Feed aggregator

PHP2Shell: What Happened and How to Know Your Site Is Safe demet Fri, 10/23/2026 - 10:18

A pair of critical PHP vulnerabilities affected much of the web this week. Here’s how they were fixed, how to check your site, and how to stay protected going forward.

This week’s disclosure of PHP2Shell, a pair of security vulnerabilities that impacted up to two-thirds of the internet and resulted in the temporary shutdown of many high-profile websites, was, for many people, the first real look at how AI is changing digital security. The vulnerabilities are now patched, and if you’re a Palantir.net client, your sites are protected. Below, we explain what happened, how to confirm your site is safe, and how to stay protected going forward.

Those of us who design, develop, and support digital applications have anticipated a disclosure like this for some time. Over the last year or so, AI coding tools have grown increasingly capable of finding and exploiting previously undetected software vulnerabilities.

The good news is that the same tools are also helping the people who build and maintain software find and fix vulnerabilities faster. Many open source software projects have dedicated security teams that work in collaboration with other projects and organizations like Alpha-Omega, who have access to security-focused AI models that are not available to the general public.

Read more

Major Drupal conferences can be difficult to attend for people with limited budgets or family commitments. Megan McDermott explains why regional events matter and how local sponsorship helps bring learning opportunities within reach.

How much should developers trust AI, and what changes will Drupal 12 demand of maintainers? Nine speakers share practical lessons on development, accessibility, infrastructure and governance ahead of Southwestern Ontario Drupal Camp.

Drupal dropdown menus: how to build them in Drupal 11 Jurriaan Fri, 10/23/2026 - 08:27

A dropdown menu in Drupal 11 always starts in the same place: the core menu system, where you nest links under a parent. What turns that structure into a dropdown is either your theme or a menu module. This post walks through both routes, shows what the result looks like on desktop and on a phone, and compares the menu modules that are maintained for Drupal 11 today.

The screenshots come from a Drupal 11.4 site with DXPR Theme 8.2.2, taken in October 2026; the module details come from drupal.org on 23 October 2026.

In short: build the menu under Structure, Menus, nest the links, and tick Show as expanded on every parent. A theme with dropdown support, such as Olivero (one dropdown level) or DXPR Theme (three levels, automatic columns), then renders the dropdowns. Add a module such as Superfish or The Better Mega Menu only when the theme cannot do what you need.

Let an AI agent build the menu. A menu is a list of links with a hierarchy, the kind of structured task a coding agent does well. With the Drush Webmaster skill, an agent creates and orders the menu links from a short brief, and with DXPR Theme's agent skill it sets the header layout and menu colors to match the brand. You review the result on the site.

1. Create the menu structure in Drupal core

Go to Structure, Menus, and edit the menu that sits in your header, usually Main navigation. Add the links with Add link, then drag each child under its parent so it indents one level, and press Save.

Read more

Drupal 11 Layout Builder tutorial: sections, blocks and overrides Jurriaan Fri, 10/23/2026 - 07:12

Layout Builder is Drupal's own page layout tool. It ships with Drupal 11 core, it works on any content type, and it lets a site builder define a default layout once and let editors adjust the layout of a single page when they need to. This tutorial walks through the whole thing on Drupal 11.4: enabling the module, giving a content type a layout, adding sections and blocks, saving the default, overriding it on one page, and the two contributed modules that make it workable for editorial teams.

Every screenshot was taken on a Drupal 11.4 site in October 2026, with Claro as the administration theme and DXPR Theme on the front end. Layout Builder opens in the front-end theme, so on your site its buttons and tray may look slightly different.

Layout Builder gives you the frame. AI fills the page.

Layout Builder arranges blocks in regions. It does not write the headline, the three feature cards or the call to action, and it will not draft the Dutch version. That part of the work is where most of the time goes, and it is what DXPR Builder adds inside your Layout Builder layouts.

