Drupal CMS News Digest
developments tricks, articles and reviews from Drupal specialists
Dynamosys Insights: Drupal Commerce Security Alert: Update Your Store and Check Your Orders
An actively exploited Drupal Commerce vulnerability could financially affect online stores. Security updates are available, and store owners should also review their orders for inconsistencies.
https://www.dynamosys.com/insi
Drupal AI Initiative: Turning AI's Promise Into Practical Results at Drupal AI Summit Paris 2026
Turning AI's Promise Into Practical Results at Drupal AI Summit Paris 2026
For most organizations, the question is no longer whether AI matters, but how AI fits into their own work, on what terms, and at what cost.
On December 1, 2026, the Drupal AI Summit Paris will bring together experts and organizations that have already worked through those questions, including EU institutions and medical researchers, to share what they learned.
Your summit ticket also gets you all three days of the Future of Software Technologies (FOST) conference, December 1-3, with over 300 sessions to choose from.
Marketing and Content Teams Moving Faster Without Losing Their Voice
For marketing and content teams, trustworthy content is essential. It has to sound like their brand and get published without weeks of waiting. That’s the promise of Drupal AI.
When pages drift off-brand and don't keep up with the brand, they lose their importance and credibility. They lose what sets them apart.
AI working as the editor, not the author, is the focus of this session. Bruno Bruno from 1xINTERNET will show how AI can review content against an organization’s own standards and suggest fixes, keeping hundreds of pages consistent. All while people still write the content and decide what gets published.
Landing pages are often the centerpiece of a campaign. The summit will also feature Canvas AI, showing how you...
https://www.drupal.org/about/a
The Drop Times: How to Use AI Coding Agents on Drupal Projects with AGENTS.md, Tests and MCP
AI-generated Drupal code can look correct while using outdated APIs, invented fields or incomplete cache metadata. Project instructions and repeatable checks help developers identify those mistakes before committing changes.
https://www.thedroptimes.com/7
The Drop Times: X to Drupal: QED42 Migrates 646 Pages From Webflow to Drupal 11
QED42's website looked correct after an early AI-assisted migration, but its Drupal backend told a different story. Souvik Pal explains how that finding changed the framework.
https://www.thedroptimes.com/7
The Drop Times: The DropTimes October Townhall Details Editorial Shift and Community Plans
With fewer routine stories and more time devoted to research, The DropTimes is examining how contributors can help determine which Drupal developments receive deeper coverage.
https://www.thedroptimes.com/7
xjm: Do you like having secure Drupal sites? Help fund xjm.
Do you like having secure Drupal sites? Help fund xjm.
xjm
Wed, 10/28/2026 - 23:00 The problem: Certain maintainer roles keep Drupal's lights on. Right now, there's a brownout.Interim Drupal Association CEO Tiffany Farriss recently wrote about bringing to light "the work that just happens": the mostly invisible (but essential) services the Drupal Association provides to sustain the Drupal project and community. I love this description. If everything's going well, maybe you don't even know or notice. But on the other hand, maybe you should. Image
Drupal Association booth at DrupalCon Vienna 2025. Photo credit: Matthew Saunders.
The Drupal Core Leadership Team has its own version of work that "just happens", a bit similar and a bit different. We're more likely to have our work celebrated, especially by other contributors. On the other hand, though, there's plenty more going on behind the scenes… and outside the core development bubble, what we do is mostly just summarized in one line as an external dependency for someone's contributed project, strategic initiative, or web application.Certain Core Leadership roles (specifically those of the committer, release manager, and team facilitator) are even more like...
https://xjmdrupal.org/blog/cor
Drupal blog: 256 Advisories in Five Months: Results from the Drupal AI Security Initiative
When the Drupal Association launched the Drupal AI Security Initiative with Alpha-Omega this past June, our goal was to test whether a fractional, funded team, pairing fixers, reviewers, and infrastructure engineering alongside our volunteer Security Team, could protect maintainers from an incoming wave of AI-assisted vulnerability reports.
