Drupal.org aggregator
Most Drupal site owners I talk to handle Drupal security updates the same way. These are the fixes the Drupal Security Team publishes for core and contributed modules. A developer sees the security advisory. A ticket goes into the next sprint. The patch goes live a few days later, sometimes two weeks later.
12 Oct 2026 5:45pm GMT
There will be a Drupal core security release for all supported branches on October 14, 2026 between 16:00 and 21:00 UTC. (To see this in your local timezone, refer to the Drupal Core Calendar.) Based on our analysis this vulnerability rates at 19/25 on our risk calculator.
The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days.
We recommend updating to the latest supported patch (bugfix) release for your site's version of Drupal before October 14, so that you can address any other upgrade issues before the security window.
This issue is being protected by Drupal Steward. Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered.
All currently supported versions of Drupal core are affected, including:
Drupal 12.0.0-beta1 is also affected. New beta releases will be provided following the security updates for the supported branches.
All versions of Drupal prior to 10.6.x, as well as all versions of Drupal 11 prior to 11.3.x, are end-of-life and no longer supported. Sites on those versions should update as soon as possible to avoid this and other publicly disclosed vulnerabilities.
Neither the Security Team nor any other party is able to release any more information about this vulnerability until the announcement is made. Security release announcements will appear on the Drupal.org security advisory page, which has RSS feeds. The announcement will also be made public on:
#security-team channel of the Drupal community Slack12 Oct 2026 4:10pm GMT
The eight-step Drupal 7 database cleanup we run before every migration: caches and logs, revisions, deleted fields, files, spam accounts, content you will not bring, and the module data you leave behind, in the order that costs least and saves most.
12 Oct 2026 3:48pm GMT
Questions about the pace of advanced artificial intelligence are no longer confined to the research teams building it. Former OpenAI safety leader David Robinson described his decision to leave the company in a 3 October essay for The Atlantic, challenging the assumption that developers can release increasingly capable systems and address risks as they emerge. Former Anthropic researcher Jacob Coxon had raised concerns about competition between AI laboratories in a September interview with WIRED. Their warnings point to a conflict between the speed of development and the time required to evaluate its consequences. Neither departure demonstrates that the industry has actually slowed down.
That tension has reached public hearings and internal disputes. At a 5 October hearing, New York City Council members questioned representatives of major AI companies and heard testimony from former researchers at Anthropic, OpenAI and Google DeepMind. Three other former OpenAI safety researchers, Jasmine Wang, Tomek Korbak and Mikita Balesni, subsequently disputed the company's stated grounds for their dismissal. They warned that uncertainty over acceptable contact with external evaluators could discourage scrutiny. OpenAI rejected the suggestion that they had been dismissed for raising safety concerns and said its policies on sensitive information had been breached. The underlying dispute remains unresolved.
Public oversight offers a possible route beyond those competing accounts, but proposals must be distinguished from protections already in force. New York City lawmakers have discussed third-party validation, reporting and protections for people who flag risks. These measures would need to be enacted and implemented before their practical effect could be assessed. Independent evaluation also raises a harder question than whether a company publishes safety reports: who receives the findings, who can challenge the evidence and who has the authority to require a change before deployment? A review process may identify dangers without having the power to alter a release decision.
These questions extend beyond arguments about catastrophic AI scenarios. Organisations that develop or operate software routinely face uncertainty, conflicting incentives and decisions that affect people outside their own teams. Open-source communities confront some of those problems through public issue histories, reviews and shared maintenance, although those processes are not substitutes for the legal and institutional oversight proposed for advanced AI. What matters is whether concerns can move from warnings to decisions, with clear accountability when evidence is contested. The question is not only whether someone is willing to say that development should slow, but whether anyone outside the organisation can make that warning count.
Follow The DropTimes on LinkedIn, X, Bluesky, and Facebook, or join #thedroptimes on Drupal Slack.
Kazima Abbas wrote and curated this issue of Editor's Pick.
