There’s a lot going on around WordPress security and performance, the Drupal Business Survey has opened, as has registration for WordCamp Kathmandu.

Core Security Initiative for automated WordPress security assessments

The WordPress Security Team announced the Core Security Initiative, a coordinated programme “with one goal: a stronger, safer WordPress.” The volume of AI-assisted vulnerability reports has increased substantially, and the Core Security Initiative aims at turning that into an advantage for WordPress. Its “ABC” strategy rests on these three pillars:

  • “A better release process” – ship security updates in a tighter, automated process with end-to-end testing
  • “Breaking the backlog” – grow the security team to handle all the reports and known issues
  • “Crush vulnerabilities with AI” – use LLMs proactively to reveal vulnerabilities in WordPress

For WordPress users, this means that the frequency of security updates is likely to increase. Having a solid process (and hosting platform) in place that makes testing and deploying them straightforward will be essential to keep websites safe.

New security advisories for Drupal contrib projects

The Drupal project published new security advisories on contributed projects that potentially expose content, credentials and directory data. Among these projects are LDAP 2.2.1, Entity PDF 2.1.5, Entity API 8.x-1.8, DXPR Builder 2.8.1 and Data Field 2.0.13.

We recommend doing an inventory of your managed Drupal sites for all affected modules, and prioritising the updates of sites that expose data to anonymous users or external APIs.

Secrets API for WordPress 7.2

A new Core proposal for “A Secrets API for WordPress 7.2” would introduce a standard encrypted credential storage and WP-CLI support in WordPress 7.2. WordPress currently lacks a first-class alternative to storing plugin API keys in plain text. Handling credentials is definitely an important security topic, but the proposal leaves valid concerns about read-only external stores and systems where encryption must occur outside WordPress unresolved. We recommend that WordPress developers follow the design discussion before adapting their integrations.

Performance fix for Block States coming

There is a performance regression in the new Block States support that came with WordPress 7.1, according to a Core Performance Team discussion. The root cause is a function that’s attached to render_block, and therefore runs for every rendered block, regardless of whether relevant style attributes exist. A fix is in progress, aiming at WordPress 7.1.1.

Developers who are noticing a performance degradation in block-heavy websites should keep an eye out for the 7.1.1 release.

Drupal Business Survey seeks agency data ahead of DrupalCon

As is tradition, the Drupal Association opened its 2026 Drupal Business Survey to agency and service-provider leaders.

It covers business outlook, client projects, talent needs, Drupal CMS, commercial success and AI. Responses will feed an anonymised ecosystem report, with highlights planned before DrupalCon Rotterdam and a conference BoF to discuss the findings. Submissions close on 7 September.

We recommend participating in the Drupal Business Survey because it gives Drupal businesses a direct way to influence the evidence used for ecosystem strategy and provides a benchmark for market, staffing and client-demand trends.

Registration opens for WordCamp Kathmandu

Open-source content management thrives beyond the usual conference hubs. WordCamp Kathmandu, a great example of a successful regional conference, opened registration and offers team discounts. Groups of five or bigger get consolidated payment and 20% off. The published programme includes more than 30 speakers and sessions on enterprise WordPress, AI-assisted development, software security, design, licensing and agency growth, followed by dedicated Core, accessibility, themes, plugins and patterns contribution tables.

It’s always great to see a sizeable regional event that offers concrete agency-oriented content. And who doesn’t like a discount?

These were our highlights of last week’s happenings in the Drupal and WordPress ecosystems. Until next week!