DXPR Builder runs as a formatter on a text field, so a DXPR Builder field sits inside a Layout Builder section like any other block. Layout Builder keeps the overall page structure; inside the field, an editor describes the page in a brief and gets an editable draft with sections, text, images and buttons, then refines it in the visual editor or by asking for changes in context. Translations start as AI drafts for a local editor to review. Nothing publishes on its own; the page goes through the permissions and moderation your site already has.

Read more

Drupal website examples: 16 sites running on Drupal in 2026 Jurriaan Fri, 10/23/2026 - 07:00

Drupal runs some of the busiest public websites in the world, and most of them do not look like each other. That is the point of this list. Every site below runs Drupal today, checked on 23 October 2026 against the markup the sites serve, and together they cover universities, governments, global manufacturers, biotech, security companies and libraries.

Most of them are DXPR customers, so for those we can tell you what was built, not only what it looks like: the team behind it, the problem they solved and, where the case study states them, the numbers. A few well-known Drupal sites are included for breadth. Where the old version of this article listed sites that have since moved to other platforms, they are gone; Drupal website examples are only useful when they are current.

How pages like these get built in 2026: with AI, inside Drupal.

Every site on this list has an editorial team that publishes without a developer in the loop. In 2026 that team starts a page with a brief.

DXPR Builder turns a brief into an editable page: describe the audience, the message and the page structure, then shape the result in the visual editor. The draft is normal DXPR Builder content, so an author can rewrite a headline, move a section or swap an image without touching AI again. Translations start as AI drafts and finish with a local editor, with Drupal keeping the language editions connected. Nothing publishes on its own: the page goes through the permissions and moderation your Drupal site already has.

Read more

Druxt is the Fully Decoupled Drupal framework for Nuxt 2, and 0.25.0, the first Druxt release since 2023, makes it ask Drupal a lot less.

On druxtjs.org, the Druxt docs site, a page render made 17 requests to Drupal. On 0.25.0 it makes 11, and with content caching on it makes none, until Drupal's lifetime for the page runs out. The Nuxt server keeps what Drupal sends for as long as Drupal's Cache-Control allows, and a webhook clears it when content changes.

Separately, the first-load flicker is gone, and with schema.refresh on, a change in Drupal's Manage display shows up without a rebuild, which is the part I have wanted for years. The upgrade command is near the end.

Continue reading →

First things first: if you have not yet updated PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your host's or distribution's patched build), do that right away. See PSA-2026-10-20 from the Drupal Security Team and the PHP project's security advisory. Updating is the only complete fix for CVE-2026-109618 and CVE-2026-109619, and a configuration change or web application firewall rule does not replace it.

It feels like the whole internet has come together to address this PHP vulnerability. It is rare to see that much coordinated effort, and that much care and collaboration.

This post is about what comes after the update. On 21 October, Amazon Threat Intelligence reported that its honeypots recorded an exploitation attempt on 17 October, four days before the vulnerabilities were public, and further attempts in the hours before the fix was released. Amazon does not know whether those early attempts would have worked against real systems. But it means a site that updated promptly on 21 October was still exposed for several days beforehand, and a site that updated later was exposed for longer. Patching closes the door; it does not tell you whether anyone came through it first.

These vulnerabilities are in PHP itself, not in Drupal, so there is no Drupal-specific signature to look for, and no single checklist that fits every site.

Read more

Today we are talking about Drupal Advocacy, Non-Code Contribution, and the future with guest Tiffany Farriss. We'll also cover Better Social Sharing Buttons as our module of the week.

For show notes visit: https://www.talkingDrupal.com/575

Topics

• Tiffany New DA Role
• Sustaining Drupal Next 25
• Time Box And Priorities
• Three Bucket Strategy
• Fixing DA Finances
• Transparency And Trust
• Trust Through Transparency
• What Advocacy Solves
• Why Reputation Lags
• From Scattered To Focused
• Beyond The Drupal Bubble
• Problem First Storytelling
• Proof Over Promotion
• Scaling Non Code Contributions
• Funding Drupal Sustainability
• Success Metrics

Resources

• Drupal Advocacy Program

Guests

Tiffany Farriss - association.drupal.org farriss

Hosts

Nic Laflin - nLighteneddevelopment.com nicxvan John Picozzi - epam.com johnpicozzi Tim Sharp - tea-sharp

Read more

Author: Martin Anderson-Clutz (mandclu)
Republished with permission from Acquia

Vibe coding or AI rejection? Learn the pragmatic middle path for Drupal teams: what to delegate to AI, when, and how to verify it.

