When you vibe an application, the AI picks the stack, and both projects I've looked at came back with the same one. I know Drupal and I contribute to it, so weigh everything here against that bias. But what a vibe-coded application ends up needing, Drupal already has, and the piece still missing is one this community could build. There may be better fits out there. This one is mine.
AI assistants increasingly sit between people and websites, retrieving and interpreting information on their behalf. That shifts the problem beyond whether software can connect to a site at all. The system also has to make clear what information means, what software may access, and which rules govern what happens next.
The Drupal AI Initiative made the first part of that problem explicit on 24 August 2026. Fields, taxonomy, relationships, metadata, and other forms of structured content can give software information that is easier to identify and interpret than meaning conveyed mainly through page design. Permissions and workflows add another layer by distinguishing what is public, restricted, current, or subject to editorial control.
A more concrete access boundary appeared this week in Acquia DAM's MCP Server. Compatible AI assistants can search assets, retrieve metadata, and obtain links through an authenticated connection that follows the user's existing DAM permissions. The initial implementation is read-only: an assistant can retrieve permitted information but cannot edit metadata or upload files. The interface therefore exposes capability without giving the software unrestricted authority over the system behind it.
GovCMS addresses a different machine-readable problem. On 27 August 2026, Rules as Code became a production capability on the platform, allowing policy, legislation, and business rules to be represented as reusable digital assets and embedded in digital services. Its first production implementation is an eligibility checker for agencies considering GovCMS, and the underlying eligibility rules are also published as open source. GovCMS describes the approach as a foundation for future AI-assisted services rather than as an AI-agent implementation today.
These developments are not three versions of the same architecture. They expose three related requirements for systems that software increasingly has to interpret or use: meaning must be explicit, access must be constrained, and important rules should not have to be guessed from prose. For Drupal teams, the agentic web may therefore depend as much on long-standing work around content modelling, permissions, auditability, and governance as it does on new AI capabilities.
The Drupal Association is excited to announce the winner of 2026 Community At-Large Board Elections.
We extend a sincere thank you to Alejandro Moreno for his service and dedication, not only to Drupal, but to the Drupal community. Your time spent on the board made such a difference to the future of the Drupal project, and we thank you all for participating with grace, thoughtfulness, and insightful contributions.
We would like to congratulate and welcome our newest board member, Janna Malikova, for winning the community-elected seat during our 2026 At-Large Board Elections.
We cannot wait to see all the amazing things Janna will accomplish while on the Drupal Association Board.
Detailed Voting Results
There were 8 candidates in this year's At-Large board member election. 307 voters cast their ballots out of a pool of 1274 eligible voters. Eligible voters are active Drupal Association members, known as Ripple Makers, whose membership must have been active at least 24 hours before voting opened.
Under Approval Voting, each eligible voter can give a vote to one or more candidates.
The final total of votes were as follows:
Candidate
Votes
Scott Falconer
74
James Abrahams
131
Bert Boerland
120
Chris Kelly
26
Darren Oh
57
Janna Malikova
141
Helge Notø
74
Matthew Saunders
128
On behalf of all the staff and board of the Drupal Association, a heartfelt Drupal Thanks to all of you who stood for the elections this year. It truly is a big commitment to contribution, the Drupal Association, and the community, and we are so grateful for all of your voices. Thank you for your willingness to serve, and we hope you'll consider participating again in 2027!
Specbee has joined the Drupal AI Initiative as a Certified Partner. See what Drupal AI initiative is about, how it's governed, and what it means for your enterprise site.
Now that we have a the Jadu connection created and redirects working we can start tackling other aspects of the migration, so let's look at migrating the main content of the site from Jadu. We can pull structured pages of content out of the Jadu API and apply them to the structure of a LGD site, maintaining the same hierarchical structure and order of pages.
Much of the content of a LGD site is built using just a handful of content types, and Central Bedfordshire was built in the same way. LGD comes with a number of content types that allow content editors to add content in different ways, which allows for some decent customisation in the structure and layout of a site. Not only that, but as we are using Drupal it is possible to customise this structure as much as we need to suit the needs of the site.
For Central Bedfordshire, we had the standard structure of the site built with Service Landing pages, which gave editors the ability to link out to other pages that contained all of the content. These inner pages were set up as Guide pages, and the migration of that content is what we will be focusing on in this article. Please note that I will need to gloss over a little bit of the detail in this article, but rest assured that the source code will be available soon.