Five months later, that anticipated wave is fully visible in the public data.
From June through October 2026, Drupal published 256 security advisories. That five-month total exceeds the 250 advisories published across the previous 30 months combined. Baseline volume climbed from an average of 8 advisories per month in early 2026 to 28 in June, 74 in September, and 106 in October. The eight highest-volume publication days in our records since 2018 all landed within the last five months, peaking at 39 advisories on October 28.
The data marks the completion of our initial Clarity phase. It demonstrates why the economics of vulnerability discovery have permanently shifted and proves that funding the complete review workflow is the only reason our volunteer process kept publishing without buckling.
Monthly Drupal security advisories published from December 2023 to October 2026. The surge beginning in June 2026 reflects an increase in automated discovery velocity and disclosure throughput supported by the SEIR grant, not a shift in Drupal...
Monthly Drupal security advisories published from December 2023 to October 2026. The surge beginning in June 2026 reflects an increase in automated discovery velocity and disclosure throughput supported by the SEIR grant, not a shift in Drupal...
https://www.drupal.org/blog/25
Dries Buytaert: Website migration costs are going to zero
Within three years, I expect the technical work of moving a website from one platform to another to cost close to nothing.
The existing site gives the agent a reference implementation. It can crawl matching URLs, diff the rendered HTML, compare screenshots, and, given admin access, run the same publishing workflows to check content changes, moderation states, and permissions.
Comparing the two systems under equivalent inputs is called differential testing. Agents work well when they can check themselves against tests. The existing site provides the baseline.
I could be wrong about the timeline, or about how close the cost gets to zero. Treat it as a business model stress test anyway: assume customers can leave whenever they want, and consider what changes for vendors, agencies, and Open Source.
Some of these changes are not new, but cheap migrations could push them much further:
Switching costs stop protecting vendors. Plenty of software companies keep customers because switching costs are high, not because their product is the best. When a customer can walk into a renewal with a working copy of their site on another platform, the vendor has to justify its price through the value it delivers.
Proprietary vendors will have to sell the way Open Source companies do. Open Source companies had to build businesses on free code, so they sell hosting, support, and other services....
https://dri.es/website-migrati
Website migration costs are going to zero
Within three years, I expect the technical work of moving a website from one platform to another to cost close to nothing.
The existing site gives the agent a reference implementation. It can crawl matching URLs, diff the rendered HTML, compare screenshots, and, given admin access, run the same publishing workflows to check content changes, moderation states, and permissions.
Comparing the two systems under equivalent inputs is called differential testing. Agents work well when they can check themselves against tests. The existing site provides the baseline.
Some of these changes are not new, but cheap migrations could push them much further:
Switching costs stop protecting vendors. Plenty of software companies keep customers because switching costs are high, not because their product is the best. When a customer can walk into a renewal with a working copy of their site on another platform, the vendor has to justify its price through the value it delivers.
Proprietary vendors will have to sell the way Open Source companies do. Open Source companies had to build businesses around free code, so they sell hosting, support, and other services. Customers will keep paying for what has to keep running: deploying, securing, scaling, and monitoring.
Agents favor CMSs they can try. Open Source CMSs can be tried directly, while a proprietary CMS behind a sales call may never get...
https://dri.es/website-migrati
Lucius Digital: How I used PHPCS, PHPCBF and an AI coding agent to clean up Drupal code
I had been postponing Drupal coding standards fixes in distro OpenLucius for far too long now. There were always more interesting things to do: fixing bugs, building new features, and improving existing functionality. While code style fixes should always be applied before a GIT commit.
So this just needed to be done. But fixing hundreds of PHP CodeSniffer violations was not exactly what I wanted to spend my time on. Earlier I ran PHPCBF, the automatic fixer included with PHPCS. It fixed a lot, but there was still so much left to do.
