12 Nov 2025

feedDrupal.org aggregator

Security advisories: Drupal core - Moderately critical - Defacement - SA-CORE-2025-007

Project:
Drupal core
Date:
2025-November-12
Security risk:
Moderately critical 10 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All
Vulnerability:
Defacement
Affected versions:
>= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8
CVE IDs:
CVE-2025-13082
Description:

By generating and tricking a user into visiting a malicious URL, an attacker can perform site defacement.

The defacement is not stored and is only present when the URL has been crafted for that purpose. Only the defacement is present, so no other site content (such as branding) is rendered.

Solution:

Install the latest version:

Drupal 11.0.x, Drupal 10.3.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)

Reported By:
Fixed By:
Coordinated By:

12 Nov 2025 8:16pm GMT

Security advisories: Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006

Project:
Drupal core
Date:
2025-November-12
Security risk:
Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon
Vulnerability:
Gadget chain
Affected versions:
>= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8
CVE IDs:
CVE-2025-13081
Description:

Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.

It is not directly exploitable.

This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). There are no such known exploits in Drupal core.

Solution:

Install the latest version:

Drupal 11.0.x, Drupal 10.3.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)

Reported By:
Fixed By:
Coordinated By:

12 Nov 2025 6:34pm GMT

Security advisories: Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008

Project:
Drupal core
Date:
2025-November-12
Security risk:
Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon
Vulnerability:
Information disclosure
Affected versions:
>= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8
CVE IDs:
CVE-2025-13083
Description:

The core system module handles downloads of private and temporary files. Contrib modules can define additional kinds of files (schemes) that may also be handled by the system module.

In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access. For example, files may be cached by Varnish or a CDN.

This vulnerability is mitigated by the following:

  1. Drupal must be configured to handle non-public files using a custom or contributed module providing an additional file scheme.
  2. An attacker must know to request a file that has previously been
    requested by a more-privileged user, and that file must still be cached.
Solution:

Install the latest version:

Drupal 11.0.x, Drupal 10.3.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)

Reported By:
Fixed By:
Coordinated By:

12 Nov 2025 6:33pm GMT

Security advisories: Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005

Project:
Drupal core
Date:
2025-November-12
Security risk:
Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All
Vulnerability:
Denial of Service
Affected versions:
>= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8
CVE IDs:
CVE-2025-13080
Description:

Drupal Core has a rarely used feature, provided by an underlying library, which allows certain attributes of incoming HTTP requests to be overridden.

This functionality can be abused in a way that may cause Drupal to cache response data that it should not. This can lead to legitimate requests receiving inappropriate cached responses (cache poisoning).

This could be exploited in various ways:

  • Broken rendering of some pages
  • Unstyled or malformatted pages
  • Adverse impacts on client-side functionality

Changes are being made in the underlying library which will mitigate this problem, but in the meantime Drupal core has been hardened to protect against this vulnerability.

Solution:

Install the latest version:

Drupal 11.0.x, Drupal 10.3.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)

Reported By:
Fixed By:
Coordinated By:

12 Nov 2025 6:33pm GMT

Centarro: How to Plan Your Enterprise eCommerce Project

Planning an enterprise eCommerce implementation is notoriously difficult. There's no single best way to approach it. Every organization has a different mix of legacy systems, required features, customers, and staff, not to mention the internal politics that can shift requirements like the moon shifts the tides.

But there are some commonalities. Almost every enterprise site we undertake begins with a massive feature list and gap analysis, and organizations often try to understand the scale and complexity of their implementation by classifying features.

They put them in buckets like:

Each one is a different level of effort, and theoretically, these buckets will help with estimation and planning.

The problem? Terms used to describe features are often fuzzy and unclear.

Take "invoicing" as an example. Invoicing can mean 18 different things to 13 different people. It's not a single feature-it's a category of features. There might be an "invoicing" module in the platform you are evaluating, but does that actually satisfy the requirement? It depends on what "invoicing" actually means to your organization.