Four version control systems in three files, a hardcoded root password we decided not to airbrush, and a surprising amount of today's stack already in place. In the oldest corner of our static file mirrors sits a directory called alpha3, and in it three shell scripts dated 20 November 2009 - older than the public BOA repository itself, whose GitHub history only starts in January 2010. These are the scripts Barracuda & Octopus grew from: one installs the Ægir layer on a VPS, one upgrades it with cron stopped and a backup taken first, and one builds a whole menu of 2009-era Drupal platforms, from Open Atrium to ManagingNews. Now published byte for byte on our docs site, with a guided tour of what survived, from the /data/disk tree to the /dev/ delivery path.
WebMCP is an emerging proposal for cooperation between a web page and a browser agent. It is not a new name for MCP and it is not a replacement. A practical rule is simple: MCP belongs near servers and data; WebMCP belongs near the live page and the workflow the user can see. At the end of August 2026, WebMCP is not something every production website should rush into every form. But it is worth understanding now, because the direction is right: an AI agent should not have to guess buttons and click through a website like a brittle automation script. A web application can declare which actions an agent may use and what structured inputs those actions expect. That distinction matters. A normal browser agent sees a page roughly as a user or automation tool sees it: headings, form fields,…
Today we are talking about Security, Vulnerabilities, and how to avoid exposure with guest Dave Welch. We'll also cover Security Scanner as our module of the week.
Have you ever wanted a fast way to catch the security mistakes that slip into custom Drupal code - especially the code your AI assistant just wrote - before it ships? There's a module for that.
How old: created in July 2026 by Mayank Gupta (mayankguptadotcom) of Acquia
Versions available: 1.0.0, which works with Drupal 10.3 and 11
Maintainership
Actively maintained - created and shipped its first stable this summer, with steady development right through late July
Security coverage
Test coverage - and it's strong: unit and kernel tests, including a regression corpus built from real Drupal core advisories
Documentation? In-depth README with a full check table and CI recipes, plus a CHANGELOG
Number of open issues: 1 issue, not a bug
Usage stats:
2 sites (it's brand new)
Module features and usage
Provide a Drush command, has no UI - you point drush security:scan at a module or any path, it reads the code statically, and prints a prioritized, OWASP-mapped list of things to review
It's built for the age of AI-written code - the checks target the classes AI assistants keep reintroducing: routes with no access check, #markup and |raw XSS, missing CSRF tokens, unserialize() on untrusted data, hardcoded secrets
Then there's an optional deep pass: with the Psalm static analysis scanning engine installed, it'll trace untrusted input across functions and files to catch cross-function issues. And it's honest about state - the report always says whether that deep pass ran, was skipped, or failed, so a failure never gets mistaken for a clean scan
One nice detail under the hood: a tokenizer-backed "code map" that knows whether a match is real code, a comment, or a string - so it won't flag the word "unserialize" sitting in a doc comment. That kills the single biggest source of false positives
The checks are regression-tested against real Drupal advisories (Drupalgeddon, Drupalgeddon2, the 2019 unserialize bug, etc) so a pattern that caused an actual CVE can't quietly come back in your custom code
Output comes in three flavors: a readable table, JSON for CI and AI agents, and SARIF - which means findings show up as annotations right on your GitHub or GitLab merge-request diff instead of buried in a job log
For adopting it on an existing codebase there's a baseline file - you fingerprint the findings you've reviewed, with a required reason on each, and they stop failing the build but never go invisible; every run still counts them
It exits non-zero on error-level findings, so it drops straight into CI or a pre-commit hook
And it's extensible - checks are Drupal plugins with a #[SecurityCheck] attribute, so any module can add its own or alter the ones that ship
Big caveat, and the module says this itself: a finding means "review this," not "this is broken." Static analysis has false positives, and a clean scan doesn't prove the code is secure - access-control logic especially still needs human review
I first heard about this module over beverages at Drupalcamp Asheville, so I know that this module was largely vibe-coded, after having an AI agent ingest every single Drupal security team CVE. So I like to think of this module as security pattern recognition tool, but of course it does even more
Open Source is usually described as a licensing model, a development model, or a production model. All three descriptions are useful, but they leave something out. Every Open Source ecosystem is also a cost-allocation system.
Keeping software relevant and dependable requires people to write code, review contributions, prepare releases, investigate security reports, operate infrastructure, write documentation, answer questions, and support upgrades and migrations. Someone always bears those costs.
A proprietary vendor can tie access to payment: every license or subscription sold helps fund developers, security work, infrastructure, and releases.
Open Source breaks the link between access and payment. Anyone can redistribute the software at any price, including zero. Payment is therefore not a condition of using or redistributing it, and those rights do not themselves provide a durable mechanism for funding production and maintenance.
