Planet Drupal

When a company sells under several brands, someone eventually asks the obvious question: why can't customers put products from every brand into one cart and check out once?

It sounds like a small improvement to the shopping experience, but it isn’t a small feature. A shared cart between brands, on Drupal Commerce at least, is relatively easy, assuming each brand runs from the same Drupal installation. 

But that’s only half of the story. What happens after the order is placed? The hard part of a shared cart experience is everything after checkout, especially fulfillment.

How the cart works by default

In a multi-brand Drupal Commerce setup, each brand gets its own store entity. A store holds a brand's commerce settings:

• Which merchant account takes the payment
• Which prices and promotions apply
• Which payment methods are available

Once something like Commerce Store Domain is installed and configured, a shopper's cart belongs to the store of the brand they're browsing.

Read more

What makes a healthcare website HIPAA compliant on Drupal: the three places patient data gets in, the BAA question, the tracking-pixel rules after AHA v. Becerra, the module stack, and what 46 healthcare Drupal projects actually prioritise.

We're introducing AI Neuron, a module that bridges Drupal with Neuron AI, a PHP framework for building agents, tools and multi-step workflows.

When you’re building AI features in Drupal, the AI module is the obvious place to start. It gives the whole site one place to configure providers and keys, and a default model for each kind of call.

Building an agentic solution means sequencing those calls into something that plans, decides what to do with a tool’s result, and calls another tool in response. The Drupal ecosystem already offers modules for that: AI Agents, ECA, the Tool API. Each gets you part of the way, but what’s left for the developer is gluing them together into one coherent solution. And that’s the hard part: each piece lives in its own module, configured on its own screen, in its own way, which makes iterating on the result, adjusting it, and evaluating it, slow.

What we wanted was one place to drive that development end to end, from a developer’s point of view: write the agent in PHP, iterate on its configuration quickly, and get real observability and evaluation, without ever leaving code to go configure something on a Drupal settings page.

Enter Neuron AI

Neuron AI is a PHP framework for building agents, tools and multi-step workflows. It handles the provider calls, the conversation memory, and the observability a run needs, so what’s left to write is the part specific to what your agent actually does.

Under the hood, five concepts drive it:

Read more

Mercury Editor 3: A Better Visual Editing Experience for Drupal Justin Toupin Wed, 10/21/2026 - 07:29 Drupal Mercury Editor

Last week, I pushed a stable release for Mercury Editor 3. It's been a long time coming, and I'm excited to share a number of new features that make it easier than ever to create and edit structured content in Drupal.

Mercury Editor has always been about making Drupal's powerful content architecture more approachable for editors. Version 3 takes a big step forward, with automatic saving, undo and redo, improved component navigation, and a more refined editing experience.

What's New in Mercury Editor 3

Auto-Save

As you type, add or remove media, reorder fields, and make other changes, Mercury Editor automatically saves your work and updates the live preview. No need to constantly switch between editing, saving, and previewing.

Undo and Redo

Experiment with confidence. Mercury Editor now supports undo and redo, making it easy to try different content arrangements and quickly reverse changes without starting over.

Component Tree View

A new component tree provides an outline of layout sections and components, making it easier to navigate complex pages. Quickly find and select components, even when they're nested several levels deep.

Read more

Audio has no picture to put an icon on, so the European Code of Practice asks for it to be declared by voice. Here I follow how version 1.0.0-beta1 of AI Disclosure, the module I created on drupal.org within the Drupal AI Initiative, does it. Images have an article of their own, and so does video.

Audio needs to be declared when it is a deep fake: when a voice credibly resembles a person who exists or could exist, and whoever listens would take it as real. The Commission's guidelines give exactly this example: a newspaper podcast with the voices of its hosts and a guest cloned to discuss current events. A voice given to a fictional character, in an audiobook or a game, stays out if nobody is misled about who is speaking. Noise reduction or normalisation, which removes interference without changing the words, stays out too.

The obligation falls on the publisher, under Article 50(4) of the AI Act, and it applies from 2 August 2026. The watermark the voice generator puts in the file is the provider's obligation, and a publisher cannot rely on it for their own declaration.

For audio, the final June 2026 version of the Code of Practice asks for a short spoken notice at the start of the deep fake, in plain words, in the language of the content or in English.

Read more

Planning a DNN to Drupal migration? See how Drupal helps government agencies meet WCAG 2.1 AA, Section 508, and ADA Title II rules with stronger web governance.

Date: 2026-October-21Description: 

PHP has announced a critical PHP security release for Wednesday, October 21, 2026, at 14:00 UTC. We recommend that all Drupal site owners reserve time to ensure their PHP version is updated as soon as the release is available.

