fidzu : Drupal

On July 15, 2026, Drupal published several core security advisories. If an organisation's website, portal or service platform runs on Drupal, now is the time to check not only the version number, but the whole update process. Drupal core July security updates: what site owners should check now On July 15, 2026, Drupal published several core security advisories. According to Drupal.org, the issues include cross-site scripting, commonly known as XSS, and information disclosure risks. The relevant fixes point to Drupal 11.4.4, Drupal 11.3.14 and Drupal 10.6.13. This does not mean every Drupal site is automatically under attack. It does mean that Drupal cannot be treated as a platform to look at "later". For a school, municipality, public-sector body, university, NGO or larger…

16 Jul 2026 6:00am GMT

15 Jul 2026 10:05pm GMT

The Drupal Association is entering a new chapter. Tim Doyle is stepping down as CEO, and the Board has appointed Tiffany Farriss as interim CEO.

I am grateful to Tim for his leadership and his impact on the Association. He built a strong leadership team that helped guide Drupal through an ambitious period of innovation. That team is well positioned to continue supporting Drupal and its community.

Tiffany brings continuity and deep expertise to the Drupal Association. She has contributed to Drupal for many years and served on the Drupal Association Board for more than a decade, including on its Finance Committee. She helped organize DrupalCon and built and ran a successful agency in the Drupal ecosystem. She understands our project, the Association's finances, and the realities our partners, contributors, and users face.

I have worked with Tiffany for many years. She is thoughtful, deeply committed to Drupal, and unafraid of hard questions. Although her title is interim CEO, she has the full authority and confidence of the Board, as well as my full support.

We expect Tiffany to serve for six to twelve months. During that time, she will focus on strengthening the Association's financial and operational foundation and preparing it for long-term leadership. Later in that period, the Board plans to launch a search for the next permanent CEO.

Turning innovation into momentum

Tiffany is stepping into the role at an important moment for Drupal.

Over the past few years, our community has done some of its most ambitious work. Contributors have continued to modernize Drupal Core. We launched Drupal CMS to make Drupal easier to adopt, introduced Drupal Canvas to rethink how people build, and rapidly advanced Drupal AI to change how people create and manage content.

We have also taken important steps toward marketing Drupal with the seriousness it deserves, so more organizations understand why it remains one of the most powerful and trusted platforms for building serious websites and applications.

This progress was made possible by our contributors and the organizations that invest in Drupal every day. The Drupal Association's role is to support that work and help turn it into wider adoption, a stronger ecosystem, and more opportunity for Drupal businesses.

Sustaining Drupal's essential work

The Drupal Association operates much of the infrastructure the project depends on, from Drupal.org and our collaboration tools to the services that help keep Drupal secure.

Drupal's infrastructure alone costs roughly $3 million each year. Today, it is funded through DrupalCon revenue, partnerships, sponsorships, donations, donated services, and volunteer contributions. That model has supported Drupal for many years, but it is not durable enough for the scale of the work ahead.

This is a challenge shared by open-source stewards everywhere. The software may be free to download, but the infrastructure and stewardship that make it dependable are not free to provide.

Building a stronger Drupal Association

Our commitment to Drupal's infrastructure and community will not change. Supporting them well requires a stronger Drupal Association, and that may mean exploring new approaches. We will weigh the options carefully, guided by what is best for Drupal and the people who depend on it.

This work will not be easy, but our ambition is clear: make the Association more sustainable, help Drupal innovate faster, strengthen how we bring it to market, and better support Certified Partners.

As this work takes shape, we will be transparent about what we are learning, the choices we are considering, and what they could mean for the Association and the community.

Tiffany understands what makes Drupal special and what the community values most. She also has the experience and mandate to shape what comes next.

Every new chapter depends on people willing to step forward. I am thankful to Tim for all he has done, to the Association's staff for their dedication, and to Tiffany for taking this on. With their commitment, I am confident in Drupal's direction and excited about the work ahead.

15 Jul 2026 9:54pm GMT

15 Jul 2026 8:01pm GMT

15 Jul 2026 7:52pm GMT

15 Jul 2026 7:51pm GMT

15 Jul 2026 7:50pm GMT

Checkout is fragile. Every extra step between "I want this" and "order placed" is an opportunity for a shopper to abandon their cart entirely. And one of the most common moments of hesitation happens when a buyer realizes they added the wrong item to their cart. Maybe it was the wrong format or the wrong bundle. Or, maybe the wrong billing cycle for a donation or subscription.

The fix is simple. Navigate back to the product page, add the correct item, and remove the old one from the cart. But this friction, however small, can cost conversions.

