16 Apr 2026

feedDrupal.org aggregator

The Drop Times: Erdfisch Expands nerdfisch DevBits into Public Drupal Code Archive

Reusable fixes often remain confined to individual projects, forcing developers to solve the same problems repeatedly. erdfisch has expanded its internal DevBits system into a publicly accessible archive, exposing working Drupal code snippets drawn directly from project work. The collection prioritises immediate implementation over explanation, making internal solutions available without reshaping them into long-form documentation.

16 Apr 2026 2:41pm GMT

1xINTERNET blog: Drupal Is All In on AI. Now Comes the Hard Part

I co-founded 1xINTERNET on the conviction that Drupal was the right platform for ambitious web applications. AI changed that certainty. Here is what the Drupal AI Initiative is building, what organizations are getting first, and why the direction is clear.

16 Apr 2026 11:00am GMT

Drupal Starshot blog: Differentiating Marketplace Site Templates and Community Site Templates

Site templates are available through two distinct pathways, each serving different needs within the community.

The official Drupal.org Marketplace provides a curated collection of site templates that meet certain quality standards, and are built on top of Drupal CMS as a foundation.

Community templates offer an alternative pathway for innovation and experimentation without the constraints of the curation process, by publishing the template as a general project on Drupal.org.

Official Marketplace Site Templates

The Drupal.org Marketplace are built on top of Drupal CMS, and curated to provide new users with confidence that they're starting with a consistent, solid and professionally built foundation that follows established best practices.

Key characteristics

  • Templates undergo a review processes

  • Must follow Drupal CMS best practices for security, accessibility (WCAG 2.2 AA), performance, and code quality

  • In the beginning, focus is solely on growing Drupal CMS adoption; site templates accelerate adoption of Drupal CMS by providing context relevant demo content and Drupal Canvas-compatible theme

  • Clear documentation, maintenance commitments, and user support expectations

  • Currently open to Drupal Certified Partners (for organizations) and Ripplemakers (for individuals or very small companies). Apply to become a creator here.

Benefits

  • Consistency for users who need reliable, production-ready starting points

  • Quality assurance through professional review processes

  • Support and maintenance commitments for long-term sustainability

  • Revenue opportunities for professional template creators

  • Sustainability for the Drupal Association through revenue sharing

Community Site Templates

Anyone interested in contributing a template can do so now, by publishing it as a general project on Drupal.org. All free site templates, including marketplace templates, are general projects for packaging and distribution purposes. Community site templates will be considered for inclusion in the Drupal.org Marketplace based on their compatibility with the outlined criteria.

Key characteristics

  • Can be published without formal review or approval

  • Not bound by the same standards as Marketplace templates

  • Can be built using Drupal CMS or Drupal Core

  • Available to all community members

  • Can take risks and explore directions that might not fit Marketplace criteria

Benefits:

  • Innovation by removing barriers to experimentation

  • Diversity of approaches and implementations

  • Learning opportunities for the community to explore what's possible

  • Stepping stones that might eventually evolve into Marketplace templates

  • Lower barriers to entry for community contribution

16 Apr 2026 3:10am GMT

15 Apr 2026

feedDrupal.org aggregator

Security advisories: Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003

Project:
Drupal core
Date:
2026-April-15
Security risk:
Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability:
Cross-site scripting
Affected versions:
>= 11.3.0 < 11.3.7
CVE IDs:
CVE-2026-6367
Description:

Drupal 11.3 comes with support for completing entity suggestions whilst adding a link to CKEditor 5.

The suggestions aren't sufficiently sanitized and a malicious user could trigger a stored cross site scripting attack against another user.

Solution:

Install the latest version:

  • If you use Drupal 11.3.x, update to Drupal 11.3.7
  • Drupal versions below 11.3 are not affected by this vulnerability
Reported By:
Fixed By:
Coordinated By:

15 Apr 2026 7:27pm GMT

Security advisories: Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002

Project:
Drupal core
Date:
2026-April-15
Security risk:
Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon
Vulnerability:
Gadget Chain
Affected versions:
>= 8.0.0 < 10.5.9 || >= 10.6.0 < 10.6.7 || >= 11.0.0 < 11.2.11 || >= 11.3.0 < 11.3.7
CVE IDs:
CVE-2026-6366
Description:

Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application deserializes untrusted data due to another vulnerability.

