fidzu : Drupal

Turning AI's Promise Into Practical Results at Drupal AI Summit Paris 2026

For most organizations, the question is no longer whether AI matters, but how AI fits into their own work, on what terms, and at what cost.

On December 1, 2026, the Drupal AI Summit Paris will bring together experts and organizations that have already worked through those questions, including EU institutions and medical researchers, to share what they learned.

Your summit ticket also gets you all three days of the Future of Software Technologies (FOST) conference, December 1-3, with over 300 sessions to choose from.

Marketing and Content Teams Moving Faster Without Losing Their Voice

For marketing and content teams, trustworthy content is essential. It has to sound like their brand and get published without weeks of waiting. That's the promise of Drupal AI.

When pages drift off-brand and don't keep up with the brand, they lose their importance and credibility. They lose what sets them apart.

AI working as the editor, not the author, is the focus of this session. Bruno Bruno from 1xINTERNET will show how AI can review content against an organization's own standards and suggest fixes, keeping hundreds of pages consistent. All while people still write the content and decide what gets published.

Landing pages are often the centerpiece of a campaign. The summit will also feature Canvas AI, showing how you can build a complete, brand-compliant landing page from a text prompt or by drag and drop, and then route it to the right people for approval. That way, the page goes live on time and in the right voice.

Marketing teams also have to make changes across many pages at once. Fabian Franz from Tag1 will demonstrate how AI can make a change across an entire university site in a separate workspace, so nothing reaches the live site until a person reviews and publishes it.

Preparing for a Changing Search Landscape

The way people discover information online is changing. Increasingly, potential customers are turning to AI assistants and answer engines to research products, services, and organizations.

For website owners and marketing teams, this raises an important concern: content that performs well in traditional search may not necessarily be discoverable or cited by AI systems.

Two sessions at the summit tackle this question: one focused on what's changing and the other on how to respond.

Martin Anderson-Clutz from Acquia will look at how AI is changing the role of websites, from how content is discovered to how organizations approach personalization and digital marketing.

Christoph Breidert from 1xINTERNET picks up from there with a practical approach to Answer Engine Optimization (AEO), building on one of last year's most popular discussions about AI search visibility. His session will explore how organizations can with S1xSignals assess their content for citation readiness, query alignment, content structure, authority and trust, semantic clarity, and technical accessibility.

Content structure, metadata, and schema are at the heart of these signals, and Drupal does these well.

Learning From Organizations Already Putting AI to Work

There is a considerable difference between showing what AI can do and making it work in an organization with established systems, responsibilities, and regulatory requirements.

Tens of thousands of candidates turn to the European Personnel Selection Office (EPSO) for information about careers with the European Union institutions. Working with Dropsolid, EPSO implemented an AI-powered answer engine to help them find what they need in all 24 official EU languages.

It uses EPSO's own documentation rather than general AI information, cites the source behind every answer, and runs on European-sovereign infrastructure with governance and auditability built in. At the summit, Dominique De Cooman, Founder and CEO of Dropsolid AI, will explain how Drupal's structured content and API-first architecture make all of that possible.

Not every use of AI faces the public. At the Clinical Practice Research Datalink (CPRD), it works inside the review process. CPRD provides anonymized clinical data to researchers around the world, and every application to use that data goes through a careful, multi-stage human review. CPRD added an AI reviewer that checks each application against its own rules on data use, while people still make the decisions. At the summit, Vijay Mani from Reading Room will share how they made it work in a highly regulated environment.

On top of EPSO and CPRD, Dan Lemon from amazee.io will present more examples of Drupal AI in production, including content classification, accessible content rewriting, and improved search experiences, all supported by private AI infrastructure. Some of these organizations went from not using AI to making it an integral part of their work cycle.

Moving Forward With AI While Maintaining Control

For many European organizations, responsible AI and data sovereignty are central to technology choices. Decision-makers need straightforward information to make clear, well-thought-out plans.

Of course, they also have to follow the GDPR, and the fines for getting it wrong can be large. So they need to know where their data is processed, which providers can access it, and who reviews what AI produces. Open source lets them make those choices for themselves, and Drupal AI supports multiple models and providers, including locally hosted options, so each organization can choose what fits best.

Two sessions pick up from there: Jamie Abrahams from FreelyGive will look at how subscriptions, the fear of lock-in, and the push for national AI sovereignty are leading people, companies, and governments toward open source. Wolfgang Ziegler from drunomics will show how people and AI agents can combine efforts while always allowing for approval to rest with people.

Both point to the same idea: adopting AI shouldn't mean giving up control of an organization's data, content, or decisions.