Read more

12 Nov 2025 3:49pm GMT

The Drop Times: Community, Code, and Columbia Gorge Views: PNW Drupal Summit 2025 Recap

Held October 18-19 at McMenamins Edgefield in Troutdale, Oregon, the Pacific Northwest Drupal Summit 2025 welcomed 71 attendees for two days of insightful sessions, spontaneous discussions, and informal exploration. With 24 recorded talks, strong local engagement, and calls to grow community visibility, this year's summit proved that small events still pack a big impact.

12 Nov 2025 1:26pm GMT

Drupal Association blog: An invitation to support DrupalCamp Burkina Faso

DrupalCamp Burkina Faso will be hosting its third event from April 24-26, 2026. Previous events have brought entrepreneurs, students, as well as government ministers and national media. This year the Camp is hoping to expand international sponsorship and recruit guest speakers who can help build the skills of the local community.

We want to invite you to participate.

Across the African continent there is an increasingly rapid pace of digital transformation. Through our connections with communities across Africa, we're seeing governments, major industries, and growing business markets rapidly prioritize digital sovereignty and online engagement, and we see them seeking international expertise to launch and up-skill their local markets.

I see an incredible opportunity for Drupal in Africa. We're seeing other open source projects like Typo3 and Wordpress make a concerted effort to lobby government and industry users, but Drupal has a unique advantage of strong communities in several countries across the continent already.

~ Tim Lehnen, CTO - Drupal Association

We hope you see the potential opportunity as well.

If you are interested in sponsorship, contact: seferiba@gmail.com

If you are interested in being a virtual guest speaker, contact: seferiba@gmail.com

12 Nov 2025 7:29am GMT

A Drupal Couple: Why Web Development Simplicity Beats AI-Generated Complexity

Why Web Development Simplicity Beats AI-Generated Complexity

Image
Paper cut collage artwork depicting colorful waves flowing from a silhouette, representing creative thought
Article body

In an era where AI can generate thousands of lines of code in seconds, I found myself asking a fundamental question: What makes me valuable as a developer when artificial intelligence can create everything?

While AI tools multiply our capacity to create, perhaps the real value lies not in generating more, but in choosing better. This is something every developer, designer, and team leader needs to hear.

A Principle Rediscovered Across Generations

The concept of "less but better" isn't new. In the 1920s-1930s, architect Mies van der Rohe popularized "Less is More"-a principle that profoundly influenced the Bauhaus school and its core focus on simplicity, rationalism, and functionality that shaped modern design. Designer Dieter Rams later refined it to "less, but better" for the consumer product era.

What strikes me most is how each generation rediscovers this wisdom in their own context. When tools can generate unlimited options instantly, the skill isn't in creating more; it's in knowing what to keep.

Why This Matters Now

From my experience, I've noticed three things that make this principle critical in modern web development. A simple approach is better from a technical, designer, and UX perspective.

Technically, less code means better performance and sustainability. Every unnecessary line of code is technical debt waiting to accumulate. Every extra component is another potential breaking point, another thing to maintain, another load on the user's browser. When we choose simplicity, we're not just making aesthetic decisions-we're making our solutions faster, more reliable, and easier to maintain.

From a design perspective, simple solutions with gradual implementation build trust. Users don't need to see everything we can do in the first interaction. They need to accomplish their immediate goal with confidence. A focused, clear interface tells users we understand what matters to them. Complexity can signal uncertainty-ours, not theirs.

Looking at user experience, I believe people are overwhelmed. They're managing hundreds of tasks, using dozens of tools, drowning in notifications and options. The more we can simplify their interaction with our solutions, the better their experience. This isn't about doing less work-it's about doing the hard work of deciding what truly matters.

