Feed aggregator

Putting AI into production raises harder questions than connecting a model to Drupal. Rotterdam speakers focus on context, evidence, controls and human review.

A statewide publishing platform can reduce repeated technical work across public websites, but it also establishes an operating model that can outlast the migration that created it.

Release state changes the response: some Drupal changes are ready to use, some warrant a targeted update, and others belong in testing rather than production.

I came up with the title for this blog post while working on 20+ Webform security issues, because there were moments when I used Codex to hammer out a particularly complex issue. I couldn't help but find it ironic to use something as advanced as AI to hammer at a problem or challenge.

Some security issues were so complex to reproduce that I had to push Codex to replicate the problem, and it occasionally generated sloppy code. Still, even with Codex generating AI-slop, it helped me understand the root causes and solutions for security issues that had lingered for years.

Before I go any further, let's step back and talk about the challenge of maintaining the Webform module and addressing security issues.

Maintaining the Webform module

The bulk of the Webform module was created a decade ago, when I had more time and motivation to make a sizable contribution to Drupal. Drupal contributors and their contributions come in all shapes and sizes. The current codebase is stable and extendable, with "extendable" as the keyword, because people and AIs can alter and create Webform features and behaviors as needed using contributed modules or custom code. It is ironic that all the example webforms included in the Webform module, intended to help humans, have proven incredibly useful for AIs in understanding and extending webforms.

Though I am willing to say the code is stable, the fact that a webform is generally public and accepts input leaves the Webform module open to security issues. In other words, malicious actors, including AI, will target webforms to exploit XSS vulnerabilities or expose data.

Securing the Webform module

Read more

Core contributors and continuous integration maintainers need to account for the new JavaScript development baseline without treating it as a Drupal 11 or production hosting requirement.

Los sistemas de gestión de contenidos incluyen diferentes tipos de archivos como parte del contenido que manejan. Sin embargo, debido a varios motivos, la aplicación no siempre hace seguimiento de estos ficheros, lo que puede hacer que haya acumulación de ficheros sin uso y dar lugar a ciertos problemas. Esta artículo trata de este asunto y propone el módulo File Inspector como solución.

Los archivos de los que Drupal no hace seguimiento

Cualquier sitio Drupal con años de vida, ya almacene archivos en una carpeta local o en un bucket remoto como Amazon S3, acumula cientos de archivos sin forma fácil de saber de cuáles sigue Drupal haciendo seguimiento y de cuáles no. Los archivos provienen de cuatro fuentes: contenido activo, restos de nodos eliminados hace años, residuos de migraciones y copias de seguridad, y subidas directas, como un PDF se copió al servidor porque en su momento era "más rápido".

Es un problema habitual en el sector y no depende de la tecnología utilizada. Todo sistema de gestión de contenidos lo afronta tarde o temprano. La causa raíz son dos almacenes que deben coincidir: los datos en disco frente a la base de datos que se supone debe llevar un seguimiento de ellos. En cuanto ambos almacenes coexisten, se acaban desincronizando en algún momento. Esto ocurre de tres formas diferentes: cuando se eliminan registros en la base de datos pero no los archivos,...

Content management systems include different types of files as part of the managed content. However, for several reasons, those files are not always tracked by the application and can accumulate and lead to certain issues. This article explores this problem and proposes File Inspector as a solution. The files that Drupal does not track

Any long-lived Drupal site, whether it stores files in a local folder or a remote bucket like Amazon S3, holds hundreds of files, and there is no easy way to see which ones Drupal still tracks and which it has lost sight of. The files come from four places: live content, leftovers from nodes deleted years ago, migration and backup residue, and direct uploads, such as a PDF dropped onto the server because it was faster.

This is a common problem in the sector, and it does not depend on the technology in use. Every content system faces it sooner or later. The root cause is two stores that must agree: the bytes in storage versus the database that is supposed to keep track of them. The moment both stores exist, they drift. It happens in three ways: records get deleted but the files stay, files get uploaded but never registered, and jobs fail halfway.

These accumulated unreferenced files are untracked files, a kind of dark data: information an organisation keeps but no longer uses.

The cost of untracked files…

Generate Drupal local actions from Views configuration

On an editorial site, it is often useful to give articles, documents and other content types their own administration listings. Editors can then work with one type of content at a time, with an "Add Article" or "Add Document" button alongside the relevant list.

Maintaining a separate button definition for every listing means keeping the same relationship in two places. Whenever we add a listing or change which content type it shows, we need to remember to update its creation action too. This article shows how to avoid that duplication with a local action deriver.

When those listings are built with Views, their content-type filters already tell us which creation form belongs on each page. We can use that information to generate the buttons, keeping their definitions in step with the listings they belong to.

Illustrative mockups with example content. Each listing offers its own creation action.

A creation button for each listing

Drupal provides these buttons through local actions. To add one, we specify its label, where it links to and which page should display it. For an article listing, that could take a short YAML definition in listing_actions.links.action.yml, assuming the custom module's machine name is listing_actions:

Read more

OpenKnowledgebase Beta 1 - try the knowledge base for people and AI agents now! jeremy.chinqui… Wed, 23 Sep 2026 - 17:56 The first public beta is out: the knowledge base for people and AI agents. Agents edit as governed collaborators, every answer cites the block it came from, and all of it is open source.

