21 Oct 2026
Drupal.org aggregator
Giorgio Pagano: How do you declare AI-generated audio or a cloned voice on a Drupal site, with AI Disclosure?
Audio has no picture to put an icon on, so the European Code of Practice asks for it to be declared by voice. Here I follow how version 1.0.0-beta1 of AI Disclosure, the module I created on drupal.org within the Drupal AI Initiative, does it. Images have an article of their own, and so does video.
Audio needs to be declared when it is a deep fake: when a voice credibly resembles a person who exists or could exist, and whoever listens would take it as real. The Commission's guidelines give exactly this example: a newspaper podcast with the voices of its hosts and a guest cloned to discuss current events. A voice given to a fictional character, in an audiobook or a game, stays out if nobody is misled about who is speaking. Noise reduction or normalisation, which removes interference without changing the words, stays out too.
The obligation falls on the publisher, under Article 50(4) of the AI Act, and it applies from 2 August 2026. The watermark the voice generator puts in the file is the provider's obligation, and a publisher cannot rely on it for their own declaration.
For audio, the final June 2026 version of the Code of Practice asks for a short spoken notice at the start of the deep fake, in plain words, in the language of the content or in English.
21 Oct 2026 12:00pm GMT
Specbee: Why (and how) government agencies should migrate from DNN to Drupal
Planning a DNN to Drupal migration? See how Drupal helps government agencies meet WCAG 2.1 AA, Section 508, and ADA Title II rules with stronger web governance.
21 Oct 2026 4:03am GMT
Security public service announcements: Critical PHP update on Wednesday, October 21, 2026 (14:00 UTC) - PSA-2026-10-20
PHP has announced a critical PHP security release for Wednesday, October 21, 2026, at 14:00 UTC. We recommend that all Drupal site owners reserve time to ensure their PHP version is updated as soon as the release is available.
Site owners are responsible for maintaining the security of their hosting platform
It is the policy of the Drupal Security Team that site owners are responsible for monitoring and maintaining the security of third-party libraries and any non-Drupal components of the application and hosting platform. In rare cases, the Drupal Security Team will post an informational public service announcement (PSA) such as this one, but the remit of the Drupal Security Team remains limited to code hosted on Drupal.org's systems. Previous PSAs on third-party code in the Drupal ecosystem include:
- External libraries and plugins - PSA-2011-002
- Various Third-Party Vulnerabilities - PSA-2019-09-04
- Third-Party Libraries and Supply Chains - PSA-2024-06-26
- Third-Party Libraries and Supply Chains - PSA-2025-09-17
This post is likely to be updated as the situation evolves and more information is available.
- Lee Rowlands (larowlan) of the Drupal Security Team
- James Gilliland (neclimdul) of the Drupal Security Team
- Angie Byron (webchick) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
21 Oct 2026 3:30am GMT