This issue is not directly exploitable.

This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). There are no such known exploits in Drupal core.

Solution:

Install the latest version:

Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)

Reported By:
Fixed By:
Coordinated By:

15 Apr 2026 7:25pm GMT

Security advisories: Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001

Project:
Drupal core
Date:
2026-April-15
Security risk:
Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability:
Cross-site scripting
Affected versions:
>= 8.0.0 < 10.5.9 || >= 10.6.0 < 10.6.7 || >= 11.0.0 < 11.2.11 || >= 11.3.0 < 11.3.7
CVE IDs:
CVE-2026-6365
Description:

Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which which can lead to a cross-site scripting (XSS) vulnerability.

Solution:

Install the latest version:

Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)

Reported By:
Fixed By:
Coordinated By:

15 Apr 2026 7:24pm GMT

Drupal Association blog: DrupalCon Chicago 2026: Where Innovation Meets the Open Web

Written by members of the DrupalCon Chicago Steering Committee.

Contributors: Stephen Mustgrave, Avi Schwab, Nikki Flores, and Rosie Gladden.

DrupalCon Chicago 2026 brought together leading experts in digital experience development, open source innovation, and enterprise technology.

The event provided a unique opportunity to connect with decision-makers, technical leaders, and innovators shaping the future of digital experiences. More than 1,300 tech leaders, CEOs, developers, marketing executives, agencies, and enterprise decision-makers gathered to help define the future of the Open Web.

Group photo at DrupalCon Chicago 2026
Image: Group photo in Chicago (Photo by Curt Rochon, CC BY-NC 4.0)

​A Diverse and Multilingual Global Community

Participants from 26 separate countries brought with them an estimated 15+ languages, reflecting the rich linguistic and cultural diversity of the Drupal ecosystem. The United States (82.4%), Canada (6%), India (2%), Germany (1.2%) and Costa Rica (1.1%) were topping the list in terms of attendee numbers, with Brazil (1%), Colombia (0.8%) and the United Kingdom (0.8%) close behind.

This global span not only highlights Drupal's widespread adoption, but also underscores the strength of a community shaped by varied perspectives, experiences, and ideas from around the world. Next year we'd love to add more blue!​

Attendees by countries

​Event Attendance

A total of 1,316 participants attended in Chicago, an increase from 1,288 for Atlanta 2025. Of these we saw 394 first-time attendees, marking a 10.67% increase from those new to the event in 2025.

539 of 1,316 also chose to extend their learning at the Summits & Trainings, with the AI Summit seeing the largest turnout in its first year, with 104 attendees joining to learn about the latest insights connected to Drupal AI.

Welcoming the Next Generation: Drupal in a Day

Outside of the main conference, and following the successful Drupal in a Day organized ahead of DrupalCon Vienna by Hilmar Kári Hallbjörnsson, DrupalCon Chicago saw the North America inaugural program take place alongside the contribution day.

The training session, organized and staffed by ten volunteers, welcomed 55 learners of high school and college age to interact with Drupal CMS for the first time, helping to expand the reach of the community to new users of all ages. We thank the mentors and supporters who made this event a welcoming place for students, and particularly thank all the individual donors who made this happen, as well as Acquia for sponsoring, and Martin Anderson-Clutz and Jordan Thompson for instructing.

Drupal in a day participants
Image: Drupal in a day in Chicago (Photo by Paul Johnson, CC BY-NC 4.0)

Grassroots to Global

Building on the momentum of 2025, the local community ticket-sharing initiative (1 complimentary ticket for every 5th sold through participating organizations) resulted in an increase of 77.5% of ticket purchases which were affiliated with a local group at registration. This initiative continued to grow in both reach and impact, what began as a strong show of grassroots participation has evolved into a more connected and collaborative global network of local camps and meetups celebrating together at DrupalCon.