At the Dev AI Summit at DrupalCon Rotterdam, I opened my session with a show of hands. Who has used AI to assist their Drupal development? Nearly every hand in the room went up. Who has used it for other parts of their job? Most hands stayed up. Then I asked who had fully delegated code creation to AI, and the room got a lot quieter.

That gap between "I use AI" and "I trust AI to do the work" is where most Drupal teams live today. It is also where the most important decisions about AI-assisted development get made, often without anyone making them on purpose.

In Part 3 of this series, I introduced the idea of the Code Director: a developer who provides direction to an AI agent, or even a swarm of agents, to make sure the right thing takes shape in the right way. In Part 5, I described the Code Director as the essential human layer for security, compliance, and maintainability, and argued that AI is most valuable as a reasoning partner. This post builds on both. It makes the case that Code Direction is not a compromise between embracing AI and rejecting it. It is the pragmatic middle path, and it comes with a practical discipline: knowing what, when, and how to delegate.

Read more

Drupal 12.0.0 is scheduled for the week of 7 December 2026, the same week Drupal 10 reaches end of life, and requires PHP 8.5 and at least Drupal 11.3.

Drush forma parte de casi todos los proyectos Drupal con cierto peso: reconstruye cachés, ejecuta actualizaciones de base de datos, importa configuración y gestiona despliegues. Con Drupal 11.4, el core incluye su propia herramienta de línea de comandos, dr, y la iniciativa detrás de ella apunta abiertamente a, con el tiempo, acabar reemplazando a Drush completamente. La herramienta todavía es experimental, pero el cambio ha comenzado, y no todas las partes de los flujos de trabajo diario que dependen de Drush, especialmente los pipelines de CI/CD y las operaciones remotas, se desarrollarán al mismo ritmo. Conocer el estado actual evitará disgustos más adelante.

Drupal ha dependido de una herramienta externa para sus operaciones diarias a un precio

Drush es el CLI de facto de Drupal. Todas las operaciones de CLI (reconstruir cachés, ejecutar actualizaciones de base de datos, importar configuración, gestionar despliegues) pasan por él, y se mantiene fuera de core. El script ofrecido por el core, core/scripts/drupal, añadido en 2018 (...

Drush is part of almost every serious Drupal project: it rebuilds caches, runs database updates, imports configuration and drives deployments. With Drupal 11.4, core ships its own command-line tool, dr, and the initiative behind it openly aims to replace Drush over time. The tool is still experimental, but the transition has started, and the parts of daily work that depend on Drush, especially CI/CD pipelines and remote operations, will not all move at the same pace. Knowing where things stand now avoids being wrong-footed later.

Drupal has depended on an external tool for its daily operations at a cost

Drush is the de facto CLI for Drupal. All CLI operations (rebuilding caches, running database updates, importing configuration, driving deployments) go through it, and it lives outside core. Core's own script, core/scripts/drupal, added in 2018 (#2911319), was not extensible and only shipped three built-in commands: quick-start, install and generate-theme.

…

Who would have thought the Drupal plural translation experience can be this much better?

Did you know that Drupal only learns how many plural variants a language has from imported .po files? It has a very fast lookup table to pick the right variant each time, but there is no UI to set or fix the rules. Get them wrong and your carefully translated strings fall back to the wrong form. Export your translations and the right plural rules don't come along either. I had a small module that provided a little bit of the solution since 2010 but recently decided to think bigger.