One Summit, Hundreds of Opportunities to Learn

The Drupal AI Summit opens the Future of Software Technologies (FOST) conference, December 1-3, 2026, at CNIT Forest in Paris. More than 5,000 people are expected across the three days.

If you make decisions about AI, run a website, or work in marketing, it's a chance to see how AI can improve what you already do, and what may shape your next decisions.

Friends of the Drupal Community can get a summit ticket for €149, which covers all of FOST. The regular FOST pass is €499, so it's a remarkable value, especially with everything else that's included.

Last year's event sold out, and we expect the same this time, so if you're thinking about coming, get your ticket now.

Frequently Asked Questions

When and where is the Drupal AI Summit Paris 2026?

On 1 December 2026, at CNIT Forest in Paris. It opens the Future of Software Technologies (FOST) conference, which runs 1 to 3 December.

How much does a ticket cost?

For Friends of the Drupal Community, a summit ticket is €149, and it covers all of FOST. The regular FOST pass is €499.

What does a summit ticket include?

All three days of FOST, with more than 25 conferences and over 300 sessions.

Who should attend?

Marketing and content teams, IT and compliance teams, and business leaders who want to see how AI can fit into their own work, on their own terms.

When the Drupal Association launched the Drupal AI Security Initiative with Alpha-Omega this past June, our goal was to test whether a fractional, funded team, pairing fixers, reviewers, and infrastructure engineering alongside our volunteer Security Team, could protect maintainers from an incoming wave of AI-assisted vulnerability reports.

Five months later, that anticipated wave is fully visible in the public data.

From June through October 2026, Drupal published 256 security advisories. That five-month total exceeds the 250 advisories published across the previous 30 months combined. Baseline volume climbed from an average of 8 advisories per month in early 2026 to 28 in June, 74 in September, and 106 in October. The eight highest-volume publication days in our records since 2018 all landed within the last five months, peaking at 39 advisories on October 28.

The data marks the completion of our initial Clarity phase. It demonstrates why the economics of vulnerability discovery have permanently shifted and proves that funding the complete review workflow is the only reason our volunteer process kept publishing without buckling.

Monthly Drupal security advisories published from December 2023 to October 2026. The surge beginning in June 2026 reflects an increase in automated discovery velocity and disclosure throughput supported by the SEIR grant, not a shift in Drupal's codebase security.

Why Advisory Volume Surged: The Changing Economics of Discovery

The surge in Drupal security advisories is driven by a fundamental shift in the economics of vulnerability discovery, not a change in Drupal's underlying attack surface. The vulnerabilities surfacing in 2026 are primarily latent bugs in mature core and contributed code that AI-assisted analysis has made cheap, fast, and automatable to identify across projects simultaneously. Since 1 June, 134 different people have been credited as reporters on Drupal advisories. In all of 2025, 68 people were.

The volume of advisories and CVEs Drupal has experienced between June and October is not an isolated event. Telemetry shared across the Alpha-Omega cohort and confirmed in our discussions with global edge security teams reveals that this massive, simultaneous surge in automated vulnerability disclosures is playing out across every major open-source ecosystem.

Most of these reports came from volunteers and outside researchers, many of them using AI tools. Every advisory represents a real issue that was found, fixed, reviewed, and disclosed responsibly. That is the system working. The question the Clarity phase set out to answer was whether it could keep working at this pace.

About the SEIR Grant

The grant came at exactly the right time. The Drupal Association received it from Alpha-Omega on May 19, 2026, and the funded team started work in early June. That same month, advisory volume began to rise: 28 advisories in June, against an average of 8.3 a month from December 2023 through May 2026. The Security Team could not have handled this volume without the grant.

The grant subsidizes part of the time for a fractional team. Drew Webber (@mcdruid) is the Fixer: he finds issues, writes patches, and builds tooling. Greg Knaddison (@greggles) and Michael Hess (@mlhess) are the Reviewers: they triage reports and review fixes. Neil Drumm (@drumm) covers Drupal.org infrastructure. Tim Lehnen (@hestenet) and I coordinate the program for the Drupal Association. The team works alongside the volunteer Drupal Security Team, which has kept up its usual work throughout.

In July, we reported 10 resolved security issues in the first six weeks, against a commitment of 8 for the whole grant. The credits on published advisories show where the funded time has gone since then:

Without the SEIR program, the SEIR team members would not have been able to adapt and scale to the increased volume as they have.