Practical Application: The Real Challenge with AI Tools

When we built Palcera.com using AI tools like Claude and Figma, I discovered how easy it is to drown in possibilities. Ask an AI to generate components, and you'll get dozens of variations. Request copy options, and you'll receive paragraphs upon paragraphs. The tools are powerful, but they lack the one thing that matters most-context about what your users actually need.

This is where the real work happens: selecting and guiding toward the minimum viable solution. Not minimum as in "barely functional," but minimum as in "exactly what's needed, and nothing more." This takes time. It requires understanding your users deeply enough to know which of those AI-generated options actually serves them.

When building editorial experiences and user interfaces, this becomes even more critical. People use these tools daily, often alongside hundreds of other responsibilities. Every unnecessary click, every confusing option, every piece of visual clutter is friction they don't need. The editorial tools we build should fade into the background, supporting their work rather than demanding attention.

AI processes information faster than any human and can be remarkably creative, but it's not ready to handle complex strategic decisions. We need professionals to guide these tools, to add the human touch that understands not just what can be built, but what should be built. That's not going to change anytime soon.

The Opportunity Ahead

Here's what excites me about this moment: we can approach the AI era as an opportunity to rebuild our mindset and technical approaches. Right now, we can strip away accumulated complexity and ask: if we were starting fresh today, what would we actually build?

This "rebuild from scratch" mindset is available to us at any time. Not literally rebuilding everything-that would be impractical. But approaching each new project, each new feature, each new interface with fresh eyes. Starting with the core problem we're solving, then adding only what serves that purpose.

The principle of "Less is More" has survived over a century because it addresses something fundamental: clarity and focus create better outcomes than complexity and abundance. In an age of infinite AI-generated possibilities, this truth matters more than ever.

The question isn't whether AI will replace us. The question is whether we'll use these powerful tools to create solutions that truly serve people-or just create more noise in an already overwhelming digital landscape.

I choose simplicity. I choose intention. I choose less, but better.

What will you choose?

A note on AI usage: I used AI assitance to create this blog post for research, validating historical facts, organizing my thoughts, and editing. The ideas and perspective areentirely my own.

Subject of
My Journey with AI Tools: Practical Tips from a Recent Discussion
Author
Ana Coto
Abstract
When AI generates unlimited code, value lies in choosing better over creating more. Why simplicity defines modern web development leadership.
Tags
Career Development
Community Development
Development
Drupal Planet
AI
FrontEnd
Design Principles
Rating
No votes yet

Add new comment

12 Nov 2025 12:49am GMT

11 Nov 2025

feedDrupal.org aggregator

The Drop Times: Planning the Next Phase

There's been a quiet but meaningful shift within the Drupal community-not in what we're building, but in how we organise and plan for the future. Governance and long-term strategy have moved closer to the centre of conversation. While not entirely new, these topics are now gaining clearer structure and attention.

Earlier this year, a multi-year strategic roadmap for Drupal core (2025-2028) was outlined through community consultation and closed for comments in August 2025. The roadmap prioritises improving contributor experience, refining release management, and sustaining platform stability. The strategy now guides Drupal's core direction over the next three years.

Alongside this, the Drupal Association and contributors are focusing on project governance. In a governance update published in late 2024, the Drupal Association outlined efforts to clarify working group roles, improve leadership transparency, and ensure that contributors-especially from underrepresented regions-can more easily participate in project decision-making.

These governance efforts are supported by the publicly documented Drupal Governance Overview, which outlines the decision-making process and assigns responsibilities across the project.

These aren't flashy reforms, but they reflect Drupal's commitment to stability, community participation, and long-term resilience. For contributors, developers, and agency partners, they represent essential groundwork for how Drupal evolves and who gets to shape its future.

Now, here are some of the major stories we published from the previous week:

DISCOVER DRUPAL

CASE STUDY

DRUPAL COMMUNITY

EVENT

SECURITY

PHP

We acknowledge that there are more stories to share. However, due to selection constraints, we must pause further exploration for now. To get timely updates, follow us on LinkedIn, Twitter, Bluesky, and Facebook. You can also join us on Drupal Slack at #thedroptimes.

