--- title: The Core Security Initiative: two months in | daily.dev description: WordPress has received over 3,000 security reports this year, more than the previous twelve years combined, partly due to AI-assisted research. The HackerOne... canonical: https://daily.dev/posts/the-core-security-initiative-two-months-in-kfherhjfs twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Core Security Initiative: two months in | daily.dev og:description: WordPress has received over 3,000 security reports this year, more than the previous twelve years combined, partly due to AI-assisted research. The HackerOne... og:url: https://daily.dev/posts/the-core-security-initiative-two-months-in-kfherhjfs og:image: https://api.daily.dev/og/posts/kFHerhjFs.png og:image:alt: The Core Security Initiative: two months in og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Core Security Initiative: two months in **[Make WordPress Core](https://daily.dev/sources/wordpresscore)** · 4 min read · 0 upvotes · 0 comments ## Summary WordPress has received over 3,000 security reports this year, more than the previous twelve years combined, partly due to AI-assisted research. The HackerOne program jumped from 20-30 reports a month to 773 in August alone. In response, WordPress shipped seven core security releases since mid July, including four in 41 days, closing more than 50 Critical or High vulnerabilities, with every fix going back to version 4.7. The team built an AI triaging system, pushed the untriaged queue down from 359 to double digits, automated 73% of the 109 steps in a security release, and enrolled WordPress in Anthropic's OSS Scanner for free security scans. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many security reports has WordPress received this year compared to previous years? WordPress has received more than 3,000 security reports this year through its HackerOne program, more than the previous twelve years combined. The program historically received 20 to 30 reports a month, but that jumped to 450 in July and 773 in August, with the program page showing 2,306 reports in the trailing 90 days. _Developers tracking WordPress's security posture can follow vulnerability trends like these on daily.dev._ ### How many WordPress core security releases have shipped recently and how far back do the fixes go? WordPress shipped seven core security releases since mid-July, including four releases in 41 days: 7.1.1, 7.1.2, 7.1.3, and 7.1.4. These closed more than 50 Critical or High severity vulnerabilities, with fixes backported to every branch still receiving security updates, going back to version 4.7. _Teams maintaining older WordPress branches can keep up with backport coverage like this on daily.dev._ ### How is WordPress using AI to handle its security vulnerability backlog? WordPress built an AI-powered triaging system that reads incoming reports, reproduces them securely, and posts a summary with a severity recommendation, though human security researchers make the final call. This helped shrink the untriaged queue from 359 reports down to double digits. The same agentic tooling is also used proactively to hunt for vulnerabilities in core before they're reported. _Developers evaluating AI for security triage in their own projects can follow approaches like this on daily.dev._ ## Similar posts on daily.dev - [\#232 – Aaron D Campbell on Navigating WordPress Security in the AI Era](https://daily.dev/posts/232-aaron-d-campbell-on-navigating-wordpress-security-in-the-ai-era-mo2mxn69j) · WP Tavern · 0 upvotes · 0 comments - [Updates to the WordPress Vulnerability Disclosure Program](https://daily.dev/posts/updates-to-the-wordpress-vulnerability-disclosure-program-pqj6erb8m) · Make WordPress Core · 0 upvotes · 0 comments - [PHP rushes out emergency patches for two critical bugs AI found first](https://daily.dev/posts/php-rushes-out-emergency-patches-for-two-critical-bugs-ai-found-first-smuf7gcab) · The Next Web · 0 upvotes · 0 comments - [WPBeginner Spotlight 26: Form Analytics, More AI Tools, and Smarter SEO Monitoring](https://daily.dev/posts/wpbeginner-spotlight-26-form-analytics-more-ai-tools-and-smarter-seo-monitoring-npidx0i8m) · WordPress Beginner · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source), [#wordpress](https://daily.dev/tags/wordpress) [View this post on daily.dev](https://daily.dev/posts/the-core-security-initiative-two-months-in-kfherhjfs) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Core Security Initiative: two months in","url":"https://daily.dev/posts/the-core-security-initiative-two-months-in-kfherhjfs","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-core-security-initiative-two-months-in-kfherhjfs"},"datePublished":"2026-10-29T17:03:06.739Z","dateModified":"2026-10-29T17:09:44.538Z","description":"WordPress has received over 3,000 security reports this year, more than the previous twelve years combined, partly due to AI-assisted research. The HackerOne...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/594267c87464ed81c9a5b118c67d172f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/594267c87464ed81c9a5b118c67d172f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Make WordPress Core","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Make WordPress Core","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/892d1a79e30e4e8a911b5726c6fb1a06","url":"https://daily.dev/sources/wordpresscore"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-core-security-initiative-two-months-in-kfherhjfs","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,open-source,wordpress","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Make WordPress Core","item":"https://daily.dev/sources/wordpresscore"},{"@type":"ListItem","position":3,"name":"The Core Security Initiative: two months in"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-core-security-initiative-two-months-in-kfherhjfs#faq","mainEntity":[{"@type":"Question","name":"How many security reports has WordPress received this year compared to previous years?","acceptedAnswer":{"@type":"Answer","text":"WordPress has received more than 3,000 security reports this year through its HackerOne program, more than the previous twelve years combined. The program historically received 20 to 30 reports a month, but that jumped to 450 in July and 773 in August, with the program page showing 2,306 reports in the trailing 90 days. Developers tracking WordPress's security posture can follow vulnerability trends like these on daily.dev."}},{"@type":"Question","name":"How many WordPress core security releases have shipped recently and how far back do the fixes go?","acceptedAnswer":{"@type":"Answer","text":"WordPress shipped seven core security releases since mid-July, including four releases in 41 days: 7.1.1, 7.1.2, 7.1.3, and 7.1.4. These closed more than 50 Critical or High severity vulnerabilities, with fixes backported to every branch still receiving security updates, going back to version 4.7. Teams maintaining older WordPress branches can keep up with backport coverage like this on daily.dev."}},{"@type":"Question","name":"How is WordPress using AI to handle its security vulnerability backlog?","acceptedAnswer":{"@type":"Answer","text":"WordPress built an AI-powered triaging system that reads incoming reports, reproduces them securely, and posts a summary with a severity recommendation, though human security researchers make the final call. This helped shrink the untriaged queue from 359 reports down to double digits. The same agentic tooling is also used proactively to hunt for vulnerabilities in core before they're reported. Developers evaluating AI for security triage in their own projects can follow approaches like this on daily.dev."}}]} ```