Participation has expanded beyond the initial groups, with 61 communities engaging through shared resources, cross-promotion, and increased visibility at the 2026 conference. This growth reflects not just higher numbers, but a deeper alignment across the community, where local leaders feel empowered, recognized, and increasingly integrated into the broader Drupal ecosystem.​

Attendees by camps

A Community Spanning All Skill Levels

DrupalCon Chicago 2026 showcased a well-balanced and highly skilled community, with attendees representing every stage of the Drupal journey. Experienced professionals made up the majority, including 348 advanced practitioners (32%) and 301 self-identified Drupal experts (27.7%), creating a strong foundation for in-depth technical exchange and innovation.

Intermediate attendees accounted for 297 participants (27.3%), playing a key role in connecting emerging talent with seasoned leaders. At the same time, the event remained welcoming to newcomers, with 117 beginners (10.8%) and 25 individuals completely new to Drupal (2.3%) joining the community.​

​Coummunity members by skills

Special Luncheons

The Drupal Association formerly required sponsors, who provided programming support for community interest luncheons. These were folded into general programming this year, and we'd like to acknowledge that not all programs had an assigned, designated host. In the next year, our focus is on strengthening local, regional, topical, and community interest groups, so please reach out to us on how to get connected.

Breakfast & Luncheons Registered
Black in Drupal Luncheon 68
Ripple Makers Breakfast 200
Women in Drupal Luncheon 200
Total 468

See You in Orlando

DrupalCon Orlando will see vision meet execution. Whether you're architecting enterprise platforms, launching your next big project, or scaling what you've already built in Drupal, this is the event that meets you where you are and pushes you further.

Save the date!

15 Apr 2026 5:15pm GMT

MidCamp - Midwest Drupal Camp: Continue the Momentum: The Tool to Convince Your Boss for MidCamp 2026!

Ready to Attend MidCamp 2026? We've Got You Covered

If, like us, you're still riding the wave from DrupalCon Chicago, MidCamp 2026 feels like it's right around the corner! MidCamp is the perfect place to dive further into what's next for Drupal, connect with your peers, and contribute to the momentum we're all feeling. But first, you might need to convince your boss to invest in your growth.

No worries-we've got your back! We've created a Convince Your Boss Tool to help you articulate the incredible value you'll bring back from MidCamp. From hands-on workshops to industry-leading insights, it's all about empowering your team with what's next in tech.

👉 Check out the tool now!

Get ready to:

Let us help you make MidCamp 2026 your next big career move.

15 Apr 2026 1:50pm GMT

14 Apr 2026

feedDrupal.org aggregator

DrupalCon News & Updates: Measuring What Matters: Building More Sustainable DrupalConEur

As DrupalCon continues to evolve, so does our responsibility to understand and reduce the impact of the events we create.

Great digital experiences don't exist in isolation. They are shaped not only by the technology we build and the communities we nurture, but also by the environmental footprint we leave behind.

At DrupalCon Vienna 2025, we took an important step forward by measuring the event's carbon footprint in detail, with measurement conducted by TerraVerde Sustainability, and the results tell a meaningful story.

Photo by Jo Da

Why measuring impact matters

Sustainability is not a one-time achievement. It is an ongoing process of learning, improving, and making better decisions over time.

The 2025 Event Carbon Measurement Report provides a comprehensive view of DrupalCon's environmental impact, helping us move from assumptions to data-driven action.

The total carbon footprint of the event was 512.8 tCO₂e, down significantly from 1,574.57 tCO₂e in 2024.

This progress reflects not only better planning, but also more intentional decisions, particularly in location and venue selection, where more efficient energy use and improved waste management played a key role.

Terra Verde logo

What we learned from DrupalCon Vienna 2025

One of the most important insights is clear: Travel remains the dominant source of emissions.

94-95% of emissions came from delegate travel, mostly driven by flights.