Thank you.
Sincerely,
Kazima Abbas,
Sub-editor, The DropTimes.

11 Nov 2025 12:59pm GMT

1xINTERNET blog: 1xINTERNET expands into the UK with new North West base

1xINTERNET expands into the UK with a new North West base, led by Paul Johnson and James Tillotson. The move strengthens partnerships with UK organisations and brings advanced Drupal and AI expertise closer to British clients.

11 Nov 2025 12:00pm GMT

Specbee: Building an interactive event calendar in Drupal 10 using the FullCalendar View module

Transform your lists of dates into a visual calendar experience. Learn how to set up and customize FullCalendar View in Drupal 10.

11 Nov 2025 9:25am GMT

10 Nov 2025

feedDrupal.org aggregator

Talking Drupal: Talking Drupal #528 - Drupal Goes to the U.N.

Today we are talking about The United Nations Open Source Week, Digital Public Infrastructure, and Digital sovereignty with guest Tiffany Farriss & Mike Gifford. We'll also cover Local Association (EU Sites Project) as our module of the week.

For show notes visit: https://www.talkingDrupal.com/528

Topics

Resources

Guests

Tiffany Farriss - www.palantir.net farriss Mike Gifford - accessibility.civicactions.com mgifford

Hosts

Nic Laflin - nLighteneddevelopment.com nicxvan John Picozzi - epam.com johnpicozzi Maya Schaeffer - evolvingweb.com mayalena

MOTW Correspondent

Martin Anderson-Clutz - mandclu.com mandclu

10 Nov 2025 7:00pm GMT

Web Wash: First Look at Drupal CMS V2 (alpha1) + Drupal Canvas

Drupal CMS V2 alpha1 introduces Drupal Canvas, a modern page builder that changes how you create content and build sites.

In the video above we cover installation, key features, and hands-on use of Drupal Canvas. You'll learn the new interface, site templates, the Mercury theme, visual page building, and how to create code components.

10 Nov 2025 9:23am GMT

09 Nov 2025

feedDrupal.org aggregator

#! code: Drupal 11: Programmatically Change A Layout Paragraphs Layout

The Layout Paragraphs module is a great way of combining the flexibility of the layout system with the content component sytem of the Paragraphs module. Using this module you can set up a Paragraph that can understand different layouts and then inject Paragraphs into that layout, all within the confines of a single field.

What this means is that you users can build the layout they want within the edit pages of your Drupal site, without having to guess where Paragraphs will end up in the final site. It makes the site a little easier to edit and means that there should be less previewing of pages before publishing.

When working on a recent project I found that layout Paragraphs was in use, which wasn't a problem. The problem was that the site was quite simple, but had 12 different layouts to pick from. As a consequence, the pages consisted of a variety of different layouts that not only made the site difficult to edit, but also made the end result look a little messy.

The solution was to move some of the existing layouts to a single type and remove those layouts from the selection. This made it easier to edit pages and also easier to predict how the site would look when we made some style changes.

Whilst it is certainly possible to do this by hand, it's not easy to track down every instance of a particular layout and convert them all. I also wanted a more automatic approach to the solution so that I could run a drush command and convert all of one type of Layout Paragraph to another.

In this article we will look at the structure of the Layout Paragraphs module and when how to move a Layout Paragraph from one layout to another using PHP.

Read more

09 Nov 2025 7:00pm GMT

07 Nov 2025

feedDrupal.org aggregator

Dries Buytaert: Connecting Drupal with Activepieces

Activepieces is an open source workflow automation platform, similar to Zapier or n8n. It connects different systems so they can work together in automated workflows. For example, you might create a workflow where publishing a Drupal article automatically creates a social media post, updates a Google Sheet, and notifies your team in Slack.

