Planet Drupal

Most Drupal site owners I talk to handle Drupal security updates the same way. These are the fixes the Drupal Security Team publishes for core and contributed modules. A developer sees the security advisory. A ticket goes into the next sprint. The patch goes live a few days later, sometimes two weeks later.

A Drupal update should come with confidence that your important workflows still work. Learn how to introduce Playwright, build useful browser tests, and make automation part of your release process.

Date: 2026-October-12Security risk: Critical 19 ∕ 25 AC:Complex/A:None/CI:All/II:All/E:Theoretical/TD:AllDescription: 

There will be a Drupal core security release for all supported branches on October 14, 2026 between 16:00 and 21:00 UTC. (To see this in your local timezone, refer to the Drupal Core Calendar.) Based on our analysis this vulnerability rates at 19/25 on our risk calculator.

The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days.

We recommend updating to the latest supported patch (bugfix) release for your site's version of Drupal before October 14, so that you can address any other upgrade issues before the security window.

This issue is being protected by Drupal Steward. Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered.

Affected versions

All currently supported versions of Drupal core are affected, including:

Read more

The eight-step Drupal 7 database cleanup we run before every migration: caches and logs, revisions, deleted fields, files, spam accounts, content you will not bring, and the module data you leave behind, in the order that costs least and saves most.

Questions about the pace of advanced artificial intelligence are no longer confined to the research teams building it. Former OpenAI safety leader David Robinson described his decision to leave the company in a 3 October essay for The Atlantic, challenging the assumption that developers can release increasingly capable systems and address risks as they emerge. Former Anthropic researcher Jacob Coxon had raised concerns about competition between AI laboratories in a September interview with WIRED. Their warnings point to a conflict between the speed of development and the time required to evaluate its consequences. Neither departure demonstrates that the industry has actually slowed down.

That tension has reached public hearings and internal disputes. At a 5 October hearing, New York City Council members questioned representatives of major AI companies and heard testimony from former researchers at Anthropic, OpenAI and Google DeepMind. Three other former OpenAI safety researchers, Jasmine Wang, Tomek Korbak and Mikita Balesni, subsequently disputed the company's stated grounds for their dismissal. They warned that uncertainty over acceptable contact with external evaluators could discourage scrutiny. OpenAI rejected the suggestion that they had been dismissed for raising safety concerns and said its policies on sensitive information had been breached. The underlying dispute remains unresolved.

Read more

Author: Will Huggins

The narrative around enterprise AI is changing. Digital leaders — from CMOs looking for campaign velocity to CISOs managing vendor risk — are no longer just asking for new AI features. They are asking for AI infrastructure they can actually trust. They want to know how to maintain brand sovereignty, ensure content provenance, and scale AI operations without creating unmanageable compliance risks.

This shift in the market perfectly aligns with the mission of the Drupal AI Initiative: to establish Drupal as the premier open-source AI platform for digital experiences.

This October, the conversation takes a national stage at Digital Leaders' AI Week 2026, the UK's largest online festival of AI learning. And the Drupal community is front and center.

While Drupal AI is fundamentally a technology initiative, its real-world impact comes from the thought leadership of the people building it. At AI Week, members of the Drupal ecosystem will share strategies that go far beyond the CMS, showing how open-source principles are solving the hardest challenges in enterprise AI adoption.

Here is a look at two key sessions you won't want to miss.

The Technology Is Ready. Is Your Organisation? Why AIMS Will Define the AI Leaders

When: October 16, 2026

The technology to generate content, personalise experiences, and orchestrate complex user journeys is already here. But as many organisations are discovering, having access to an AI model is not the same as having a scalable AI operation.

In this session, we will explore the critical gap between technological capability and organisational readiness. The focus will be on the necessity of an AI Management System (AIMS) — a structured approach to governing AI adoption.

Read more

Running with scissors: Using AI to explore, build, maintain, contribute, and secure Drupal" is the title of my DrupalCon Orlando session proposal. I've been using and writing about AI as a Drupal developer for the past year, and I look forward to sharing my experience with fellow Drupalers at the conference. There is so much discussion about AI and Drupal, and I'd like your help with my DrupalCon session proposal.

We should assume most session proposals will focus on AI inside and outside Drupal from the perspective of site owners and builders. Meanwhile, if we want to encourage people to try Drupal, we also need to sell it to developers. My goal is to sell "using AI to explore, build, maintain, contribute, and secure Drupal" to developers and vibe coders, while acknowledging the challenges and risks by comparing how fast we've had to adopt AI to "running with scissors."

Running with scissors

I first heard the expression "Running with scissors" in the title of Augusten Burroughs' memoir. I enjoyed reading that book, and now I am listening to the audiobook while working on this blog post. A subtle takeaway from the memoir is that sometimes you may find yourself "running with scissors' involuntarily (or voluntarily), and you have to decide how to handle that scenario.

Related to AI, "running with scissors" captures the extremely fast, collectively exceptional pace we're in: a remarkably massive societal shift, comparable to the Industrial Revolution, is unfolding. The Industrial Revolution took decades to unfold, whereas the AI Revolution is unfolding in a few years, especially among software developers.

Read more

Shared code creates shared security needs. European product rules raise a more specific question: who must act?

Importing content with the Default Content module is really useful when populating a site with content. There's an increasing number of recipes and modules that can be used to populate a site with content either for setup or demonstration purposes.

Default content is really useful when figuring out how a system works as it can show relationships between content types that are not always simple to discern through the site itself. It also has a place when deploying content between sites as you can package up some default content and include that in a deployment step.

