cms

21 Oct 2026

Drupal.org aggregator

Omega8.cc: The Ninety-Minute Recall

On Tuesday PHP's security team gave notice of two critical bugs, both scored 9.2, with the fixes due on Wednesday at 14:00 UTC. By Wednesday morning every BOA server, PHP 5.6 to 8.6, had switched off one setting which neither Drupal nor Backdrop uses, session upload progress, and a new PHP security floor was waiting, empty. PHP published at 13:34 UTC, and ninety-odd minutes later 8.2.35, 8.3.36, 8.4.27 and 8.5.12 and the floor were on all three BOA trees, so every box below the floor starts its own system pass within half an hour of seeing it, automatic updates switched off or not. By the evening the fixed 8.6 candidate and PHP's own backports for 7.4, 8.0 and 8.1 had gone the same road, leaving 5.6 and 7.0 to 7.3 on BOA's settings, with no patch. BOA's defaults, PHP-FPM alone behind Nginx with no per-request PHP settings, had shut most of the described routes before anyone outside PHP's security team knew of the bugs, though not the out-of-memory bug, which only the fix closes.

21 Oct 2026 7:04pm GMT

Centarro: A Shared Cart Across Brands Is Only Half a Feature

When a company sells under several brands, someone eventually asks the obvious question: why can't customers put products from every brand into one cart and check out once?

It sounds like a small improvement to the shopping experience, but it isn't a small feature. A shared cart between brands, on Drupal Commerce at least, is relatively easy, assuming each brand runs from the same Drupal installation.

But that's only half of the story. What happens after the order is placed? The hard part of a shared cart experience is everything after checkout, especially fulfillment.

How the cart works by default

In a multi-brand Drupal Commerce setup, each brand gets its own store entity. A store holds a brand's commerce settings:

Which merchant account takes the payment
Which prices and promotions apply
Which payment methods are available

Once something like Commerce Store Domain is installed and configured, a shopper's cart belongs to the store of the brand they're browsing.

21 Oct 2026 6:31pm GMT

Gspikes: HIPAA-Compliant Website on Drupal: What It Actually Takes

What makes a healthcare website HIPAA compliant on Drupal: the three places patient data gets in, the BAA question, the tracking-pixel rules after AHA v. Becerra, the module stack, and what 46 healthcare Drupal projects actually prioritise.