There are two main ways to run Activepieces:

Once you have Activepieces running, you'll want to connect it to your Drupal site. This note explains two ways to do that: a basic integration using Drupal's built-in APIs, and an advanced setup that unlocks deeper automation capabilities.

Setting up basic integration

You can connect Drupal with Activepieces without installing any extra Drupal modules.

Drupal ships with JSON:API support, a REST API that exposes your content and data through HTTP requests. This means Activepieces can query your content, fetch individual nodes, explore field definitions, and follow entity relationships without any custom code.

While JSON:API is part of Drupal Core, it may not be enabled yet. You can enable it with:

drush pm-enable jsonapi -y

Next, set up a dedicated Drupal user account with only the permissions needed for what you want Activepieces to do.

Activepieces can use Basic Authentication to connect to Drupal with the corresponding username and password.

Basic Auth sends credentials with each request, which makes it simple to set up. For production environments, I recommend using a more secure authentication method like OAuth, though I have not tried that yet.

Drupal Core comes with a Basic Auth module, but you might also need to enable it:

drush pm-enable basic_auth -y

Once both modules are enabled, you can create a connection to Drupal from within Activepieces. In the Activepieces interface, drag a Drupal trigger or action onto the canvas, and you'll be prompted to set up the connection.

Setting up advanced integration

For more advanced scenarios, we created the Orchestration module. It's an optional module. Installing this module unlocks deeper integrations that enable external systems to trigger Drupal ECA workflows, use Drupal AI agents, call Drupal Tools, and more.

The module is organized using specialized submodules, each connecting to a different part of Drupal's ecosystem. You can pick and choose the capabilities you want to use.

For starters, here is how to install the Drupal AI and ECA integrations:

composer require drupal/orchestration drupal/ai drupal/ai_agents drupal/tool drupal/eca
drush pm-enable ai ai_agents tool eca orchestration_ai_agents orchestration_ai_function orchestration_tool orchestration_eca -y

Before you can use any of the AI agents, you also need to install and configure one or more AI providers:

composer require drupal/ai_provider_anthropic drupal/ai_provider_openai drupal/ai_provider_ollama
drush pm-enable ai_provider_anthropic ai_provider_openai ai_provider_ollama -y

Clear the cache:

drush cache-rebuild

With these modules installed, you can build much more sophisticated workflows that leverage Drupal's internal automation and AI capabilities.

07 Nov 2025 9:44am GMT

Dries Buytaert: Setting up an Activepieces development environment

If you just want to use Activepieces with Drupal on your local development machine, the easiest option is to follow my guide on running Activepieces locally with Docker. That approach allows you to use Activepieces, but you can't make code changes to it.

If you want to contribute to the Drupal Piece integration or create a new Piece, the Docker setup won't work. To develop or modify Pieces, you'll need to set up a full Activepieces development environment, which this note explains.

First, fork the Activepieces repository on GitHub using the UI. Then clone your fork locally:

git clone https://github.com/YOUR-USERNAME/activepieces.git

Move into the project directory and install all dependencies:

cd activepieces
npm install

After the installation finishes, start your local development instance:

npm start

Open your web browser and go to http://localhost:4200.

Sign in with the default development account:

This account is preconfigured so you can start building and testing custom Pieces right away.

The Drupal Piece code lives in ./packages/pieces/community/drupal. When you make changes to the code, they're automatically compiled and hot-reloaded, so you can see your changes immediately without restarting the development server.

To complete your setup, see my guide on connecting Drupal with Activepieces.

Troubleshooting common issues

I've run into a few issues while working with the Activepieces development environment. Here is what usually fixes them.

Start by deleting all caches:

rm -rf node_modules cache dev

This removes node_modules (all installed dependencies), cache (build and runtime caches), and dev (temporary development files).

Activepieces uses Nx, an open source build system for monorepos. If Nx's cache is out of sync, reset it to start with a clean slate for builds and tests:

npx nx reset

07 Nov 2025 9:35am GMT