Occasionally, you'll want to tweak the content that is imported for different situations; with the reasons why you would want to do this being numerous. It might just be that you have a demo site and you wanted to tweak the content imported to better tailor it for the user. You could have a single recipe that contains the content and want to alter that for a specific demo.

I needed to do this selected default content import on a recent site as I was installing. A contributed module was used to populate the site with content to create a collection of examples. Although the content was good, I didn't want to import it all as some of it didn't make sense for a couple of scenario that I was looking at. That lead me to seeing if I could alter the content automatically as it was imported into the site, rather than manually delete content after the fact.

In this article we will look at some of the actions I tried to prevent content from being imported, before moving onto what the actual solution was. If you are following along at home, it is assumed that you already have a default content process setup and are just looking for change what content is imported without altering the source files.

Read more

Drupal's Form API comes with built-in tooling to allow any form element to initiate a submission. When combined the support for returning HTML fragments in htmx 4, it's very easy to make an interactive form for your users.

Drupal Meets Matrix part 2: Live Comments with ECA and HTMX John Locke Sat, 10/10/2026 - 12:00

A comment thread in Drupal works totally fine. You fill in a form, click submit, and your comment gets posted. Same way it has for over 20 years.

But if somebody else replies when you're on the page, you don't see anything change, you don't get any notification.

Read more

Read more

Opening DrupalCon, a summit

DrupalCon Rotterdam: building Drupal’s AI future together

drupalSaturday, October 10, 2026 - 19:41

Can it be all so simple? Migrating a 13-year-old WordPress blog to Drupal CMS Image

Can it be all so simple? Spoiler: no, it can't. But it was fun.

Can It Be All So Simple (CIBASS for friends, and yes, the name comes from the Wu-Tang Clan song) is a Spanish blog about cinema, music, comics, TV series and culture that has been publishing since 2013. Some friends started it, and later a bunch of others joined, including me. I ended up hosting it and doing its maintenance for years. And we even ended up earning an award.

It ran on WordPress all that time. Maintenance was painful. In 2021, I alleviated part of that pain by migrating it to roots/bedrock and managing updates with Composer, but still, I wanted to migrate it to Drupal at some point. If you explore its contents, you will end up finding quite a few articles written by Drupal people. 

On October 1st, 2026, thanks to Drupal CMS 2.2.0 and its multilingual support improvements, that could finally happen. Even if activity on the blog has been at its lowest, I still wanted to do that to keep the site online with minimal maintenance, while I refuse to accept that the project is almost dead. 

Read more

A customer submits a web enquiry. Someone reads it, copies the details into the CRM and asks for missing information. When that happens every day, enquiry preparation is a useful place to test whether AI can save time. Choose one task with a clear finish line AI business process automation becomes easier to evaluate when the task has a defined start and end. For a web enquiry, it starts with submission and ends when the responsible person has checked the information and knows the next action. Our recommendation is to begin with a summary, a suggested category and a draft response. A person approves prices, delivery dates and commitments. This gives the team a bounded task whose time savings can actually be measured. The approach may suit a manufacturer receiving descriptive quotation…

Drupal is changing how developers organize some of the code behind your website. Here’s what the transition means for custom functionality, theme maintenance, and planning your next upgrade.

So, Where Have I Been? 🧭

It's been about 10 months (!) since the last article. Most of that time went into my work at Dropsolid as an AI Product Architect. I've participated in the design, building, and maintaining the AI infrastructure: inference, models, guardrails, tracing, vector stores, and their integrations with Drupal. Quite a few moving parts - plus, some participation in the Drupal AI community, which was a fun process but definitely took some time ⏳.

Meanwhile, we secured €2.5 million in financing at Dropsolid AI. There was a lot happening on that side, and moving NicheBench forward alongside it was harder than I expected 💢.

The hardware was another limit. Progress with one GPU was difficult, and even after adding a second one, running a model through the new benchmark could tur...

Read the Full Article

Henadzi Koltun argues that Drupal’s value lies in durable engineering rather than short-term gains. He discusses when headless architecture is justified, why AI still needs human oversight and how accessibility becomes an organisational responsibility.

During the lifecycle of a Drupal site, content changes and the site evolves, requiring content maintenance. One of the issues that can happen is redirect chains. Why Drupal sites accumulate hundreds of redirect chains

A Drupal site with many years of life, one or more migrations, or frequent content changes accumulates redirects automatically. Every alias change and every moved page leaves one behind, until there are hundreds or even thousands of them. A new project gets there too once content starts to be created, redirects added, and URLs moved.

The problem is silent. Nobody decides to create a redirect chain; chains appear when redirects pile up on top of each other over time. Reviewing them manually is unfeasible because of the time it would take, so they stay. These situations usually surface in audits run with different tools: until that moment they go unnoticed.

Redirect chains and loops cost performance, SEO, and dead pages

A redirect chain is several hops in a row: a → b → c → d. Each additional hop increases navigation latency for users and makes crawling harder for search engines. Keeping every redirect at a single hop contributes to better SEO.

Googlebot follows up to 10 hops in a chain before giving up, but …

Pierre Rudloff, Joseph Zhao, Bram Driesen and Swan Kalata have moved from provisional to full membership of the Drupal Security Team. Their public records show experience in vulnerability reporting, fixes, advisory coordination, core contribution and community leadership.

Today we are talking about Drupalcon Rotterdam, Canvas and evaluating modules. We'll also cover Revision Graph as our module of the week.

For show notes visit: https://www.talkingDrupal.com/573

Read more