Phase 1 Lessons: Discovery Is Cheap, Intake Is the Bottleneck

• Finding vulnerabilities is no longer the slow step. AI-assisted analysis made discovery cheap, so the work piled up later in the process: first in reviewing fixes, then in intake, where someone has to decide whether a new report is valid, whether it is new, and who should handle it.
• Our own process showed strain. The busiest publication days were preceded by review work piling up against the release deadline. A process that depends on a push at the deadline does not scale, so we are trying changes as ordinary as a standing early-week review pass.
• The SEIR cohort connected Drupal to partners. Through the cohort, Drupal joined Patch the Planet, run by Trail of Bits and OpenAI. A Trail of Bits report against one contributed module led to SA-CORE-2026-014, a critical fix in Drupal core released on October 14.
• Shared scanning tools can miss code silently. Opengrep's PHP parser skipped valid PHP 8 code without reporting an error, in about 350 files across 176 contributed projects and every supported branch of core. We reported it, and the fix was merged upstream on September 1, so every Opengrep user gets it.
• Drupal adds depth to the SEIR cohort. Other ecosystems in the cohort bring reach and volume. Drupal brings a large, long-lived codebase with security coverage across thousands of projects, which tests shared tools hard. When those tests find a problem, as with Opengrep, the fix goes upstream to everyone.
• Some bugs follow systemic patterns best addressed architecturally. Six hardening changes went into Drupal core through the public issue queue, including three that neutralize known gadget chains used in PHP object injection attacks (see Issue #3524971 and related core hardening commits).
• AI tools for maintainers with guardrails. Triagebot posts one message per new report, with a suggested classification and any likely duplicates, and does nothing else. AI-assisted tooling also proposes weakness classifications for Drupal's CVE records, with mandatory human verification on every entry. Since mid-August 2026, Triagebot has triaged hundreds of new reports into the Security Team's Slack channel, flagging roughly 20% as probable duplicates.
• Release capacity is the next constraint. A security fix reaches sites only when a release ships. Core maintainers have opened proposals to change the security release process, starting with a separate release process for drupal/core-recommended.

Phase 2 (Attention): Hardening GitLab Intake and Release Pipelines

Attention focuses on intake, in two directions:

1. Triage: we are extending Triagebot from Slack notifications to the GitLab API, so classification and duplicate detection happen where reports are filed, under the same one-action rule.
2. Reporting: with the Security Team and maintainers, we are writing a working standard for what a useful AI-assisted security report must contain.

Alongside that, core maintainers have opened proposals to make security releases faster and more predictable.

Upcoming Deep Dives: Upstream Fixes, Tooling, and Standards

Over the next few weeks, we will publish a short posts about:

• How a report from Trail of Bits, through the Patch the Planet program, became the critical core fix SA-CORE-2026-014
• How we identified a silent parser bug in Opengrep, patched it upstream, and landed six systemic hardening changes in Drupal core
• The tools engineered for Security Team intake, and what we suggest to open-source projects evaluating automated AI scanning

If you maintain a Drupal project or report security issues, please keep sharing examples of good and bad AI-assisted security reports in the #security-discussion channel on Drupal Slack.

Thanks

Thank you to Alpha-Omega, the Open Source Security Foundation (OpenSSF), and the Linux Foundation for the grant, and for access to AI tooling from Anthropic. Thank you to Trail of Bits and OpenAI for Patch the Planet; to the Open Source Technology Improvement Fund (OSTIF) and the PHP Foundation for tooling and protocols we now use daily; and to the SEIR cohort across a dozen ecosystems, including Ruby, Rust, Node.js, Python, Perl, Erlang, FreeBSD, and Eclipse, for comparing notes every week.

Most of all, thank you to the volunteers on the Drupal Security Team, who have protected Drupal sites for more than 20 years and kept doing so through the busiest five months in our records.

At DrupalCon Rotterdam, Dries asked the community to talk louder about Drupal. The platform is years ahead of its reputation, and no single organisation can close that gap alone. To that end, the Drupal Association launched the Drupal Advocacy Program: tell Drupal's story in your own voice, and earn contribution credits for it, through the same system that recognises code.

This first month has been a proper pilot: we've built the program as we've gone. A month in, we think it's a success. The community is energised, we've developed a credit scoring matrix, and we've reviewed 264 pieces of advocacy. Here's the month by the numbers, the people and content that stood out, and what we've learned.

The first month in numbers

264 pieces of content went through review in Month 1, from nearly 150 contributors. 117 came in through the submission form; the other 147 we found ourselves. Yes, this month we did some of our own tracking. But fill in the form anyway - it's how we make sure we don't miss you, and it's how you credit your sources. And if you're submitting your own work, we're happy to review anything you've published in 2026. Your back catalog counts.