A complex public healthcare platform can put Drupal at the centre of governance without making it responsible for identity, workflows, messaging, observability or the frontend.

Sharing Drupal code across country sites does not sync product specifications, documents, or company claims.

Drupal multisite vs multilingual teams must decide where authoritative facts live before AI assistants encounter contradictory pages. Maciej Lukianski compares multisite, one multilingual Drupal, and Domain Access for market-aware publishing.

Eight Posts on the Fun Part. One on the Bill. Photo by Kamil Foatov on Unsplash Jürgen Haas Wed 23 Sep 2026 - 15:00

In Post 8 I described my monthly billing run. One client never gets an invoice: the Drupal community, which has had almost all of my working time since July 2025. This post is that invoice. The eight posts before it showed the fun part: the Modeler API, the Workflow Modeler, test and replay, the ECA Guide, orchestration. This one shows the ledger underneath: 87 actively maintained drupal.org projects, the Gin admin theme, the Admin theme subsystem in core, 293 public projects on the LakeDrops GitLab, a calendar of weekly and monthly community meetings, two DrupalCons a year. Innovation gets applause; maintenance gets a green badge. Every funding conversation so far was about a feature. Nobody has offered to sponsor a security release. Since July 2025 the revenue has been zero, paid for by earlier years. Dries' cost-allocation posts explain why. The menu at the end has prices: sponsor maintenance through Open Collective, a service agreement, hiring for ECA work, funding the next innovation. Total: roughly €10,000 a month.

Useful Drupal work does not reach wider audiences automatically. The September Townhall explores where community participation can help.

Estonia has several development partners with strong Drupal experience, but they are not directly interchangeable. Building a large new digital platform, maintaining an existing Drupal website and taking over a legacy project require different kinds of teams. The first step in choosing the right partner is to define the problem you actually need to solve. Who provides Drupal development in Estonia? Drupal development in Estonia is provided by both larger full-service software companies and smaller specialist teams. Based on public service pages, references, Drupal.org profiles and public procurement records from recent years, visible providers include ADM Interactive, Trinidad Wiseman, Web Expert, Krabu Grupp and Krabu Tech, Mearra, Limegrow, Revelan and WebPro. This is not a ranking…

A partner-managed website is not a problem as long as your company can take control of all critical access and assets when needed. Gaps usually become visible only when you need to change developers or restore the website quickly. Your company may own the domain while someone else controls access The first things to check are the domain and DNS. Your company should know who the domain is registered to, where it is managed and which email address receives renewal notices and other important messages. The same applies to DNS. If only the current development partner or a former employee can access it, even a simple server migration can become difficult. DNS can affect services beyond the website, so records should not be changed blindly during a partner transition. The point is not that a…

What should an agency return to the open-source ecosystem it relies on? Zoocha’s answer connects community investment with harder questions about AI accountability and Drupal’s ability to explain its value beyond familiar audiences.

Two shifts are converging in how Drupal pages get built. The first has already arrived: Drupal Canvas, Drupal's new visual page builder, gives editors a modern, component-based way to compose pages. The second is happening across the broader industry: AI that generates pages from natural-language prompts.

The Enterprise AI Summit takes place in one week, on 28 September aboard the SS Rotterdam, and the countdown is a good moment to properly introduce a session that's been on the agenda for a while: sovereign AI with Julien Blanchez.

Digital sovereignty has moved from a policy discussion into a boardroom question. Regulators, procurement teams and public sector organisations are asking the same thing in different ways: can we use world-class AI technology while keeping control over where our data lives, who can access it, and under what conditions?

With over a decade at Google working on data protection, security and digital sovereignty for large, highly regulated organisations, Julien will walk us through what's driving rising sovereignty expectations and how to keep access to leading AI technology on your own terms.

He joins a day full of similar questions answered with real numbers. The European Personnel Selection Office deployed a RAG-powered instant answer engine inside Drupal in under eight weeks, running in all 24 EU official languages, with 90% fewer repeat support questions and zero hallucinations on manual review. The American Diabetes Association will share what happened when editorial teams got real AI tools in their hands, including the honest lessons that came with it. And Moritz Arendt takes on a question that sits right next to Julien's: can AI strengthen digital communities, or does it risk hollowing them out?

With just days left, there’s still time to check the full agenda and save your seat. Tickets and details are available on the Enterprise AI Summit page.

Choosing a CMS for a multilingual product catalogue is a content-operations decision, not a plugin shootout.

Drupal vs WordPress enterprise teams must compare field-level translation, moderation, entity APIs, and AI-ready outputs before assistants read conflicting specs. Maciej Lukianski explains when WordPress still wins, when Drupal fits connected complexity, and how to pilot migration without guessing.

The 2025 recruitment drive added maintainers across a dozen vacancy areas, but Drupal core’s current roster shows how later departures and module changes have altered that picture.