16 Sep 2026
Drupal.org aggregator
Drupal AI Initiative: AI at DrupalCon Rotterdam
Written by Duncan Worrell (dunx)
DrupalCon Rotterdam is almost here. Alongside two dedicated AI summits and the main conference keynote, the program is stacked with high-value AI content for developers, strategists, and leaders alike. Whether you're looking to push agentic workflows, scale digital governance, streamline content operations, or keep your AI integrations trustworthy, here is a complete breakdown of the top AI sessions to help you optimize your schedule.
Full schedule at https://events.drupal.org/rotterdam2026/schedule
Tickets at https://events.drupal.org/rotterdam2026/registration-information
All session times are local CEST.
Summits
In addition to the main DrupalCon event, there are two AI-specific summits being held catering for two very different audiences.
Enterprise Drupal AI Summit
An executive-focused event for CXOs, Heads of Digital, and enterprise leaders connecting with curated Drupal AI partners. Hosted on the historic former ocean liner, SS Rotterdam.
Date & Time: All day Monday, 28 September
Event details here: https://summit.enterprisedrupal.eu/schedule.html
AI Dev Summit
Getting Drupal developers up to speed on AI coding tools, AI in PHP/Symfony/Drupal frameworks, Canvas, and Drupal CMS innovations.
Date & Time: All day Monday, 28 September
Event details here: https://events.drupal.org/rotterdam2026/ai-dev-summit
Keynote
For many, the DriesNote by Drupal founder Dries Buytaert is the week's highlight. Expect a keynote packed with the latest AI roadmap updates, architectural reveals, and live technical demos.
Date & Time: Tuesday, September 29, 2026 - 10:30 to 11:45
DriesNote will live stream on YouTube if you can't make the event in person.
Sessions
Every session is likely to mention "AI" but we expect these sessions to be focused on AI.
Unblocking AI: Why Programmes Stall at Pilot Stage, and How to Move Past It
Research and strategies for moving AI initiatives past the pilot phase to deliver real-world impact.
Date & Time: Tuesday, 29 September 2026, 13:00 - 13:10
Speakers: Amanda Falshaw (AI Enablement Lead at Reading Room) & Megan Harvey (Reading Room)
Open Intranet: A Drupal-Based Digital Workplace
Features AI-assisted content creation as part of an open-source Drupal intranet workspace.
Date & Time: Tuesday, 29 September 2026, 13:15 - 13:25
Speaker: Maciej Łukiański (CEO and Co-founder of Droptica)
Culture Mapping the Human Side of AI - A Workshop to Meet Your People Where They Are
Leadership and organizational change management required to guide teams through fast-moving AI adoption.
Date & Time: Tuesday, 29 September 2026, 13:30 - 14:15
Speaker: Timi Csontos (Culture Consultant/Freelygive)
Reviewer-Friendly AI: A Practical Drupal Contribution Workshop
Practical AI-assisted workflows designed to turn ideas into high-quality, review-ready open-source contributions.
Date & Time: Tuesday, 29 September 2026, 13:30 - 14:15
Speaker: Scott Falconer (Senior Principal Software Engineer at Acquia)
Why Your AI Agent Hallucinates: Engineering Lessons From a Production Workflow Builder in Drupal
Engineering reliable, trustworthy AI agent integrations in Drupal using modules like AI, ECA, and agentic tools.
Date & Time: Tuesday, 29 September 2026, 13:30 - 14:15
Speaker: Shibin Devadas Kakanat (Backend Pro Lead at Factorial)
Context Control Center: Bringing AI Context Natively to Drupal CMS
Structuring, scoping, and natively managing AI context within Drupal CMS for downstream agents and tools.
Date & Time: Tuesday, 29 September 2026, 14:25 - 15:10
Speakers: Emma Horrell (User Experience Manager University of Edinburgh and UX Research Lead for Drupal CMS) & James Abrahams (Technical Director at Freelygive)
Encoding Expertise: How UX Research Powers Human-First AI
Applying UX research methods to train and ground AI content tools to output domain-specific quality.
Date & Time: Tuesday, 29 September 2026, 14:25 - 15:10
Speaker: Aidan Foster (Senior UX Strategist at Kanopi Studios)
From Shadow AI to Sovereign AI Infrastructure
Addressing data security, compliance, provider selection, and cost control as AI adoption scales.
Date & Time: Tuesday, 29 September 2026, 14:25 - 15:10
Speaker: Michael Schmid (Head of Technology and Co-Founder of amazee.io)
AI-assisted site migration to Drupal Canvas: a real-world case study
Testing AI coding agents on live projects to automate complex site migrations into Drupal Canvas, examining real metrics, wins, and limitations.