Every piece was scored against the credit matrix (below): a base value per channel, one of three tiers, doubled for content on the quarterly theme; 105 pieces earned the doubling. And if someone named you as a source in their submission, you picked up a credit too: one per attribution, 71 in total.

All up, around 2,400 contribution credits are going out for Month 1 (2,336 for content plus 71 attribution credits) through the same Drupal.org system that recognises code contribution.

One thing jumps out of the numbers. Social posts were the bulk of the volume (150 of the 264 pieces) but earned less than a fifth of the credits. The credits followed the heavier work: blogs, videos, talks at non-Drupal conferences, and coverage in outside press.

Channel	Pieces	Credits
Social posts (original + shares)	150	459
Blog posts (personal + company)	77	529
Video	14 entries (one covering a 102-video back catalog)	944
Conference talks	5	180
Industry press	6	80
Podcasts	2	18
Other (interviews, event photography, and more)	10	126

That's the balance we want: lots of people keeping Drupal visible day to day, with the biggest rewards going to the work that travels furthest.

How credits are scored

The matrix is channel × tier, and the tiers do most of the work, so it's worth being clear about what they mean.

Light (×1) stays close to the source: a social post, a quick share with your commentary, a short piece. Most content lands here, and that's fine - showing up matters.

Substantial (×2) has something of your own in it: your market, your language, your examples, your experience. Most good blog posts, videos, and talks.

Standout (×4) is rare by design. It means the piece travelled outside the Drupal world, or is exceptional in depth and craft, with visible evidence it connected: shares, discussion, pickup.

Channel	Light	Substantial	Standout
Social media (original or share)	1	2	8
Blog post (personal or company, incl. LinkedIn articles)	2	4	16
Podcast	3	6	24
Video (YouTube etc.)	4	8	32
Conference talk	20	40	160
Industry publication	20	40	160

On-theme content doubles its score, whatever the channel.

About that 160: a Standout conference talk or industry-press piece means you put Drupal in front of a serious outside audience and it landed. Nobody earned one in Month 1. The highest single-piece scores were 32-40. That's how it should be: if the top score were easy, it wouldn't mean anything. When someone does hit 160, you'll hear about it.

The best of Month 1

Here are fifteen picks that show the range of what came in: some here for a single standout piece, some for a month-long habit; the program rewards both. Every one reached people the Drupal Association couldn't reach on its own.

1. Ivan Zugec (ivan zugec), WebWash - 102 Drupal videos and livestreams published in 2026, plus steady posts on LinkedIn and Bluesky. The month's biggest credit haul, and the clearest example of education at scale.
   Ivan has built a 9,000-strong subscriber base at WebWash and produced an amazing amount of content: 65 tutorial videos and 37 livestreams in 2026, covering everything from Drupal CMS and the new AI features to day-to-day site building.

   Educational content like this is key to building a healthy onramp for new developers. Every video becomes a search result telling a newcomer that Drupal is alive and well supported

2. John Money (john.money), Acquia - gave a live Drupal AI tech demo at MAICON, a major marketing-AI conference, the kind of room where Drupal usually isn't in the conversation.

   John took a 15-minute live tech demo slot at MAICON 2026 and showed Drupal AI working in real time, to an audience of marketing and AI professionals rather than Drupal people. A claim on a Drupal blog is marketing; a working demo in front of a sceptical outside audience is proof. We'll take one of these over fifty reshares.
   

   
   John Money gives a live Drupal AI demo on the Transform Theater stage at MAICON
   

3. Kai Gertz (kgertz), Tojio ai Gertz (kgertz), Tojio - took a live Drupal AI demo to the Open KI Bodensee Barcamp, a non-Drupal AI event in Germany, then wrote it up so others could do the same. Local tech events are everywhere, most have never seen modern Drupal, and you don't need a big conference slot: the playbook works at any scale.
   

   
   A presenter smiles and points to the Drupal AI Demo homepage projected on a screen at the Open KI Bodensee Barcamp.
   

4. Ronald te Brake (ronaldtebrake), Open Social - published a three-post deep-dive series on Drupal and the Model Context Protocol in a single month, including MCP Apps: reusable Drupal components inside AI agent interfaces, with working proof-of-concept code and honest benchmarks. Technical depth with real code and real numbers is what developers trust; this is the content that wins arguments in engineering channels.

5. Christian López Espínola (penyaskito) - migrated his 13-year-old WordPress blog to Drupal CMS and wrote up how simple it actually was. First-person migration stories answer the question every evaluator has: how hard is it really? Nothing we publish ourselves lands like someone showing their own move.
   
6. Lukas Fischer (Lukasfischer), NETNODE - published the month's highest-scoring video: 5,000 viewers reached, and the only single piece to earn a Standout video score. Video travels further than text, and production quality is what gets it watched; reach is part of the score for a reason.
   
