In Rotterdam, Dries asked the community to talk louder about Drupal. The response so far: 264 pieces of advocacy from nearly 150 people, in at least seven languages, on everything from Reddit threads to a major Italian daily. I spent the past week reviewing all of it, and I'm feeling incredibly optimistic about what this program can unlock.
In the Open is a weekly series from Drupal Association Interim CEO Tiffany Farriss, sharing what she is hearing across the Drupal community and where the Association is headed. In this episode: what the Drupal Association team took away from its first all-staff retreat in three years, how the Drupal certification program is evolving, and what’s coming up with the Rosetta Sprint and DrupalCon Orlando 2027.
In the Open is a weekly series from Drupal Association Interim CEO Tiffany Farriss, sharing what she is hearing across the Drupal community and where the Association is headed. In this episode: how AI is changing vulnerability discovery for everyone, what the Drupal Security Team and the Alpha-Omega funded SEIR program have achieved in five months, and how site owners, hosts, and organizations can help.
At DrupalCon Rotterdam, Dries asked the community to talk louder about Drupal. The platform is years ahead of its reputation, and no single organisation can close that gap alone. To that end, the Drupal Association launched the Drupal Advocacy Program: tell Drupal's story in your own voice, and earn contribution credits for it, through the same system that recognises code.
In the Open is a weekly series from Drupal Association Interim CEO Tiffany Farriss, sharing what she is hearing across the Drupal community and where the Association is headed. In this episode: why Drupal's commons is under pressure, how the Drupal Certified Partner program is evolving, and what it takes to keep free software running for the next 25 years.
Updating PHP closes the door, but it does not tell you whether anyone came through it first. With honeypot evidence of exploitation attempts from 17 October, four days before the fix was public, here is how the Drupal Association is auditing Drupal.org, and what our research suggests site owners should check on their own servers.
Contribution credit weights for Drupal core and core security work have gone up, and the core sponsorship table now covers Security Team, Topic Maintainers and Subsystem Maintainers. Here’s what changed, why, and what’s still to come.
On October 21, 2026, the PHP project released emergency security updates for two critical remote code execution (RCE) vulnerabilities in the PHP runtime engine itself (CVE-2026-109618 and CVE-2026-109619, known as "PHP2Shell"). These flaws affect all PHP applications across the web, including Drupal sites. There is no evidence of compromise across Drupal.org infrastructure. All Drupal site owners must update their underlying PHP runtime immediately and audit their environments.
In a major shake-up, your advocacy work now earns Drupal contribution credit.
Drupal is now light-years ahead of its reputation. It's time we changed that.
The Drupal Advocacy Program is a new Drupal Association pilot that awards contribution credit for work that helps people discover and understand Drupal.