Measured Event Emissions - Total

However, while travel still represents the largest share, overall travel emissions were significantly lower than in 2024, supported in part by Vienna's central location and strong rail connectivity.

The remaining emissions are distributed across several categories. Excluding travel, the total footprint was 26.97 tCO₂e, with heating accounting for 48% of emissions, while materials, food & beverage, and accommodation were other large contributors.

Across the event, we also saw:

  • Energy consumption significantly decreased compared to previous years
  • Waste was reduced through improved recycling and diversion strategies
Total event emission graph

These insights help us move from general intentions to targeted action.

What sustainability looks like at DrupalCon

Sustainability at DrupalCon is built through intentional choices across the entire event experience:

  • Catering - Plant-forward meals, locally sourced ingredients, no disposables, and food donation
  • Wellbeing - Quiet spaces, wellness activities, and opportunities to recharge
  • Climate action - Energy-efficient venues, low-emission travel, and carbon reduction strategies
  • Community - Inclusive programs, scholarships, and initiatives that support diverse participation
  • Waste reduction - Minimal printing, refill stations, and reduced single-use materials
  • Partnerships - Working with sponsors and suppliers to align on sustainability goals

A shared responsibility

Drupal has always been more than just technology. It is a global community built on collaboration, openness, and shared values. Sustainability is a natural extension of those values.

By sharing these insights openly, we invite the Drupal community to be part of the solution.

Whether you are:

  • Choosing more sustainable travel options
  • Stay in green-certified hotels
  • Being mindful of materials and waste
  • Supporting more responsible event practices
  • Providing more detailed travel information during registration to help improve measurement accuracy

Your decisions matter.

Together, we can continue building DrupalCons that are not only impactful and inspiring, but also responsible and sustainable.

Rotterdam skyline

14 Apr 2026 9:48am GMT

Specbee: Introducing Node Cleanup - Your solution to managing & deleting unpublished nodes in Drupal 10/11

Still cleaning up messy content for hours? Read this blog to learn about the Node Cleanup module that can quickly filter, manage, and safely delete unused nodes to keep your Drupal 10/11 site organized.

14 Apr 2026 9:01am GMT

Drupal blog: Drupal CMS leadership changes

We're excited to announce updates to the Drupal CMS leadership team, with the addition of Bálint Kléri as our new Frontend Lead.

Bálint Kléri named Drupal CMS Frontend Lead

Bálint Kléri has been named Frontend Lead, a new leadership role created to oversee the frontend architecture for Drupal CMS, Mercury and Mercury-based themes. Bálint is a full-time contributor to Drupal Canvas, leading the development of Code Components for Acquia and a key contributor to Mercury, the Drupal CMS design system.

During development of Mercury, Bálint stepped in to guide the Tailwind CSS implementation and advocate for the use of best practices. We are grateful for his contributions already, and are excited to have him formally join the team. The addition of this frontend role is critical as we refine the Drupal CMS design system, providing users with a modern and adaptable foundation for Drupal sites and site templates.

Pamela Barone promoted to Product Lead

Pamela Barone is now Drupal CMS Product Lead, overseeing product direction, roadmap, prioritization, and delivery. Serving as Product Owner previously, this shift recognizes the product management responsibilities that Pamela has taken on during the evolution of Drupal CMS.

She will continue to work closely with me as I lead the Drupal CMS initiative. I'll continue to set direction, align teams, and ensure we have the support and momentum to achieve our goals.

We appreciate the ongoing support from Technocrat support in giving Pamela the time to contribute to Drupal CMS.

Tim Plunkett is stepping down as Technical Lead

Tim Plunkett is transitioning out of his role as Drupal CMS Technical Lead to dedicate his full focus to the development of Drupal Canvas. We thank Tim for his leadership and his employer Acquia for all of his contributions.

Adam Hoenich, Lead Architect for Drupal CMS, has been ably overseeing all things technical in the meantime and he will remain in that role. Adam's contribution to Drupal CMS is generously supported by Acquia.