12 Oct 2026 2:55pm GMT
Author: Will Huggins
The narrative around enterprise AI is changing. Digital leaders - from CMOs looking for campaign velocity to CISOs managing vendor risk - are no longer just asking for new AI features. They are asking for AI infrastructure they can actually trust. They want to know how to maintain brand sovereignty, ensure content provenance, and scale AI operations without creating unmanageable compliance risks.
This shift in the market perfectly aligns with the mission of the Drupal AI Initiative: to establish Drupal as the premier open-source AI platform for digital experiences.
This October, the conversation takes a national stage at Digital Leaders' AI Week 2026, the UK's largest online festival of AI learning. And the Drupal community is front and center.
While Drupal AI is fundamentally a technology initiative, its real-world impact comes from the thought leadership of the people building it. At AI Week, members of the Drupal ecosystem will share strategies that go far beyond the CMS, showing how open-source principles are solving the hardest challenges in enterprise AI adoption.
Here is a look at two key sessions you won't want to miss.
When: October 16, 2026
The technology to generate content, personalise experiences, and orchestrate complex user journeys is already here. But as many organisations are discovering, having access to an AI model is not the same as having a scalable AI operation.
In this session, we will explore the critical gap between technological capability and organisational readiness. The focus will be on the necessity of an AI Management System (AIMS) - a structured approach to governing AI adoption.
This is where Drupal AI's philosophy truly shines. When we talk about Drupal as an "AI platform," we are talking about built-in governance. Organisations locked into proprietary platforms often struggle to adapt their AI infrastructure as new models emerge or regulations change. Lightweight SaaS tools, conversely, often lack the rigorous audit trails enterprise IT requires.
This talk will illustrate why the organisations that win in the age of AI will be those that prioritise structural sovereignty - the ability to control their own data, choose their own models, and enforce their own brand guidelines at scale. It's the exact reason why the Drupal AI Initiative developed the Context Control Center (CCC), ensuring that AI-generated content is always grounded in verified, human-authored brand rules.
When: October 15, 2026
As AI-generated content floods the web, user trust is becoming the most valuable currency in digital experience. How do organisations prove that their content is accurate, authoritative, and compliant?
This session tackles the critical challenge of provenance data. It's not enough to simply label something as "AI-generated"; organisations need to design systems that users can fundamentally trust.
This aligns perfectly with Drupal's Grade A rating for Software Sovereignty. Drupal's architecture is built on transparency and community governance. The platform doesn't just generate content; it provides the branch-based versioning, strict approval workflows, and deep audit trails necessary to track exactly how that content was created.
When an AI agent in Drupal proposes a layout optimisation or drafts a translated page, it operates within a highly governed environment. Humans remain firmly in the loop. This session will explore the broader implications of this approach, arguing that trustworthy AI requires safeguards built into the core architecture, not bolted on as an afterthought.
The future of digital experience is being built on open, model-agnostic foundations. The Drupal community's strong presence at AI Week 2026 reflects our commitment to leading this transformation, ensuring organisations can move fast, stay in control, and own their digital operations permanently.
We encourage everyone in the Drupal community - and anyone responsible for digital strategy in their organisation - to register for these free sessions.
👉 Register for AI Week 2026 Here
To see how these principles are being put into practice today, explore the Drupal AI interactive demos.
12 Oct 2026 2:10pm GMT
Running with scissors: Using AI to explore, build, maintain, contribute, and secure Drupal" is the title of my DrupalCon Orlando session proposal. I've been using and writing about AI as a Drupal developer for the past year, and I look forward to sharing my experience with fellow Drupalers at the conference. There is so much discussion about AI and Drupal, and I'd like your help with my DrupalCon session proposal.
We should assume most session proposals will focus on AI inside and outside Drupal from the perspective of site owners and builders. Meanwhile, if we want to encourage people to try Drupal, we also need to sell it to developers. My goal is to sell "using AI to explore, build, maintain, contribute, and secure Drupal" to developers and vibe coders, while acknowledging the challenges and risks by comparing how fast we've had to adopt AI to "running with scissors."
Running with scissors
I first heard the expression "Running with scissors" in the title of Augusten Burroughs' memoir. I enjoyed reading that book, and now I am listening to the audiobook while working on this blog post. A subtle takeaway from the memoir is that sometimes you may find yourself "running with scissors' involuntarily (or voluntarily), and you have to decide how to handle that scenario.
