If you follow Craft’s release notes or security advisories, you’ve probably noticed a significant increase in security-related updates over the past year.
It’s reasonable to wonder what that means. Has Craft suddenly become less secure? Are newer versions introducing more vulnerabilities? Should site owners be worried?
The short answer is the way vulnerabilities are discovered has changed dramatically.
Artificial intelligence has made it much faster and cheaper for security researchers to analyze large codebases, explore unusual code paths, and test potential exploits. Work that once took days or weeks of specialized human effort can increasingly be done by AI-assisted tools running around the clock.
The result is a surge in vulnerability reports across the entire software industry. The Linux kernel, Google, Microsoft, and countless open source projects are all seeing the same thing.
The thing to keep in mind is that it isn’t how many vulnerabilities are being reported. It’s how quickly legitimate issues can be validated, fixed, released, and, most importantly, installed on the sites that depend on the software.
More advisories don’t necessarily mean less secure software
A security advisory is evidence that a vulnerability was found, fixed, and disclosed. By itself, it isn’t a measure of how secure a piece of software is.
A project with many published advisories may have a large attack surface, but it may also have active researchers, responsive maintainers, and a mature disclosure process. A project with very few advisories might genuinely have fewer vulnerabilities, or it might simply be getting less scrutiny.
Why don’t we disclose vulnerabilities immediately?
When we fix a vulnerability, we ship the patched release first and publish the full advisory later.
Our standard disclosure window is 30 days from the patched release. During that time, site owners can update before the GitHub Security Advisory and any associated CVEs are made public.
That window isn’t a guarantee of secrecy, though. Once a patch is public, a motivated researcher (or an automated agent) can compare the old and new code to determine what was fixed. AI is making that kind of analysis faster and easier, too.
That makes timely updates more important than ever.
What should Craft site owners do?
The two most important changes we recommend are:
- Make sure you’re on a supported version of Craft.
- Make updates routine, not exceptional.
A site that’s updated regularly is usually straightforward to patch when an important security release arrives. A site that has fallen six or twelve months behind may first need unrelated dependency, plugin, or application work before the security fix can be safely deployed.
Higher-risk sites, such as those handling commerce, personal information, financial data, or other sensitive material, should aim to apply security releases even faster.
Craft publishes several ways to stay informed, including a Critical Releases feed, security announcements, GitHub advisories, changelogs, and notices directly within the Craft control panel.
Where does this go from here?
We don’t expect the pace of security research to return to what it was a few years ago. The tools will keep improving, researchers will keep finding vulnerabilities faster, and attackers will have access to many of the same capabilities.
That puts real pressure on software maintainers and site owners alike.
But there’s an upside. Many of the vulnerabilities being uncovered today are the product of years of accumulated assumptions and technical debt across the industry. Finding and fixing them is painful work, but it leaves actively maintained software stronger.
For Craft site owners, stay on a supported version, keep them updated, and have a plan to apply security fixes promptly when they’re released.