How can you tell that a project has awesome infrastructure?
You read in a mailing list that the project will release a security update in a few days. You add it to your calendar so you don't forget to update everything and everyone. Then you get an URGENT IMPORTANT email from one hosting provider. Then from a second and a third. All about this security update.
Then you read a reminder in a themed Telegram channel. Then your colleagues come alive in Jira, each of them also writing about the upcoming update. After the colleagues, the clients come alive: they've also been notified by their hosting providers and are now worried. In short, EVERYONE already knows that Drupal is releasing a security patch tomorrow evening. Everyone knows, everyone is getting ready.
So I proclaim unto you as well: yes, tomorrow between 17:00 and 21:00 UTC a security patch for Drupal 10 and 11 is due, here's the page about it. The update is marked as highly critical, scoring 20 out of 25 on the scale of trash, mayhem and debauchery security risk. There's a smell of ozone in the air, and the scars from Drupalgeddon I and II have started to ache.
Update, friends, as soon as possible — you need to. And if you'd like to wait and see what happens first, I can say with full responsibility: it's always better to update and watch what happens to those who didn't than the other way around ;)
And yes — this is the kind of awesome infrastructure Drupal has these days. A separate mailing list for security updates. A team that deals with these holes. Security checks not only in core, but in contributed modules too. Patches released on a set day with advance notice.
And yes — Drupal is completely free on top of all that.