Looking ahead

During DrupalCon Chicago, our leadership team met to discuss the future of Drupal CMS. The first question we asked was 'Do we still think this initiative is important for Drupal's future?' We think it is. We're proud of what we have delivered so far in version 2, with Canvas enablement and site templates as the highlights, but we know there is a lot more to do to meet our objective: To enable marketing teams to launch fully-branded, professional websites in hours, not weeks.

The leadership team is currently working to define the product roadmap for the next 6-12 months, with a strategic focus on launching sites faster with Drupal. We'd love to see new site templates in the marketplace and want to promote easier pathways from installation to going live with a range of hosting options. Other areas we are looking to pursue are: onboarding, better AI tooling, multilingual support for Canvas and site templates, and better support for common third-party integrations.

14 Apr 2026 5:44am GMT

Drupal Starshot blog: Drupal CMS leadership changes

We're excited to announce updates to the Drupal CMS leadership team, with the addition of Bálint Kléri as our new Frontend Lead.

Bálint Kléri named Drupal CMS Frontend Lead

Bálint Kléri has been named Frontend Lead, a new leadership role created to oversee the frontend architecture for Drupal CMS, Mercury and Mercury-based themes. Bálint is a full-time contributor to Drupal Canvas, leading the development of Code Components for Acquia and a key contributor to Mercury, the Drupal CMS design system.

During development of Mercury, Bálint stepped in to guide the Tailwind CSS implementation and advocate for the use of best practices. We are grateful for his contributions already, and are excited to have him formally join the team. The addition of this frontend role is critical as we refine the Drupal CMS design system, providing users with a modern and adaptable foundation for Drupal sites and site templates.

Pamela Barone promoted to Product Lead

Pamela Barone is now Drupal CMS Product Lead, overseeing product direction, roadmap, prioritization, and delivery. Serving as Product Owner previously, this shift recognizes the product management responsibilities that Pamela has taken on during the evolution of Drupal CMS.

She will continue to work closely with me as I lead the Drupal CMS initiative. I'll continue to set direction, align teams, and ensure we have the support and momentum to achieve our goals.

We appreciate the ongoing support from Technocrat support in giving Pamela the time to contribute to Drupal CMS.

Tim Plunkett is stepping down as Technical Lead

Tim Plunkett is transitioning out of his role as Drupal CMS Technical Lead to dedicate his full focus to the development of Drupal Canvas. We thank Tim for his leadership and his employer Acquia for all of his contributions.

Adam Hoenich, Lead Architect for Drupal CMS, has been ably overseeing all things technical in the meantime and he will remain in that role. Adam's contribution to Drupal CMS is generously supported by Acquia.

Looking ahead

During DrupalCon Chicago, our leadership team met to discuss the future of Drupal CMS. The first question we asked was 'Do we still think this initiative is important for Drupal's future?' We think it is. We're proud of what we have delivered so far in version 2, with Canvas enablement and site templates as the highlights, but we know there is a lot more to do to meet our objective: To enable marketing teams to launch fully-branded, professional websites in hours, not weeks.

The leadership team is currently working to define the product roadmap for the next 6-12 months, with a strategic focus on launching sites faster with Drupal. We'd love to see new site templates in the marketplace and want to promote easier pathways from installation to going live with a range of hosting options. Other areas we are looking to pursue are: onboarding, better AI tooling, multilingual support for Canvas and site templates, and better support for common third-party integrations.

14 Apr 2026 5:44am GMT

13 Apr 2026

feedDrupal.org aggregator

Nonprofit Drupal posts: April 2026 Drupal for Nonprofits Chat

Join us THURSDAY, April 16 at 1pm ET / 10am PT, for our regularly scheduled call to chat about all things Drupal and nonprofits. (Convert to your local time zone.)

We don't have anything specific on the agenda this month, so we'll have plenty of time to discuss anything that's on our minds at the intersection of Drupal and nonprofits. Got something specific you want to talk about? Feel free to share ahead of time in our collaborative Google document at https://nten.org/drupal/notes!