But separating payment from access does not make the costs disappear. Costs are distributed across maintainers, employers, foundations, sponsors, and users. A maintainer may volunteer their time. An employer may pay a developer to contribute. A foundation may operate infrastructure.
Because these costs are distributed rather than collected through a single transaction, they are harder to see and harder to fund.
Technical choices often shape where those costs fall. That allocation is not always deliberate; it can emerge slowly from decisions that were individually reasonable and become visible only years later.
Drupal's update service recently gave me a good example. Drupal sites periodically contact updates.drupal.org to ask whether new versions of Drupal or any installed add-ons are available. Drupal calls these add-ons "contributed projects", such as modules and themes maintained by members of the community.
The current design sends one request for Drupal itself and one for every contributed project installed on the site. A site with 100 contributed projects therefore makes 101 requests each time it checks for updates, by default, once a day.
There were good reasons for that design. Each project's release history could be stored as a static file and served repeatedly without rebuilding it for every request. The design was straightforward, and it worked.
But Drupal grew. Today, updates.drupal.org serves nearly a billion requests a month. The file containing Drupal Core's release history is roughly half a megabyte by itself. Based on the number of requests for that file, I estimate that Drupal Core update checks alone may account for roughly 50 to 75 TB of data transfer each month. Traffic for contributed projects comes on top of that.
No one chose to make updates.drupal.org transfer tens of terabytes of release data each month. That scale emerged gradually as Drupal grew, from a design that had been reasonable when the ecosystem was smaller.
Part of the challenge is that, in Open Source, the people who benefit, the people who decide, and the people who bear the costs are often different and may have no formal obligations to one another.
Site owners benefit from reliable update notifications, usually without paying the Drupal Association for them. Drupal Association staff operate the update service, while the Association bears its traffic and infrastructure costs. But the code that determines how sites make those requests lives in Drupal Core, where changes require the involvement of Core committers. The Core committers do not report to the Drupal Association, so the Association cannot change that behavior on its own.
In practice, Drupal Association staff and Core committers collaborate closely. That collaboration is important because decision-making authority and cost-bearing sit with different groups.
The people bearing material costs need a way to make those costs visible and influence the decision, even if they do not control it.
This example shows why every Open Source architecture is also a cost-allocation system. Good governance considers that allocation up front, monitors its effects over time, and revisits it when it becomes unsustainable.
Understanding an Open Source system therefore requires more than understanding its code or license. We also need to understand who benefits, who decides, and who bears the costs as the system grows. Once those relationships are visible, a community can decide whether the allocation is sustainable or whether the architecture should change.
This article introduces six new ECA Guide library recipes that improve the Drupal content editing experience through small, focused changes. They can draft metadata on first save, add access-aware edit links to teasers, prevent invalid dependent select values, offer field-level actions, fill several form fields without saving, and show contextual guidance beside a form. The point is not to apply all six recipes unchanged. They are well-architected starting points for a real editorial irritation. For editors, that means less repeated work and fewer avoidable mistakes. For organisations, it means more consistent content and a practical route to improving the CMS without turning every detail into a custom development project. The article also gives a simple choice: Field Widget Actions for one field, Form API Ajax for several form fields, and HTMX endpoints for nearby content. Production concerns still matter, especially permissions, validation, managed data, and AI review.
Rebuilding a data-driven Drupal site: From ctools plugins to Layout Builder blocks
In the previous post, I described why we chose Layout Builder and how Layout Builder IPE restored the frontend editing workflow we had used with Panels IPE.
With the editing workflow in place, we still had to rebuild the elements that editors placed on their pages.
The Drupal 7 site used custom ctools content type plugins for maps, charts, figures, lists and tables. Editors placed and configured these plugins, while the plugins retrieved the information and rendered the result. I will call both these ctools plugins and the block plugins that replaced them page elements.
If you use DDEV, a simple way to mention the project is to star the GitHub repository. Head over to github.com/ddev/ddev↗ and click Star. It takes five seconds, and it can help us - a star count is one of the things new users, sponsors, and and AI check before trusting an open source tool. If you're already a star, thank you!
DDEV IntelliJ/PhpStorm Plugin Lands in the DDEV Org
The DDEV Integration plugin for IntelliJ/PhpStorm↗, maintained by @AkibaAT, has been transferred into the ddev GitHub organization. This was on our 2026 plans list, and it's great to see it land. Awesome maintainer AkibaAT has kept the plugin in excellent shape, and this move gives it a permanent home alongside the rest of the DDEV ecosystem.
What's New on the Blog
A Love Letter to the DDEV Community → Randy on what the DDEV community - real feedback, hard questions, generous contributions, genuine collaboration - makes this project what it is.
