Blogs

News in this area are aggregated from Blogs across Drupal.org:

Drupal blog
Drupal.org blog
Drupal Association blog
Drupal Supporters blog

PHPStan level 3, constructor property promotion, and other disruptive commits this week in advance of Drupal 12.0.0-rc1

By xjm on

Drupal 12.0.0 and 11.5.0 are scheduled for the week of December 7, 2026. In preparation for these upcoming releases, our schedule targets release candidates for these versions for less than two weeks from now, the week of November 9.

Turning AI's Promise Into Practical Results at Drupal AI Summit Paris 2026

By pdjohnson on

For most organizations, the question is no longer whether AI matters, but how AI fits into their own work, on what terms, and at what cost.

On December 1, 2026, the Drupal AI Summit Paris will bring together experts and organizations that have already worked through those questions, including EU institutions and medical researchers, to share what they learned.

Your summit ticket also gets you all three days of the Future of Software Technologies (FOST) conference, December 1-3, with over 300 sessions to choose from.

256 Advisories in Five Months: Results from the Drupal AI Security Initiative

By farriss on

Between June and October 2026, the Drupal Security Team published more advisories than in the previous 30 months combined. Five months into our SEIR grant, our data shows the shifting economics of discovery and why funding a complete workflow kept our volunteer process moving.

The best of the Drupal Advocacy Program's first month

By ryan_witcombe on

At DrupalCon Rotterdam, Dries asked the community to talk louder about Drupal. The platform is years ahead of its reputation, and no single organisation can close that gap alone. To that end, the Drupal Association launched the Drupal Advocacy Program: tell Drupal's story in your own voice, and earn contribution credits for it, through the same system that recognises code.

In the Open with Tiffany Farriss: What it takes to sustain the Drupal commons

By ryan_witcombe on

In the Open is a weekly series from Drupal Association Interim CEO Tiffany Farriss, sharing what she is hearing across the Drupal community and where the Association is headed. In this episode: why Drupal's commons is under pressure, how the Drupal Certified Partner program is evolving, and what it takes to keep free software running for the next 25 years.

Webinar: Can AI help your website guide people to their next step? Join us October 29, 2026

By pdjohnson on

Your website may have the information people need. But the way they discover and evaluate their options is changing, with AI-generated answers becoming part of the journey.

After the PHP security release: auditing your Drupal sites

By hestenet on

Updating PHP closes the door, but it does not tell you whether anyone came through it first. With honeypot evidence of exploitation attempts from 17 October, four days before the fix was public, here is how the Drupal Association is auditing Drupal.org, and what our research suggests site owners should check on their own servers.

Vibe Coding Drupal: The Pragmatic Middle Path

By matthews on

Author: Martin Anderson-Clutz (mandclu)
Republished with permission from Acquia

Contribution credit updates: higher weights for core and core security work

By hestenet on

Contribution credit weights for Drupal core and core security work have gone up, and the core sponsorship table now covers Security Team, Topic Maintainers and Subsystem Maintainers. Here’s what changed, why, and what’s still to come.

PHP2Shell Incident Recap: Upstream PHP RCE Vulnerabilities and Drupal.org Response

By farriss on

On October 21, 2026, the PHP project released emergency security updates for two critical remote code execution (RCE) vulnerabilities in the PHP runtime engine itself (CVE-2026-109618 and CVE-2026-109619, known as "PHP2Shell"). These flaws affect all PHP applications across the web, including Drupal sites. There is no evidence of compromise across Drupal.org infrastructure. All Drupal site owners must update their underlying PHP runtime immediately and audit their environments.

Pages

Subscribe to all posts