The Commerce Product Alternative module for Drupal Commerce solves this by letting shoppers swap a product variation directly in their cart. One click. No detours.

Cart decisions, by design, shouldn't be final

Shoppers change their minds. Someone adds a hardcover book to their cart, then realizes they want the bundle that also includes the digital download. A new member selects a one-time membership fee, then notices the auto-renewal option is more cost-effective. A donor commits to a single gift, then considers whether a recurring contribution would be better.

In each of these cases, the shopper has already committed to buying something. They're in the cart. They're ready.

Why force them to start over?

Read more

15 Jul 2026 3:03pm GMT

Today we are talking about Aaron Winborn, The award named after him, and what winning is like with guests George DeMet & April Sides. We'll also cover Summit as our module of the week.

For show notes visit: https://www.talkingDrupal.com/561

Topics

• Who Was Aaron Winborn
• Award Origin Story
• How Winners Are Chosen
• Why Community Matters
• What Winners Share
• April Learns She Won
• Handcrafted Award Stories
• On Stage Emotions
• After Winning Reflections
• How To Contribute
• Nominations And Makers
• Surprise Award Ideas
• Wrap Up And Contacts

Resources

• TD Cafe #018 - Drupal Site Templates
• Aaron Winborn Award Winner
• Ask a wookie

Guests

April Sides - weekbeforenext George DeMet - palantir.net gdemet

Hosts

Nic Laflin - nLighteneddevelopment.com nicxvan John Picozzi - epam.com johnpicozzi Ashraf Abed - drupito.com ashrafabed

MOTW Correspondent

Martin Anderson-Clutz - mandclu.com mandclu

• Brief description:
  • Have you ever wanted to create a website purpose-built for an event like a Drupal camp, that collects, moderates, and schedules user-submitted sessions, and do all of that within the Drupal CMS installer? There's a site template for that.
• Module name/project name:
  • Summit Site Template
• Brief history
  • How old: created in June 2026 by yours truly
  • Versions available: 1.0.0, released yesterday
• Maintainership
  • Actively maintained
  • Security and test coverage
  • Documentation some in the repo we'll talk about later
  • Number of open issues: no open issues, though there are a couple of open issues on the Event Platform Starter, from which Summit was created
• Module features and usage
  • We've talked before on this podcast about the Event Platform that grew out of an initiative from the Event Organizers Working Group. The goal is to remove friction for anyone organizing a Drupal camp or similar event in creating a website that sets them up for success
  • The Event Platform was created before Recipes were a thing in the Drupal-verse, even though it was initially built in ways that were similar to recipes
  • A couple of years ago, I started working on the Event Platform Starter recipe to help spin up a fully-built event website in a single step. That ran into some technical complexities, so it ended up being being a time-saver, but still required a number of manual steps
  • As the newer concept of site templates took shape, I could see that the Event Platform ecosystem had the necessary elements to become a site template, in particular a theme and a battle-tested a content architecture
  • I ended up needing to decouple the configuration and the functional code that had previously been in Event Platform. The configuration would reside solely in the site template, so the functional code was moved to a new project, Event Platform Helper
  • Along the way, there have been a number of significant changes: Canvas integration for a fully customizable homepage, also a set of Canvas components to allow building new, custom layouts, a new, custom cache context, improved management of event information, and more
  • Now, you set everything up with a single click in the Drupal CMS installer. There's an open issue to get it into the Drupal CMS installer by default, but today it's just a composer require away
  • The repo does also include an AGENTS.md and CONTENT-STRUCTURE.md files, to help human or AI agents who want to work a site built using Summit to understand the initial state of the content architecture it provides, as well as the different logical components and how to troubleshoot them, individually or in combination

15 Jul 2026 12:00pm GMT

composer require 'drupal/commerce_ifthenpay:^3.0'

15 Jul 2026 10:47am GMT

The debate over open-source infrastructure often ends at agreement. Matthew Saunders wants it to continue into budgets, governance, and contributor support.

15 Jul 2026 6:28am GMT

Your Drupal site is on a current version, gets security updates, and technically works - yet editing is painful and every small change waits in a developer queue. The platform is rarely the problem.

Fourteen common implementation mistakes that make a Drupal site feel broken - with symptoms, diagnosis, and fixes for each. Most cost a fraction of a rebuild to put right.

15 Jul 2026 6:13am GMT

When approaching AI, I've done so warily. Maybe it was because I was a skeptic, but my first endeavors were not glowing success stories. My first real attempt to kick the tires ended with me kicking AI to the curb and doing some regex and search/replace to finish what it started. I chalk it up to a mix of model maturity and, let's be honest, my own ill-directed uses.