Related to AI, "running with scissors" captures the extremely fast, collectively exceptional pace we're in: a remarkably massive societal shift, comparable to the Industrial Revolution, is unfolding. The Industrial Revolution took decades to unfold, whereas the AI Revolution is unfolding in a few years, especially among software developers.
The AI Revolution is probably the right term, and it could foreshadow AI winning the revolution, leading to humankind's demise. BTW, this won't be the focus of my session...Read More
12 Oct 2026 1:32pm GMT
Shared code creates shared security needs. European product rules raise a more specific question: who must act?
12 Oct 2026 8:36am GMT
Drupal.org aggregatorImporting content with the Default Content module is really useful when populating a site with content. There's an increasing number of recipes and modules that can be used to populate a site with content either for setup or demonstration purposes.
Default content is really useful when figuring out how a system works as it can show relationships between content types that are not always simple to discern through the site itself. It also has a place when deploying content between sites as you can package up some default content and include that in a deployment step.
Occasionally, you'll want to tweak the content that is imported for different situations; with the reasons why you would want to do this being numerous. It might just be that you have a demo site and you wanted to tweak the content imported to better tailor it for the user. You could have a single recipe that contains the content and want to alter that for a specific demo.
I needed to do this selected default content import on a recent site as I was installing. A contributed module was used to populate the site with content to create a collection of examples. Although the content was good, I didn't want to import it all as some of it didn't make sense for a couple of scenario that I was looking at. That lead me to seeing if I could alter the content automatically as it was imported into the site, rather than manually delete content after the fact.
In this article we will look at some of the actions I tried to prevent content from being imported, before moving onto what the actual solution was. If you are following along at home, it is assumed that you already have a default content process setup and are just looking for change what content is imported without altering the source files.
11 Oct 2026 5:54pm GMT
Drupal's Form API comes with built-in tooling to allow any form element to initiate a submission. When combined the support for returning HTML fragments in htmx 4, it's very easy to make an interactive form for your users.
11 Oct 2026 1:36pm GMT
Drupal.org aggregatorDrupal Meets Matrix part 2: Live Comments with ECA and HTMX
A comment thread in Drupal works totally fine. You fill in a form, click submit, and your comment gets posted. Same way it has for over 20 years.
But if somebody else replies when you're on the page, you don't see anything change, you don't get any notification.
10 Oct 2026 7:00pm GMT
Opening DrupalCon, a summit
10 Oct 2026 5:41pm GMT
Can it be all so simple? Migrating a 13-year-old WordPress blog to Drupal CMS
Can it be all so simple? Spoiler: no, it can't. But it was fun.
Can It Be All So Simple (CIBASS for friends, and yes, the name comes from the Wu-Tang Clan song) is a Spanish blog about cinema, music, comics, TV series and culture that has been publishing since 2013. Some friends started it, and later a bunch of others joined, including me. I ended up hosting it and doing its maintenance for years. And we even ended up earning an award.
It ran on WordPress all that time. Maintenance was painful. In 2021, I alleviated part of that pain by migrating it to roots/bedrock and managing updates with Composer, but still, I wanted to migrate it to Drupal at some point. If you explore its contents, you will end up finding quite a few articles written by Drupal people.
On October 1st, 2026, thanks to Drupal CMS 2.2.0 and its multilingual support improvements, that could finally happen. Even if activity on the blog has been at its lowest, I still wanted to do that to keep the site online with minimal maintenance, while I refuse to accept that the project is almost dead.
The first step: an inventory. By setting up both the WP project and the new Drupal CMS one in DDEV, we made sure they could see each other. Looking at what was actually in the database:
Audit your content before the migration too, not only after. The database will surprise you.
In 2021 I said that upgrading your site is the best time for taking the trash out. Still true: the spam and 5,580 revisions stayed in WordPress.
The site is built on the Drupal CMS project template. Everything specific to CIBASS lives in project recipes: one per vocabulary, one per content type, one per media type, all bundled in a site template recipe. A fresh clone installs the whole site, in Spanish, with a single command. Then the migrations fill it.
