Introducing the Drupal AI Security Initiative: The First Six Weeks

Drupal's volunteer Security Team has protected millions of sites for more than 20 years and its process is world-class. Bandwidth among the security engineers has always been the limiting constraint. This spring that constraint met a new kind of pressure: AI-assisted analysis is finding latent vulnerabilities at an accelerating pace.

The Drupal AI Security Initiative adds funded security capacity in response. It is funded through Alpha-Omega's Security-Engineer-in-Residence (SEIR) program, coordinated by the Drupal Association, and works alongside the volunteer Security Team, which continues its normal process throughout.

This post introduces the initiative and reports on our first six weeks. The short version: the funded fractional team model is working and has already evolved our understanding of where we want to focus next.

Why Drupal Contribution matters to you!

DrupalCon Rotterdam 2026 is going to be way more than just sessions and keynotes, it’s a chance to be part of what actually builds and improves Drupal. 

Contribution Day is a part of DrupalCon, and in Rotterdam it will be on Thursday, 01 Oct. This is the heart of the event, where the global community comes together to make a real and concrete impact to the project.

Outside AI - The State of Agent Experience in Drupal.

By Scott Falconer, Product Lead, Outside AI

Where Drupal really stands with AI agents, where it has a right to win, and what we need to do next.

AI agents can build with almost anything. That is both great news and a problem for Drupal.

How Drupal Has Protected Millions of Sites

The Drupal project runs one of the most disciplined coordinated-disclosure programs in open source, and it has done so through volunteer effort for more than two decades. Millions of sites, many operated by governments, universities, and enterprises, depend on it.

Serving the Drupal project, and evolving how we fund it

I've stepped into the role of interim CEO of the Drupal Association for a limited period, expected to last six to twelve months. My job in that time is to help put the Association on a durable footing. As I undertake that task, I want to start by being direct about where we are and where I'd like to see us go next.

Three Real-World AI Cases Coming to the Enterprise AI Summit

It feels like the right moment to share something I have been looking forward to announcing. The holidays are just beginning, and the Enterprise AI Summit (28 September, Rotterdam) is coming together.

We have been reviewing sessions over the past weeks, and three cases in particular stood out, each solving real problems for real organisations.

Here is a first look at three of the sessions we are excited to share.

Migrating issues from security.drupal.org to git.drupalcode.org

All security issues have been migrated from the older security.drupal.org site to our GitLab instance at git.drupalcode.org. This is the latest in a series of steps to improve Drupal’s coordinated vulnerability disclosure tools. We hope this will help in a few ways:

Tiffany Farriss to lead the Drupal Association

As Tim Doyle steps down as CEO, Tiffany Farriss will lead the Drupal Association through its next chapter, strengthening its foundation and preparing it for long-term growth.

Leadership changes at the Drupal Association

Our CEO, Tim Doyle, has stepped down from his role. We are grateful to Tim for his leadership and impact on our organization. Tim has built a strong leadership team that is positioned to continue the mission and vision that he and the Board share for Drupal.

As part of this process, the Board has been working to identify Tim’s successor. We anticipate that the important work and mission of our organization will continue under new leadership, building on the strategy and plans we led during Tim’s time with Drupal.

Pages

Subscribe to all posts