   
   Video thumbnail titled "Drupal Canvas Demo", showing the Canvas editor and its AI page builder.
   
7. Riccardo Paradisi (rickydox), Hinto Group - a one-person localisation engine: DriesNote recaps, a Drupal 12 preview, digital sovereignty, and Drupal as an AI knowledge base, each published in both English and Italian, with collaborator Erika Bruno credited throughout. The market doesn't all read English, and one good piece, told again in your own language, reaches people the original never will.
   
8. Vadim Mykolenko (vadim478), Devdotcom - carried the DriesNote message into French, in his own words, for his own network. Translation, not just amplification. You don't need a company blog to localise; a post in your own words, in your own language, to your own network counts.
   
9. Natalie Cainaru (cainaru), Bluefly - went where the sceptics are: r/webdev, r/PHP, and r/cms. In one thread, the original poster admitted their impression of Drupal was years out of date. The reputation gap lives in comment threads, and it closes when someone turns up with current facts and a civil tone.
   
10. Michael Anello (ultimike), DrupalEasy - posted about Drupal all month, across LinkedIn, Mastodon, and Bluesky, and credited the original authors as he went: ten of the month's 71 attribution credits trace back to his submissions. Showing up regularly keeps Drupal in people's feeds, and crediting your sources puts credits in other people's pockets too.
    
11. Fons Vandamme (f0ns), Webhaven - kept showing Drupal in motion all month: demos that made people look twice, a speaking recap, and his first Drupal video. Short clips of modern Drupal do the mythbusting for us; people don't argue with a screen recording.
    
12. Alessandra Petromilli (alessandra), Hinto Group - asked what happens when we no longer need to understand how things work, a long-form essay that got people thinking. Not everything needs to mention a feature; thoughtful writing from our community builds the kind of respect that makes people take the software seriously.
    
13. Giorgio Pagano (sjpagan) - connected Drupal, content credentials, and EU AI Act transparency, taking Drupal into the European policy conversation. Compliance questions decide big procurement, and having Drupal credibly present in them beats another feature post.
    
14. Pamela Barone (pameeela), Technocrat - showed a client-ready prototype built in under two hours with Drupal CMS, Canvas, and Mercury. Speed-to-result is the claim buyers doubt most, and a timestamped build is the cleanest possible answer.
    
15. Nico Grienauer (grienauer), acolono - got Austria's Splash Awards wins into Austrian tech press and coordinated a community promo push across three agencies, crediting colleagues all the way. Press reaches people who will never open drupal.org, and a coordinated push with credit shared makes a small community look big.

And if you're wondering where you landed: we'll release the full Month 1 leaderboard next week.

What we learned, and what's changing

The point of a pilot is to find the things you didn't plan for. We found a few.

You sent us whole back catalogs. We said any 2026 content counts, and people took us at our word: one submission covered an entire year of YouTube output. We're keeping that rule, and we've settled how to handle it: bulk submissions are scored as a single entry at one tier, not piece by piece. Keep them coming.

The credit matrix had gaps. People submitted things we hadn't priced: organising community events, event photography, video interviews, press coverage with no byline. Rather than invent rules on the spot, we scored these case by case and we're updating the matrix for Month 2. If your contribution doesn't fit a category, submit it anyway; that's how the categories get better.

The line between advocacy and marketing needs work. Some of the strongest pieces this month were case studies and honest product comparisons from agencies. A page that's mostly calls-to-action, though, is marketing. That's fine, it's just not what this program credits. We're sharpening the guidelines so the line is clear before you write.

How to get involved

If you make anything public that shows what Drupal can do, it counts: a post, a blog, a video, a talk, a translation, a share with your own take.

1. Publish wherever your audience is. Your blog, LinkedIn, YouTube, a local meetup, an industry publication. The further outside the usual Drupal circles, the better.
2. Submit it via the form in Drupal Slack or drupal.org/advocacy : you'll find it in #promote-drupal. Not in Drupal Slack yet? Join here. Use the full URL, include your Drupal.org username, and credit anyone whose work you built on; attributions earn them a credit too.
3. Credits land on your Drupal.org profile through the contribution credit system, the same recognition that code contribution earns. It counts toward an organisation's standing in the ecosystem.

Anything you've published in 2026 is eligible, so your back catalog counts. The Rotterdam theme is now complete, but we'll be releasing the next theme in the coming week.

Month 1 made a decent case that the gap between what Drupal can do and what the market believes can actually close. It just takes a lot of people telling true stories in their own voices. Month 2 is already underway.