For the source I didn't use the XML export of wordpress_migrate. wordpress_migrate_sql reads the WordPress database directly. With DDEV, the WordPress clone runs as its own project, and the Drupal one connects to its database container. 24 migrations, run in order by a script that stops at the first failure.
The development happened on a parallel branch of the same repository, and at cutover it was a plain git merge into master, plus running the migration live. The WordPress code is now only in git history. RIP.
WordPress had "posts". CIBASS had three different things pretending to be posts: critiques, interviews and articles. So the plan was to split them, and the first plan said "around 337 critiques".
The data said otherwise. A critique on CIBASS is a post with a rating, and the rating is… an image. A picture of a score at the end of the post. So the rule ended up being "a critique is a post with exactly one rating image". Posts with several ratings are compilations ("our 10 favorite movies of the year"), and those became articles flagged for editorial review.
The final numbers: 185 critiques, 22 interviews (plus 2 manual overrides) and 513 articles. Ratings are now a real field, and a custom field formatter outputs that same image.
Bylines became a contributor vocabulary. Parsing "Por NAME, @HANDLE" sounds easy until you find multiple authors, authors joined with " y ", and the same person written in 61 different ways. A small overrides table at migration time brought it down to 46.
This is where most of the work went. Thirteen years of hand-written HTML, three generations of WordPress editors (classic, shortcodes, Gutenberg), and a lot of copy-paste from YouTube. While at it, we wanted to use the power of media in Drupal, so we needed to ensure we could unify all these different kinds of embeds from several different social networks this site has outlived (hey Vine!).
As an example, every critique body goes through a chain of twelve process plugins, in this order:
field_content:
- plugin: wp_strip_byline_blocks
- plugin: wp_rewrite_inline_formatting
- plugin: wp_strip_rating_image
- plugin: wp_rewrite_gallery_shortcodes
- plugin: wp_rewrite_manual_galleries
- plugin: wp_rewrite_caption_shortcodes
- plugin: wp_rewrite_gutenberg_blocks
- plugin: wp_rewrite_embed_shortcodes
- plugin: cibass_image_override
- plugin: wp_rewrite_img_urls
- plugin: wp_relativize_links
- plugin: wp_rewrite_search_to_tagEach one does one thing. Remove the byline, because it's a field now. Remove the rating image, same reason. Turn [gallery ids="…"] (62 of them, 828 images) and the galleries people built by hand into gallery media. Turn 521 [caption] shortcodes into embedded media with captions. Turn [embed], bare URLs and raw iframes into the right remote media. Turn every <img src="…/uploads/…"> into a <drupal-media> token. Make links relative. And convert old ?s=query search links into tag pages.
Order matters. If the rating image isn't stripped (step 3) before images are converted (step 10), the rating image ends up as a media item in the body.
And then there's the rule that is not a rule: CIBASS editors use [sic], [mos] and [habla] as editorial brackets in Spanish. They look exactly like shortcodes. They are not. Leave them alone.
Write each transformation as its own small process plugin, with its own tests. You'll rerun the migration dozens of times, and you want to know which rule broke.
That's around 2,250 lines of process plugins and 186 test methods in the migration module. It sounds like a lot. It's the reason I could rerun everything without fear.
Those rules need somewhere to put things. The site ended up with eleven media types, and some of them deserve a story:
embed.spotify.com iframes needed to be parsed and rewritten too.format=json.embed.js instead.oEmbed Providers made the custom providers manageable, as core's list doesn't include iVoox or Scribd. And every third-party embed goes through a formatter that waits for Klaro consent before loading the iframe. No request reaches Spotify or YouTube until the visitor says yes. So in the process, we made the recipe GDPR-friendly.
Media types are prerequisites, not follow-ups. If a post is migrated before its media type exists, its embeds are gone and you'll run the migration again.
I planned remote video as "something for later". It wasn't.
Thirteen years of URLs are out there: in Google, in tweets, in other people's posts. As I mentioned, the site even won an award, and it's still getting lots of organic traffic. Breaking URLs is not an option.