Date & Time: Wednesday, 30 September 2026, 10:45 - 11:30
Speakers: Wolfgang Ziegler (Architect, Founder of drunomics) & Jeremy Chinquist (Project Manager at drunomics)
AI-Augmented Accessibility: From Automated Alt-Text to Governance Gates
Automating inclusive governance and identifying accessibility errors early by bridging code, humans, and AI workflows.
Date & Time: Wednesday, 30 September 2026, 10:45 - 11:30
Speaker: Mike Gifford (Senior Accessibility Strategist at CivicActions)
Nobody Asked for a CMS: From Content Management to Answer Delivery in the Age of AI
Adapting content architecture for direct answer delivery to AI systems while increasing Drupal's strategic value.
Date & Time: Wednesday, 30 September 2026, 10:45 - 11:30
Speakers: Tomi Mikola & Ulla Koho (both digital strategists and content architects at Wunder)
Clean Code in the Age of AI: Writing for Humans When Machines Write the Code
Maintaining human readability, software architecture, and clean code standards when using AI generators.
Date & Time: Wednesday, 30 September 2026, 11:40 - 12:25
Speaker: Len Swaneveld (Senior Drupal Developer at iO)
One Brand Voice from 35 Sources: How We Rebuilt VisitEurope.com and How Drupal AI Unifies Its Tone
Unifying 35 national voices into a cohesive travel brand using generative AI integrated into Drupal.
Date & Time: Wednesday, 30 September 2026, 11:40 - 12:25
Speakers: Krisztián Kása & Zsófia Alföldi (both Project Managers at Brainsum)
AI Best Practises
Leveraging Drupal's structured architecture to build optimized environments for AI Agents running inside and outside CMS boundaries.
Date & Time: Wednesday, 30 September 2026, 12:30 - 12:40
Speaker: James Abrahams (Technical Director at Freelygive)
The New Front Door: How AI Agents Are Driving Drupal's Growth
How autonomous AI agents act as primary decision-makers selecting, building, and verifying Drupal systems.
Date & Time: Wednesday, 30 September 2026, 12:45 - 13:30
Speaker: Scott Falconer (Senior Principal Software Engineer at Acquia)
Drupal AI Product Update: From Foundation to Agentic Workflows
Official product update from the Drupal AI Initiative leadership on building production-ready Agentic CMS capabilities.
Date & Time: Wednesday, 30 September 2026, 13:40 - 14:25
Speakers: Niels Aers (CTO/AI Tech Lead at Dropsolid) & Dr. Christoph Breidert (CEO and Founder of 1xINTERNET)
From Brief to Review-Ready in 60 Minutes: A Governed AI Campaign Workflow in Drupal 11
Generating governed, high-quality draft campaign pages straight from PDF briefs in minutes without code tickets.
Date & Time: Wednesday, 30 September 2026, 13:40 - 14:00
Speaker: Kieran Cott (Executive Creative Technology Director at Delete Agency)
How can we improve Drupal's visibility in ChatGPT, Gemini, and Claude?
Open discussion on improving how LLMs describe, evaluate, and recommend Drupal to users.
Date & Time: Wednesday, 30 September 2026, 13:40 - 14:25
Speaker: Larissa Tropp (Digital Marketing & Growth Specialist at 1xINTERNET)
Dismantling and Reassembling a Drupal Migration with AI
Leveraging AI tools to simplify, re-architect, and map legacy un-typed data into clean destination bundles during migrations.
Date & Time: Wednesday, 30 September 2026, 14:45 - 15:30
Speaker: Roberto Peruzzo (Principal Architect and Founder of Sparklingboys)
AI Mid-Life Crisis: failure stories from the silent majority
Honest post-mortems on AI project failures and pragmatic ways to navigate rapid technological shifts.
Date & Time: Wednesday, 30 September 2026, 14:45 - 15:30
Speakers: Dieter Blomme (Drupal Architect at Dropsolid) & Valery Lourie (Lead Software Engineer at EPAM Systems)
Scolta: Drop-in AI Search Without a Search Server
Running lightweight, client-side search powered by Pagefind with an AI layer for query expansion and summaries.
Date & Time: Wednesday, 30 September 2026, 14:45 - 15:30
Speaker: Jeremy Andrews (CEO and Founder of Tag1 Consulting)
SDCs, Canvas, and the Agent That Builds With Them
Training AI agents to generate Single Directory Components, insert them into pages, and verify browser rendering.
Date & Time: Wednesday, 30 September 2026, 14:45 - 15:30
Speaker: Matt Glaman (Principal Software Engineer at Acquia)
AI Assists, Humans Decide: Agentic Workflows in Drupal - A Drupal AI Hackathon Story
Agentic translation and governance workflows developed for the European Commission across 24 languages.