Gábor Hojtsy Thu, 10/22/2026 - 16:20

What 84 nonprofit Drupal projects prioritised, the eight homepage elements that turn visitors into supporters, how to design the donation path, and which platform fits your nonprofit.

Behind some of Drupal's most demanding projects are difficult decisions about scale, security and legacy systems. Six speakers reveal what they have learnt, what surprised them and what they will bring to the stage in Bologna.

On Tuesday 20 October (Wednesday morning in Australia), the PHP Foundation announced the pending release of fixes for two critical security vulnerabilities in PHP, the language Drupal is written in.

The release was scheduled for 14:00 UTC, which would be 1am for us. This post details how our team prepared and handled the rollout of this release to our clients' sites.

by griffyn.heels / 22 October 2026Lurking in plain sight

The PHP security release was for bugs that had sat unnoticed for more than a decade before security researchers found them with the help of AI. The exploit needed multiple steps to reproduce, which previously made it very difficult to detect. AI makes that much easier.

This reflects a bigger shift in cybersecurity. AI is now being pointed at decades of existing code and turning up serious flaws faster than open source security teams have had to deal with before. While the headlines have been about PHP this week, other open source projects are experiencing a similar increase in security reports.

PHP's maintainers were following established security practices and had planned a coordinated release with the researchers who found the flaws. They were forced to bring the release date forward by a day when it was undermined by someone leaking details during the embargo period. The PHP Foundation has been candid about how it unfolded, and it's a reminder that how quickly you respond now matters as much as the code you run.

Read more

Drupal has issued a security alert following the discovery of two critical PHP vulnerabilities. Patches are now available, and site owners should confirm that their hosting environment has received both fixes, even if Drupal itself is fully updated.

We've changed how contribution credit is weighted on Drupal.org, and the changes are now live. If you watch the Drupal Marketplace you may have noticed some organizations shift position as a result; this post explains what changed and why, and what's still coming.

Two weights went up. Everything else stayed the same.

• Core issues are now worth a baseline of 15 credits each (previously 10). We're delighted at how strongly organizations have rallied behind strategic initiatives like Drupal CMS, Drupal Canvas, and Drupal AI. That's exactly what the credit system is meant to encourage. Those initiatives all stand on Drupal core, though, and we want to make sure the core team gets the fundamental care and feeding it deserves alongside them.
• Core security advisories now carry a 10x multiplier on top of that baseline, so a single core security issue is worth 150 credits (previously 50). The Security Team and core release managers are handling a growing volume of AI-generated reports, and we want organizations to have a strong reason to support, or join, that work.
• Unchanged: the minimum credit value is 1; credit scales with project usage (a project used on 300,000 sites earns 3 credits per issue); strategic initiative issues are worth 10 credits; and contrib security advisories remain at 5x the project's normal weight.

We've also expanded the core sponsorship table, which gives sponsors a guaranteed monthly base credit for supporting key roles whose most important work doesn't always happen in an issue. It now covers active Security Team Members, Subsystem Maintainers, and Topic Maintainers in addition to the core leadership roles already listed.

Read more

On Tuesday PHP's security team gave notice of two critical bugs, both scored 9.2, with the fixes due on Wednesday at 14:00 UTC. By Wednesday morning every BOA server, PHP 5.6 to 8.6, had switched off one setting which neither Drupal nor Backdrop uses, session upload progress, and a new PHP security floor was waiting, empty. PHP published at 13:34 UTC, and ninety-odd minutes later 8.2.35, 8.3.36, 8.4.27 and 8.5.12 and the floor were on all three BOA trees, so every box below the floor starts its own system pass within half an hour of seeing it, automatic updates switched off or not. By the evening the fixed 8.6 candidate and PHP's own backports for 7.4, 8.0 and 8.1 had gone the same road, leaving 5.6 and 7.0 to 7.3 on BOA's settings, with no patch. BOA's defaults, PHP-FPM alone behind Nginx with no per-request PHP settings, had shut most of the described routes before anyone outside PHP's security team knew of the bugs, though not the out-of-memory bug, which only the fix closes.