/2015/01/23/las-claves-de-akira), built by Pathauto from the local post date. Use the GMT one and some posts move to the previous day./app/uploads/… paths, checked against 4,109 real files and their resized variants. 284 of them had non-ASCII filenames, because of course they did./sitemap.xml. For RSS, WordPress provided several different paths for the same feed! We redirect all of them to the proper one.Verify redirects with real requests, not with migration counts.
Here's a fun one. The sidebar had a "most visited posts" widget, powered by Jetpack Stats. Thirteen years of visits… that never left WordPress.com. We had no way to export them. When WordPress goes, the stats go with it. The new block started with a list copied from a Wayback Machine snapshot of the live site. Archaeology instead of analytics.
That was a good reminder of something we keep saying in open source and keep forgetting in practice: if it's not on your servers, it's not yours.
CIBASS now uses Matomo, self-hosted on our own server. It runs cookieless, and doesn't send any data to third-party companies. And unlike with Jetpack, this time we could take our history with us: our Google Analytics data since 2023 is now imported into Matomo, so we didn't start from zero.
As of this week, that "most visited" block ranks posts by real pageviews: cron asks Matomo's Reporting API once a day for the most viewed pages in the last 3 months, maps them to posts by path alias, and stores the ranking. Without depending on any external provider.
Now the parts we care about most - the content, the code, the deployments and the numbers - live on infrastructure we control. The code lives on a self-hosted GitLab, too.
When you migrate away from a platform, check what data you can't take with you. Then make sure it doesn't happen again.
One thing we lost in the move was our mailing list, provided by Jetpack. I'm often frustrated with organizations or content creators building a community or audience, and having all that data depending on third-party services. If you don't have the email addresses, you don't have a community. If we revive the project, we will need to start that from scratch. Hopefully Simplenews can help with that.
Managing WordPress is hard if you want traceability of the updates in version control. roots/bedrock helps a lot with that. While they do a great job maintaining an endpoint for Composer, it means depending on a third-party company.
Jetpack provides great functionality, but you lose all sovereignty over your data. It ends up on WordPress.com servers, not yours.
With this move we got most of our data back, maintenance will be easier from now on, and our editors get a unified UX thanks to the media work. All on an infrastructure I know well, and that is proven on other sites I maintain.
Have you migrated a WordPress site to Drupal CMS? Any experiences worth sharing?
AI was used for a drafting an outline of this post.
penyaskito
10 Oct 2026 9:31am GMT
A customer submits a web enquiry. Someone reads it, copies the details into the CRM and asks for missing information. When that happens every day, enquiry preparation is a useful place to test whether AI can save time. Choose one task with a clear finish line AI business process automation becomes easier to evaluate when the task has a defined start and end. For a web enquiry, it starts with submission and ends when the responsible person has checked the information and knows the next action. Our recommendation is to begin with a summary, a suggested category and a draft response. A person approves prices, delivery dates and commitments. This gives the team a bounded task whose time savings can actually be measured. The approach may suit a manufacturer receiving descriptive quotation…
10 Oct 2026 6:00am GMT
Drupal is changing how developers organize some of the code behind your website. Here's what the transition means for custom functionality, theme maintenance, and planning your next upgrade.
10 Oct 2026 3:06am GMT
Drupal.org aggregator
It's been about 10 months (!) since the last article. Most of that time went into my work at Dropsolid as an AI Product Architect. I've participated in the design, building, and maintaining the AI infrastructure: inference, models, guardrails, tracing, vector stores, and their integrations with Drupal. Quite a few moving parts - plus, some participation in the Drupal AI community, which was a fun process but definitely took some time ⏳.
Meanwhile, we secured €2.5 million in financing at Dropsolid AI. There was a lot happening on that side, and moving NicheBench forward alongside it was harder than I expected 💢.
The hardware was another limit. Progress with one GPU was difficult, and even after adding a second one, running a model through the new benchmark could tur...
09 Oct 2026 2:05pm GMT
Henadzi Koltun argues that Drupal's value lies in durable engineering rather than short-term gains. He discusses when headless architecture is justified, why AI still needs human oversight and how accessibility becomes an organisational responsibility.
09 Oct 2026 11:50am GMT