Date & Time: Wednesday, 30 September 2026, 16:00 - 16:45
Speakers: David Galeano & Adam Nagy (both work in the DIGIT department at the European Commission)
AI-Powered Site Building in Drupal: From Blank Site to Styled Pages in a Conversation
Enabling non-technical users to build, style, and structure complete Drupal sites via conversational prompts.
Date & Time: Wednesday, 30 September 2026, 16:00 - 16:45
Speakers: Francesco Pesenti & Francesco Quagliati (both are Developer Advocates and Solution Engineers at Platform.sh)
From Drupal Content to AI Answers: Learnings from EPSY
Designing constrained AI search engines over standard chatbots to deliver structured content answers.
Date & Time: Wednesday, 30 September 2026, 16:00 - 16:45
Speaker: Antonella Picarella (Head of Digital Communications & Content Strategy at BFF Banking Group)
From SEO to GEO: What Changes, What Doesn't
Strategic shifts from Search Engine Optimization to Generative Engine Optimization as AI engines handle discovery.
Date & Time: Wednesday, 30 September 2026, 16:00 - 16:45
Speaker: Wouter De Bruycker (Digital Marketing Strategist at Dropsolid)
From local voices to global impact: Powering World Cancer Day with Drupal and AI
Translating and moderating hundreds of high-volume personal stories across 60+ languages using AI tools.
Date & Time: Wednesday, 30 September 2026, 17:00 - 17:45
Speakers: Charles Andrew Revkin & Diego Fernando Costa (both part of the digital communications team at the Union for International Cancer Control (UICC), which runs World Cancer Day)
How Marketers Win in an AI‑First Search World (AEO & GEO Playbook)
Practical tactics for Answer Engine Optimization (AEO) and maintaining content discoverability in AI platforms.
Date & Time: Wednesday, 30 September 2026, 17:00 - 17:45
Speakers: Reena Tripathi (Digital Marketing Manager at OpenSense Labs) & Anubhav Gupta (CEO/Technical Architect at OpenSense Labs)
Whether you're coming to DrupalCon Rotterdam to build with AI, figure out how to govern it, or understand where it is taking Drupal next, there is a lot to choose from. From the two Monday summits through the DriesNote and a packed slate of sessions, AI is clearly woven throughout this year's programme. Check the full schedule, plan around the sessions that matter most to you, and we'll see you in Rotterdam.
16 Sep 2026 4:29pm GMT
Security advisories: Drupal core - Moderately critical - Third-party libraries - SA-CORE-2026-013
drupalThe Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal.
Vulnerabilities are possible if Drupal is configured to use CKEditor for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit this Cross-Site Scripting (XSS) vulnerability to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.
For more information, see CKEditor's security advisory:
Install the latest version:
Drupal 11
- If you use Drupal 11.4.x, update to Drupal 11.4.7.
- If you use Drupal 11.3.x, update to Drupal 11.3.17.
- Drupal 11.2.x and below are end-of-life and do not receive security coverage.
Drupal 10
- If you use Drupal 10.6.x, update to Drupal 10.6.17.
- Drupal 10.5.x and below are end-of-life and do not receive security coverage.
Note that Drupal 8 and Drupal 9 have both reached end-of-life.
Instructions for contributed modules
Site owners should also review their site following the protocol for managing external libraries and plugins, as contributed projects may use additional CKEditor plugins not packaged in Drupal core.
CKEditor has also released another CVE in today's release that does not affect Drupal, but may affect custom plugins or other usecases:
- catch (catch) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Mohit Aghera (mohit_aghera), provisional member of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- catch (catch) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
16 Sep 2026 4:21pm GMT
LakeDrops Drupal Consulting, Development and Hosting: Everybody Orchestrates. Most Do It by Hand.
Everybody Orchestrates. Most Do It by Hand.
Every month I do my agency's billing by hand: export timesheets from one system, create invoices in another, merge, email, file, upload to the accountant. I maintain ECA. Elsewhere, a multi-agency project runs from an Excel sheet nobody can keep current, because the spreadsheet is the only place people see everything and feel in control. Everybody orchestrates, most by hand, and not for lack of tools. ECA, Maestro, FlowDrop, Tool API, AI Integration - ECA 1.0.0 and the Orchestration module with Activepieces, soon n8n, could run my billing end to end today. But the builder opens five UIs and, worse, has to decide which engine runs which step. No user can make that decision. The fix is one UI: every component of every participating system on one canvas, engine routing done by the platform. The Modeler API, the Workflow Modeler, Tool API's typed contract and Post 6's shared vocabulary are that architecture. Missing: a composite model owner, a dispatcher, the cross-system data contract. Let's build them. In Drupal.
16 Sep 2026 10:15am GMT