The RA team monitors for security releases based on the Drupal Security team’s schedule. Security release windows for Drupal use the following timeline:

• Drupal contributed projects: Every Wednesday
• Drupal core: One Wednesday a month (typically the third Wednesday)

A release window does not necessarily mean a release will always occur on that date. They exist so you can plan in advance for the possibility of a security release. In the unusual case of a highly critical security issue, such as an actively-exploited zero-day issue, releases can occur outside of the normal release window.

If the RA team is aware of particularly hazardous security updates available for common modules, or during long gaps between Drupal core security releases, we will periodically contact RA subscribers to inform them of available module security updates we can perform.