Title: core – Making WordPress Secure --- # Tag Archives: core [ ](https://profiles.wordpress.org/rfaile313/) [Rudy Faile](https://profiles.wordpress.org/rfaile313/) 4:58 pm _on_ October 29, 2026 Tags: core    # 󠀁[The Core Security Initiative: two months in](https://make.wordpress.org/security/2026/10/29/the-core-security-initiative-two-months-in/)󠁿 Two months ago we launched the [Core Security Initiative](https://make.wordpress.org/security/2026/08/28/the-core-security-initiative/): three pillars, one goal, a stronger and safer WordPress. Here’s where it stands, what we’ve changed, and how you can help. ## The volume For about a decade, the WordPress HackerOne program received 20 to 30 reports a month. In July it received 450. In [August it received 773](https://www.therepository.email/wordpress-tightens-bug-bounty-scope-after-monthly-security-reports-nearly-double-to-773). The [program page](https://hackerone.com/wordpress) currently shows 2,306 reports in the past 90 days. We’ve received more than 3,000 reports this year, which is more than the previous twelve years combined. ![](https://make.wordpress.org/security/files/2026/10/csi-hackerone-submissions- by-quarter-1-1024x584.png) Submissions, excluding spam and N/A. A lot of this is real research made faster by AI tools, and it’s making WordPress safer. It also means everything after a report lands (triage, fixing, backporting, testing, shipping) has to move faster too. That’s what this initiative is for. ## A: A better release process WordPress has shipped four security releases in 41 days: [7.1.1](https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/) on September 17, [7.1.2](https://wordpress.org/news/2026/09/wordpress-7-1-2-release/) on September 22, [7.1.3](https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/) on October 6, and [7.1.4](https://wordpress.org/news/2026/10/wordpress-7-1-4/) on October 28. That’s seven coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. security releases since mid July, with more than 50 Critical or High vulnerabilities closed. Every fix went to every branch still receiving security updates, all the way back to 4.7. ![](https://make.wordpress.org/security/files/2026/10/csi-release-timeline-1-1024x603. png) Each release has a set squad filled by trusted and experienced contributors with clear roles: a release host, core committers, someone on Mission Control to build packages, a WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. [https://wordpress.org/](https://wordpress.org/) committer to turn on autoupdates and language packs, a HelpHub editor, and a GutenbergGutenberg The Gutenberg project is the new Editor Interface for WordPress. The editor improves the process and experience of creating new content, making writing rich content much simpler. It uses ‘blocks’ to add richness rather than shortcodes, custom HTML etc. [https://wordpress.org/gutenberg/](https://wordpress.org/gutenberg/) lead. Everyone knows their part before release day. Releases ship in two waves, the most widely used versions first, then older branches, so most sites get protected as early as possible. We’re also automating the slow parts. Backporting a fix used to mean running scripts by hand across up to 25 branches, for every fix. Tools that aren’t security sensitive live in public in [core-release-utils](https://github.com/WordPress/core-release-utils). Today, 73% of the 109 steps in a security release have automation. Some friction stays on purpose e.g. only a small group can package a release, which helps protect against things like supply chain attacks. ## B: Breaking the backlog On September 1st we [updated the program’s scope](https://make.wordpress.org/security/2026/09/01/updates-to-the-wordpress-vulnerability-disclosure-program/) to focus researchers on issues with clear security impact. We’ve also developed an AI powered triaging system that reads incoming reports, reproduces them securely, and posts a summary and a recommendation (is it valid, how severe, etc) and our security researchers still make the final call. We’ve closed nearly 3,000 reports this year. The untriaged queue went from 359 to double digits, and we’re working to keep it there. ![](https://make.wordpress.org/security/files/2026/10/csi-backlog-queue-1024x609. png) ## C: Crush vulnerabilities with AI Reacting to reports isn’t enough, we want to find bugs before anyone else does. The agentic tooling we built to triage incoming reports, which reads the code and checks whether a report holds up, is now pointed the other way: hunting for vulnerabilities in core before anyone reports them. We’re running it with open weight models and purpose built harnesses, and what it finds goes through the same release process. We also [enrolled WordPress in Anthropic’s OSS Scanner](https://github.com/anthropics/oss-scanner/pull/632) which gives open sourceOpen Source Open Source denotes software for which the original source code is made freely available and may be redistributed and modified. Open Source **must be** delivered via a licensing model, see GPL. projects free security scans with Anthropic’s strongest models and we’ve already started addressing the issues flagged by the first scan results, with [Anthropic credited in the release announcements](https://wordpress.org/news/2026/10/wordpress-7-1-4/). ## How you can help **Researchers:** read the [updated guidelines](https://make.wordpress.org/security/2026/09/01/updates-to-the-wordpress-vulnerability-disclosure-program/) before you report through [HackerOne](https://hackerone.com/wordpress). One clear, high impact report helps more than ten informative or out of scope reports. **Organizations:** if your business runs on WordPress, help us keep this pace! The most useful help is sponsoring people for triage and release work, and contributing to the bounty program. **Contributors:** the release tooling is open in [core-release-utils](https://github.com/WordPress/core-release-utils), and on release days you can help test packages in [#core](https://make.wordpress.org/security/tag/core/) on [Making WordPress Slack](https://make.wordpress.org/chat/). Thank you to everyone on the security team, the core committers, and every contributor who’s been part of this. We’re on it, and there’s room for more people to join us. * [Login to Reply](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fmake.wordpress.org%2Fsecurity%2F2026%2F10%2F29%2Fthe-core-security-initiative-two-months-in%2F%23respond&locale=en_US)