORE-2026-005, a critical PHP object-injection vulnerability that could be exploited when an attacker had JSON:API write permission and the site used an unusual field type storing a serialized property.

The initiative has also produced five skills, opengrep static-analysis rules, and local tooling that processes about 40,000 historical security-mailbox emails while keeping sensitive data local. The next six weeks will focus on sorting and deduplicating incoming reports and checking whether submissions contain enough context and reproduction detail before human review. The Association also plans to draft a working standard for AI-generated or AI-assisted security reports with maintainers and the Security Team while continuing collaboration with The PHP Foundation and the Open Source Technology Improvement Fund.