Site owners are responsible for maintaining the security of their hosting platform

It is the policy of the Drupal Security Team that site owners are responsible for monitoring and maintaining the security of third-party libraries and any non-Drupal components of the application and hosting platform. In rare cases, the Drupal Security Team will post an informational public service announcement (PSA) such as this one, but the remit of the Drupal Security Team remains limited to code hosted on Drupal.org’s systems. Previous PSAs on third-party code in the Drupal ecosystem include:

• External libraries and plugins - PSA-2011-002
• Various Third-Party Vulnerabilities - PSA-2019-09-04
• Third-Party Libraries and Supply Chains - PSA-2024-06-26
• Third-Party Libraries and Supply Chains - PSA-2025-09-17

This post is likely to be updated as the situation evolves and more information is available.

Read more

On 21 October 2026, as scheduled, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. Every PHP installation that serves web requests is in scope: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP security team rates both 9.2 out of 10 (CVSS v4.0) and considers the risk highest for mod_php, where a demonstrated exploit runs before any application code.

In practice, anyone who can reach your site like an ordinary visitor, with no account or password, could run their own commands on your server: read the database, steal passwords and API keys, change pages or install malware. The bugs sit in PHP, the language Drupal and WordPress run on, so updating Drupal or WordPress will not help. PHP runs 69% of websites whose server-side language W3Techs can identify, and the researchers demonstrated attacks against Drupal, WordPress and Joomla. They say temporary web firewall rules do not replace the PHP update.

Read more

PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026. They fix CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell", two vulnerabilities that can let a single unauthenticated request run code on a server. According to PHP's security advisory, every PHP installation that serves web requests is at risk.

TL;DR:

• If you use DDEV only for local development, your DDEV projects aren't affected.
• Update PHP on the servers where your sites are hosted.
• If you use DDEV for casual hosting or ddev share, get the fixed PHP into those projects now, as described below, or upgrade to DDEV v1.25.5, which we hope to release on October 22.

What It Means for Your DDEV Projects

Local development isn't affected because a DDEV project listens only on your own computer, so nobody on the internet can send it a request. A project is exposed in two cases:

Read more

A common interface cannot settle every question about responsibility. Jürgen Haas examines the choices beneath Drupal’s orchestration ambitions.

This post is adapted from the DA Insider, the Drupal Association's monthly newsletter. Subscribe here to get it in your inbox each month.

A note from our CTO

The Drupal Association team is incredibly grateful to have spent time with our community at DrupalCon Rotterdam. Dries Buytaert made one thing clear: Drupal is light-years ahead of its reputation. Our keynotes proved it, and stories from brands like Mars and World Cancer Day showcased Drupal's global power and ability to scale for good, both with cutting edge page building and AI integrations.

We were thrilled to celebrate our International Splash award winners, and the winners of the Women in Drupal award. It's our mission moving forward to expand our recognition for Makers, Patrons, and Advocates across the Drupal ecosystem, and to share Drupal's story beyond our own community.

Thank you to every attendee, speaker, sponsor, volunteer, and contributor who made Rotterdam absolutely unforgettable. We're excited to share what's next.

Tim Lehnen, CTO

DrupalCon Rotterdam Was Everything & More!

This year's event welcomed 876 participants across 46 countries for four days of sessions, summits, workshops, and contribution activities at the Postillion Hotel & Convention Centre WTC Rotterdam.

Read more

Why It’s vital to upgrade, and how to easily move to D11 hassle-free Better a little bit of time & money for an efficient solution, than a lot of time & money for a big problem . Your Drupal site may be one unpatched vulnerability away from trouble. Drupal 7, 8 & 9 no longer receive security updates, and end-of-life for Drupal 10 is around the corner this December. Here’s why it matters. If your site goes unsupported: There aren't community-supported updates for any new vulnerabilities that may come up There aren't community-supported updates for most contrib modules While your site may still be running and your visitors keep browsing, the gap between "working" and "protected" widens Your content, your user data, and your organization's reputation are at risk An unpatched website can become an audit finding in security and compliance reviews The longer you wait to address it, the bigger (and more expensive) the upgrade job becomes. The good news? Fixing it doesn't have to be a long

An AI-generated image can reach a Drupal site with a digital signature attached, and leave it with another one. Three modules sit in between, and each does one job. Here I follow them one by one on a real image, the cover of this article made with ChatGPT, and I say what held up on my test site and where it broke. What an AI image carries and how AI Disclosure, the module I created on drupal.org within the Drupal AI Initiative, labels it is covered in the article on metadata and labels for AI images. Content Credentials reads: it opens the signature of the files an editor uploads and, if it says the file was made with AI, proposes the grade in AI Disclosure. AI Disclosure declares: it keeps the grade the editor confirms, shows the label to readers where the law asks for it and writes the metadata into the copies.