But more recently I've been finding wins. I find AI very useful for writing test cases for test-driven development (TDD). It's also really good at troubleshooting. It takes a bug report, follows the code paths, and writes a failing test that reproduces the bug. When you solve the problem, you can be sure you have solved it. And more importantly, that it was even a problem in the first place.

Putting AI to Work on a Real Problem

It was at this point, I realized that AI might be able to help me with my Drupal Core maintainer duties. For those that don't know, I maintain an insane number of contrib modules and am a core subsystem maintainer in 3 areas, namely migrate, image, and authentication/authorization. The last area of auth/authZ is in desperate need of modernization.

The planning issue requirements and roadmap are all open. The community design review hasn't started yet, so now is a good time to take a look: [Plan] YAML-Based Pluggable Authentication Flow

The first part of the problem for auth/authZ is that there aren't any core components in the core issue queue for the sub system. I have to look in a few module queues and the base system to find relevant issues. I filed this issue to establish a dedicated auth/authZ component in the Drupal core queue.

To help me get my mind around the space, I had AI query all 1,200 issues in the module-based issue queues. Then it spun out from there to find referenced issues. I leveraged a local file cache of d.o issues so I didn't have to hit the drupal.org API repeatedly as I was tweaking the discovery.

This demonstrates the first lesson I've learned with AI. It is really good at doing directed research and planning. But you need to give it guard rails. I had to tell it to add a cache. I had to tweak the issue filters. I had to think about what I wanted. AI wouldn't think for me. But at the end, I had several hundred issues downloaded locally.

Making Sense of 1,200 Issues

Then came the next step. I asked AI to create a mind map using mermaid.live. With over 1,000 issues, I didn't want something that was too unmanageable. I picked a couple issues that seemed key to me and asked AI to give me a mind map with issues directly related to authentication (excluding authorization for the moment). That shrank things down to just a few hundred. But the large picture of categorized issues in a mind map started to tell a story.

The mind map story led me back to the planning phase again. This time I used BMAD, an AI methodology specifically structured to guide planning a task using AI. I fed it the pain points and asked it to look at some reference PHP and non-PHP authentication frameworks. It researched Laravel, Symfony, Drupal and Keycloak. At this point I had enough data to request it to write some pros/cons and possible pseudo implementations.

Somewhere in this whole process DrupalCon Chicago happened. Then a few weeks later MidCamp in Chicago happened. This gave me ready access to real people to bounce ideas off. They asked some really great questions. I fed these questions back into AI and refined the design even further.

Then more recently, I had the opportunity to speak at a Drupal meetup on Zoom. I took all the data I'd gathered, the mind maps, the design artifacts generated by BMAD and created a nice slideshow presentation. But the source data was from research provided by AI. The attendees at the meetup had even more feedback. I fed this feedback back into AI and now have a pretty defensible architecture for a new authentication system in Drupal core - the YAML-Based Pluggable Authentication Flow outlined in the planning issue. Broken down into phases with dependencies identified between phases of work.

The Blank Sheet Problem

We haven't built the new system. No code has been written. But AI helped architect everything. I don't think a human could parse that many hundreds of drupal.org issues, create a mind map, and build a new architecture without massive amounts of effort. AI is great at holding lots of nuggets of data in memory all at once. It is optimally designed to help with just such a task as I went through.

Time will tell if the architecture co-developed by AI proves useful. I do know it has helped with the "blank sheet of paper" -syndrome. The feeling where you know you need to do something but don't know where to start. You just sit there staring at the blank sheet of paper hoping for inspiration. Even if we entirely threw out the new architecture, we have something to start.

For those interested in the artifacts from this discovery, you can visit https://www.drupal.org/project/drupal/issues/3593328.

15 Jul 2026 12:00am GMT

phpstan-drupal 2.1.0 is out. The theme of this release: rules and behaviors that proved themselves as opt-ins are now the defaults. If you run `composer update` and see new errors, that is the release working as intended - everything below includes the configuration to opt back out.

Nine rules are now enabled by default

These rules shipped as opt-ins over the 2.0 cycle. They have had time to bake, and they catch real bugs, so they no longer require configuration:

14 Jul 2026 5:00pm GMT

14 Jul 2026 3:49pm GMT

Boerland links his board candidacy to a question now facing Drupal: how the project can expand institutional support without narrowing the path for contributors, local communities, and site owners.

14 Jul 2026 2:14pm GMT