Knecht.works Ships Sandbox Rollback - Following up on last month's beta-tester call, the team at knecht.works has added sandbox rollback to their agency dashboard, letting each automated DDEV run boot into its own disposable environment. Read the update↗
TYPO3 Snapshot: Pull and Anonymize Production Data Locally - Ramon Herrmann released Snapshot, an open-source TYPO3 extension that pulls databases and fileadmin from live/staging into a local DDEV environment, with built-in anonymization for GDPR compliance. Read the announcement↗
Quick DDEV Previews: A Self-Hosted Preview Service - Matthias Andrasch built a proof-of-concept service that spins up DDEV preview environments from any branch of a connected GitHub repository, based on Samuel Reichör's technical work. Screencast: Using it on Hetzner VPS↗ • View the repo↗
Community Tutorials from Around the Web
Migrating a Local WordPress Site to DDEV on Windows/WSL2 (Spanish) → Adam Martín walks through moving a WordPress project from Local to DDEV running inside WSL2, including database import, URL fixes, SSL certificates, and troubleshooting port conflicts. Read on dev.adammartin.es↗
Installing DDEV on Linux (French) → An updated walkthrough covering Docker prerequisites and DDEV installation on Ubuntu/Debian, Fedora, and openSUSE, plus mkcert certificate setup. Read on kgaut.net↗
Global Commands for Database Dumps and Remote Imports (French) → ddev db-import and ddev db-export, a pair of global DDEV commands for restoring and exporting Drupal databases with drush cache-clear and login-link steps built-in, plus a follow-up set (db-prod-import, ssh-prod, and their preprod equivalents) for pulling a remote database in one step, packaged as the ddev-drupal-tools↗ add-on. Read the first post↗ • Read the follow-up↗
DDEV + a-blogcms as a MAMP Alternative (Japanese) → An introduction to DDEV for a-blogcms developers used to MAMP, covering setup, useful commands, and Mailpit for email testing. Read on kazumich.com↗
Running Drupal's GitLab CI Checks Locally → How Kalamuna's ddev checks and ddev checks-fixes commands mirror the Drupal.org GitLab CI template, so code that passes locally passes in CI. Read on kalamuna.com↗
DDEV Training Starting Up Again This Fall
Live training is back for the fall, three sessions open to everybody.
Upcoming DDEV Live Contributor and User Training Sessions
September 23, 2026 at 8:00 AM US Mountain / 10:00 AM US Eastern / 16:00 CEST - Managing Huge Databases with DDEV, with Moshe Weitzman
Covers the new embedded snapshot and uncompressed snapshot features shipping in the upcoming v1.25.4 DDEV release. Add to Google Calendar • Download .ics
November 11, 2026 at 8:00 AM US Mountain / 10:00 AM US Eastern / 16:00 CET - Advanced Coder.ddev.com Techniques
Using the coder CLI, local and web-based VS Code, and remote-controlling Claude, including the freeform template. Add to Google Calendar • Download .ics
The next DDEV advisory group meeting, open to everybody, is September 2, 2026 at 8:00 AM US Mountain / 10:00 AM US Eastern / 16:00 CEST. Add to Google Calendar • See the agenda. We love to hear from our community!
Sponsorship Update
A steady month - thank you to everyone who contributes!
July 2026: ~$9,931/month (82.8% of goal)
August 2026: ~$10,038/month (83.7% of goal)
If DDEV has helped your team, consider sponsoring. → Become a sponsor↗
Contact us to discuss sponsorship options that work for your organization.
Stay in the Loop-Follow Us and Join the Conversation
We analyzed 79 months of Chrome UX Report field data covering every Drupal and WordPress site Google measures - 2.9 million origins in July 2026 alone. Drupal has led on Core Web Vitals in every single month since 2020, and the entire gap traces to one metric. The numbers, the honest caveats, and what to fix on whichever platform you run.
Four version control systems in three files, a hardcoded root password we decided not to airbrush, and a surprising amount of today's stack already in place. In the oldest corner of our static file mirrors sits a directory called alpha3, and in it three shell scripts dated 20 November 2009 - older than the public BOA repository itself, whose GitHub history only starts in January 2010. These are the scripts Barracuda & Octopus grew from: one installs the Ægir layer on a VPS, one upgrades it with cron stopped and a backup taken first, and one builds a whole menu of 2009-era Drupal platforms, from Open Atrium to ManagingNews. Now published byte for byte on our docs site, with a guided tour of what survived, from the /data/disk tree to the /dev/ delivery path.