All nonprofit Drupal devs and users, regardless of experience level, are always welcome on this call.

This free call is sponsored by NTEN.org and open to everyone.

Information on joining the meeting can be found in our collaborative Google document.

13 Apr 2026 7:44pm GMT

Talking Drupal: Talking Drupal #548 - How to build your own CRM

In episode 548 we welcome back JD Leonard to discuss what CRMs are, what problems they solve, and which organizations benefit from them. JD explains why Drupal CRM defines CRM as "Contact Relationship Management," outlines core expectations like contact and relationship tracking and integrations, and describes Drupal CRM's Drupal-native architecture using dedicated, fieldable entity types for contacts, relationships, and contact methods. The panel compares Drupal CRM to older Drupal CRM efforts and user-based approaches, covers security considerations for PII and plans for field encryption, and highlights ecosystem projects such as CRM Email, CRM Membership (including Drupal Commerce integration), and event registration needs.

For show notes visit: https://www.talkingDrupal.com/548

Topics

Resources

Try the latest - https://drupal.org/project/crm Field encrypt - https://www.drupal.org/project/crm/issues/3558040 Primary entity reference - https://www.drupal.org/project/primary_entity_reference Member Platform initiative - https://www.drupal.org/project/member Financial sponsor of Steve Ayers' time working on Drupal CRM - https://www.govwebworks.com https://www.portlandwebworks.com CRM ecosystem modules - https://www.drupal.org/project/crm/ecosystem Drupal Slack #crm channel: - https://drupal.slack.com/archives/C08N90UF9TR

Guests

JD Leonard - modernbizconsulting.com jdleonard

Hosts

Nic Laflin - nLighteneddevelopment.com nicxvan John Picozzi - epam.com johnpicozzi

Martin Anderson-Clutz - mandclu.com mandclu

Module of the Week

with Martin Anderson-Clutz

Social Media Links Block and Field

The modules provides a configurable block that display links (icons) to your profiles on various popular networking sites. With this module, a website can be quickly extended with a "Follow us" functionality. Or you make the block available for your site editors, and they can configure the social networks themselves.

13 Apr 2026 6:00pm GMT

The Drop Times: Edges of Judgment

The conversation around AI is drifting into a familiar trap. We're treating it as a question of alignment when it's really a question of judgment. A recent reflection by Matthew Tift, written after DrupalCon, captures this tension well. Debates harden into sides, positions get defended, and nuance disappears. But the more useful observation is this: most of the people doing meaningful work with AI aren't anchored to a fixed stance. They're working through it, using principles they already trust.

That's the part many organisations are skipping. Instead of grounding decisions in existing values, they're reacting to the pace of change. This creates a false urgency to define a position quickly, often at the expense of clarity. In practice, that leads to inconsistent decisions. One team leans into AI for speed, another resists it for control, and neither is wrong. What's missing is a shared framework that makes those decisions coherent over time.

At TDT, we see this as less of a technology shift and more of a decision-making test. AI doesn't require new values as much as it exposes whether existing ones are actually being used. If your principles only show up in documentation but not in how choices are made under pressure, they're not doing much work. The organisations that navigate this well won't be the ones that pick a side early, but the ones that stay consistent in how they decide as the landscape keeps changing.

Discover Drupal

Events

Free Software

Organisation News

Additional developments from across the Drupal ecosystem were published during the week. Readers can follow The DropTimes on LinkedIn, Twitter, Bluesky, and Facebook for ongoing updates. The publication is also active on Drupal Slack in the #thedroptimes channel.

Alka Elizabeth
Sub-editor
The DropTimes

13 Apr 2026 4:29pm GMT

1xINTERNET blog: Is your website optimised for AIO / GEO?

Is your website ready for AI search? Learn how AIO and GEO help your content get cited in AI-generated answers, not just ranked in search results. Discover the S1x SIGNALS framework and request a free assessment.

13 Apr 2026 12:00pm GMT