fidzu : php

Choosing open-source software can free an organisation from a vendor's restrictions. It cannot free that organisation from the responsibility of maintaining what it uses. The distinction became harder to ignore when the Drupal Security Team and core release managers announced a shorter security-support window for standard minor releases. Beginning in 2027, coverage will fall from twelve months to eight, leaving site owners roughly two months to upgrade after a new minor version arrives. The decision reduces the workload for maintainers, but also leaves organisations less time to complete their own testing and approvals.

The pressure behind that decision is substantial. Between June and October 2026, Drupal published 256 security advisories across core and contributed projects, exceeding the 250 published during the preceding thirty months. The Drupal Association links the surge in reports to the growing use of AI-assisted vulnerability discovery, while funding from Alpha-Omega has supported efforts to manage the increased volume. Core release management, however, faces a separate funding problem, with experienced maintainers reporting significant reductions in sponsored hours. The result is an uncomfortable imbalance: more vulnerabilities are being discovered, but the resources needed to maintain and distribute secure software remain uncertain.

Public institutions face a similar challenge when pursuing digital sovereignty. Following DrupalCon Rotterdam's Government Summit, Bert Boerland, chair of Stichting Drupal Nederland, argued that public procurement should reward contributions to the software communities supporting government services, rather than paying only for finished applications. Governments may have the legal freedom to modify or replace their software, yet remain dependent on suppliers for the expertise to maintain it. Europe's Digital Commons EDIC strategy, which includes a maintenance funding pilot, offers one possible response to that dependency. Whether such commitments produce lasting support will depend on their implementation.

What connects these developments is the growing distance between those who benefit from open-source infrastructure and those responsible for sustaining it. Drupal's security commitments rely on maintainers whose time and expertise are finite, while public institutions depend on software communities that their procurement systems may do little to support. Neither problem can be resolved simply by choosing an open-source licence. As governments and businesses place more essential services on shared software, the question becomes less about whether they have the freedom to control it and more about whether they are prepared to share the responsibility that makes such freedom possible.

Follow The DropTimes on LinkedIn and Bluesky, or join #thedroptimes on Drupal Slack.

Allen Jason wrote and curated this issue of Editor's Pick.

09 Nov 2026 4:55pm GMT

Real-time Drupal with Drupack

theodore November 9, 2026

09 Nov 2026 4:43pm GMT

The Symfony AI & MCP Hackathon is well under way, with around 50 teams building and submissions open until 22 November. Three things have changed since we started. Two more judges Florian Bauer - Member of Technical Staff at OpenAI Fabien Potencier…

09 Nov 2026 4:30pm GMT

Turn repetitive editorial work into reviewable drafts. Learn how to configure Drupal AI tasks, protect accepted content, control spending, and measure completed fields.

09 Nov 2026 4:04pm GMT

Looking to exchange ideas with other Symfony builders? SymfonyCon Warsaw 2026 is happening on Nov 26-27 in Poland, with 3 streams of community talks and social gatherings. 🎤 Speaker announcement Mark your calendars for Greg Qualls, Director of…

09 Nov 2026 1:30pm GMT

Symfony 8.2 brings many improvements to the Translation component and its integration with Twig and forms, including better XLIFF files and a translation:extract command that finds many more messages. Meaningful XLIFF Source Elements…

09 Nov 2026 8:06am GMT