Now, let's AI this.
https://www.lucius.digital/en/
The Drop Times: Drupal AI Modules by Use Case: What to Install and How Mature Each Is
Sixty-two maintained Drupal AI projects, one per job, each with its install count, latest release and security advisory status from Drupal.org.
https://www.thedroptimes.com/7
LakeDrops Drupal Consulting, Development and Hosting: One trace, inside and outside Drupal: a proposal for Rosetta
One trace, inside and outside Drupal: a proposal for Rosetta Photo by Jason Leung on Unsplash Jürgen Haas
Wed 28 Oct 2026 - 15:30 Dries Buytaert's Rosetta initiative wants Drupal modules to describe their data and operations once, so AI assistants, front ends and workflow engines can reuse them. Tools compose: a Maestro workflow can call an ECA model exposed as a tool. When that fails, Jürgen gets two unrelated traces. ECA, the AI module, FlowDrop and Maestro each record runs their own way, and no run ID crosses a system boundary. Tool API has reserved attach points for call IDs and audit records, but four callers bypass its runner. Jürgen proposes one shared API for tracing, debugging and replay. OpenTelemetry handles correlation and export. One optimized serializer records step state, storage is pluggable, and playback spans systems. He lists six open questions and invites the discussion now, before the Rosetta Sprint.
https://www.lakedrops.com/en/b
Matt Glaman: ContribKanban now tracks GitLab work items
Drupal projects are moving their issues from Drupal.org to GitLab work items, and ContribKanban couldn't see them. I rebuilt it so that one board tracks both.
https://mglaman.dev/blog/contr
The Drop Times: WordPal Converts WordPress Block Themes for Drupal Canvas and Display Builder
A familiar WordPress design can now become an editable Drupal site. But what survives the conversion, who maintains the result, and how close is the experiment to working on real projects?
https://www.thedroptimes.com/7
Stuart Clark (Deciphered): Vale 1.0.0; prose linting for Drupal
Drupal is 25 this year, and its code has had linters for a long time. Its words haven't, and with Drupal AI writing straight into the node form, more of them now come from a model. A search of drupal.org turns up readability scores and spellcheckers, but nothing that holds a save to your own style guide.
Vale (for Drupal) does that with the Vale prose linter. Break an error-level rule and the save is refused, or only the publish if drafts should save freely. 1.0.0 is out now for Drupal 10.3, 11 and 12, and needs the Vale binary on your server.
Vale in CI is the right tool for Markdown in a repository. Content in Drupal arrives through a save instead: the node form, a Fully Decoupled frontend over JSON:API, a workspace being published. The module checks there, on the server, whatever editor the author used.
Continue reading →
https://stuar.tc/writing/vale-
Drupal Association blog: In the Open with Tiffany Farriss: What it takes to sustain the Drupal commons
In the Open is a weekly series from Drupal Association Interim CEO Tiffany Farriss, sharing what she is hearing across the Drupal community and where the Association is headed. In this episode: why Drupal's commons is under pressure, how the Drupal Certified Partner program is evolving, and what it takes to keep free software running for the next 25 years.
"Drupal is free. The code of Drupal is free forever. But those of us who run Drupal know that running Drupal has never been free."
The following is a transcript of Tiffany's remarks, lightly edited for readability.
What I'm hearing from the community
The thing that's top of mind for me this week is reflection. I've spent a lot of time listening to folks, talking to folks, asking a lot of questions. I wanted to take a few minutes to share back some of the things I'm hearing, because these are the things motivating the changes in how I'm thinking about existing programs, and about how we might want to do things differently for the next 25 years of Drupal.
Whether it was the ecosystem survey, the business community survey, or conversations with the core release maintainers and other parts of the community, it's very clear to me that our commons is fragile. The technology of Drupal itself is a brick. It is solid. We are super proud of our security team. But the people and the funding sustaining it aren't yet in a sustainable...
https://www.drupal.org/associa