Charter first, price tag later: thoughts on a Drupal Federation Photo by Annie Spratt on Unsplash Jürgen Haas Tue 20 Oct 2026 - 12:50

In May 2025, the Drupal Association proposed an International Drupal Federation under Belgian law. It could unlock European public funding, give Drupal's assets a neutral legal home, and reduce dependence on a single legal system. At its public board meeting in Rotterdam, the DA said it supports the idea but won't drive it. Somebody else has to pull the strings. Jürgen, watching from the outside, sees one trap: every stakeholder starting with "what's in it for us?" and "how much is it?". He suggests two phases. First, write a charter that defines the Federation's objectives, responsibilities, decision-making, legal framework, membership and conflict resolution, with everyone's own stakes left out. Then let each prospective member decide whether to join.

We've spent the last year building an AI-assisted development pipeline for daily use on client projects. Here's what that looks like in practice, and where humans stay firmly in control.

by kim.pepper / 20 October 2026

Whether you're a technical lead at another Drupal agency or a government team new to AI, here's what accountable adoption looks like in practice.

The pipeline: ticket to pull request

Planning 

We ask Claude to review the ticket—Jira or the relevant Drupal.org issue queue—and ask clarifying questions before proposing a plan. We iterate until the developer and AI share the same understanding of what's required.

Implementation

We draw on approximately 30 reusable skills during implementation. Among them is a profiling skill for Drupal performance bottlenecks.

We also connect 2-3 MCP servers depending on the task—typically PHPStorm, Chrome DevTools, and Xdebug for runtime debugging instead of dump statements. A simple grep is often faster than routing a search through an IDE's MCP server, so we default to whichever tool is cheapest and still gets the job done.

Review and test coverage

Before anything nears a pull request, Claude reviews its own code and tests for scope creep and duplication. It also tests whether a slower browser test could be a faster kernel test. 

Quality checks

We run PHPCS, PHPStan, and relevant PHPUnit tests. Claude Code's built-in security-review skill flags vulnerabilities before code goes anywhere near a pull request.

Read more

Build a reliable local Drupal environment with DDEV. Follow the steps to start a new site, import an existing project, and export the code, database, and uploaded files needed to recreate it elsewhere.

Working with AI, developer Brandon Thomas says he has recreated seven Adobe applications as open-source alternatives through ArtCraft. His pitch promises familiar tools without subscriptions, with code people can inspect, modify and keep. For users frustrated by proprietary terms, the attraction is a credible alternative they can make their own.

Credibility takes time to establish. PhotoCraft’s documentation describes an early alpha that is not yet a Photoshop replacement for daily professional work. Its future usefulness will depend on continuing improvements, compatibility and support, alongside the freedom its licence provides.

Drupal founder Dries Buytaert explains that distinction in his essay on licence-only and stewarded open source. Both are open source, but stewardship adds an ongoing commitment to the software and the people who depend on it. Maintainers fix failures, coordinate releases and respond to security issues, while organisations help fund the infrastructure and continuity that adoption requires.

Drupal illustrates why that continuing care matters. Its community and supporting organisations sustain a shared platform that users can retain while choosing different providers to host, extend or support it. The opportunity for new AI-built alternatives is to develop comparable continuity around their code. Established projects, including Drupal, must keep demonstrating that their stewardship delivers dependable software and meaningful choice.

Read more

Website teams can generate new pages faster than they can govern them. Pantheon's P1 beta tests a different approach to sharing that responsibility.

The image above shows me holding a plant that represents a small piece of code or an idea I want to share with someone else. To me, sharing code feels like planting something in someone else's garden. The analogy of open-source code and projects as plants and gardens appeals to me because plants are organic and essential to sustaining life, and the gardens we plant require significant planning and care. Open-source contributions come in all shapes and sizes, like gardens and the plants they hold, and both need maintenance. Some gardens require more maintenance than others.

My past two posts/tales focused on building and maintaining a Drupal module using AI, and now I want to discuss contributing to a module using AI. To continue my garden analogy, the projects I maintain are like my personal gardens.

Personal garden

By building and maintaining a Drupal module, I have control over my personal garden, but it exists within a community of gardens. I can decide which code/plants stay or go. Ultimately, I am responsible for the health of the project/garden. My project/garden is part of the Drupal gardens community (pun/irony intended). I am hyper-aware of the Drupal community where my Drupal garden lives.

Read more

An AI-generated video that looks real has to be declared to the people watching it, and on a site the declaration has to be both on the page and inside the file. Here I follow how AI Disclosure, the module I created on drupal.org within the Drupal AI Initiative, does it. Images have an article of their own, and so does audio. A video needs a label when it is a deep fake: when it credibly shows a person, a place, an object or an event that exists or could exist, and whoever watches it would take it as real. A synthetic avatar presenting a company's results falls within it, if the viewer mistakes it for a real person. A cartoon or a clearly fictional video keeps the label in a lighter form, next to the video rather than on it. The obligation falls on the publisher, under Article 50(4) of the AI Act, and it applies from 2 August 2026.