Planet Drupal

As we work with our consulting clients on site-builds, we are often asked to include modules related to newsletters and analytics. Sometimes, our clients don't fully understand the ramifications of adding external scripts to their sites, so we end up having a larger data privacy discussion. In most cases, we recommend to our clients that they limit external embeds and scripts on their site mainly in the interest of user privacy. We figured it was about time that we took a closer look at our own site. With that in mind, we recently made the decision to remove most 3rd-party embeds and tracking scripts from this site with a few exceptions: Our Mautic marketing automation system (which we self-host and completely control.) Termageddon (affiliate link) content for our Terms of Service and Privacy Policy pages. Embedded YouTube videos. We have removed: All embedded EventBrite forms (which we haven't used in a very long time!) All references to Mailchimp (again, we haven't used it in a long

When AI design tools started reading codebases to learn a design system, we wanted to know what Mixtape looked like through that lens. 

by rikki.bochow / 18 October 2026

It turned out "well documented for humans" and "legible to an agent" are two different things. Closing the gap surfaced bugs that had been shipping silently for months.

Three years ago we modernised Mixtape's CSS for the browser: cascade layers, container queries, modern selectors. Since then, we've also converted to Web Components, full Typescript and integrated some more modern CSS. The system got easier for developers to read and extend. What we didn't anticipate was that the next reader wouldn't be a developer at all.

In April 2026, Anthropic launched Claude Design. This tool reads a codebase during onboarding to build a model of its design system, then uses that model for every prototype it generates afterward. The same would apply to v0, Bolt, and anything else that learns a design system by reading it rather than receiving human guidance. We wanted Mixtape to onboard well.

Documented for humans isn't the same as legible to an agent

We did a full pass over the codebase in March. We worked on the assumption that AI tools generally would need something more literal than what we had before Claude Design existed as a specific thing to test against. What came out of that work was a central /docs folder covering everything from Component Architecture, Memory Management and Security to Code Quality and Troubleshooting.

Read more

Six hats off to DrupalCon Rotterdam

Most of the year my six hats take turns. At DrupalCon they all show up at once, and I end up wearing a "hat tower". Rotterdam last month was an absolute whirlwind again, and I came home tired but buzzing with energy. Here is the view from under each hat.

Gábor Hojtsy Sat, 10/17/2026 - 18:02

There’s an incredible amount of things happening in the world of Drupal and AI. It’s very exciting, but almost impossible to keep up with. I’d been planning for a while to seriously dive into agentic coding. I feel a little late to the party, but at the same time, I get the impression that many organizations haven’t got the faintest idea that this revolution is happening.

Until now, I’d mainly been experimenting with frontier models like ChatGPT and Claude through their AI chat interfaces. But I’ve finally found the time to take the plunge into agentic coding myself.

Get to know Drupal CMS, Canvas and Mercury for rapid prototyping Description At my day job, we recently had a client who wanted to bring us a project but had to persuade a large group of stakeholders. I was able to create a functioning version of the site they described in less than 2 hours. admin Fri, 16 Oct 2026 - 17:43

At my day job, we recently had a client who wanted to bring us a project but had to persuade a large group of stakeholders. I was able to create a functioning version of the site they described in less than 2 hours.

BigCommerce is a SaaS platform that has earned its reputation with B2B sellers. Its B2B Edition handles selling with quotes, its catalog supports far more product options than most SaaS platforms, and its open APIs make it friendlier to integrations than many of its competitors. If your business fits neatly inside its walls, it's a legitimate choice. Many distributors and manufacturers have found success on the platform.

The trouble starts when your requirements don't match the platform's assumptions. Its best B2B features sit behind the top-tier plan. Gross Merchandise Value (GMV) caps force automatic upgrades as you grow. A new fee introduced in June 2026 charges a percentage on orders processed through non-embedded gateways, including offline payments like purchase orders. And when your order workflows, product types, or integrations go beyond what the platform anticipated, you're forced to work around BigCommerce rather than with it.

Drupal Commerce is an open-source alternative built on Drupal. You own the code and the data, there are no license or transaction fees, and every part of the platform, from checkout to order workflows to the product data model, can be shaped to fit how your company already works.

Read more

Today we are talking about the UN, Open Source, and Drupal with guests Tim Lehnen & Henry Poole. We'll also cover Live Update as our module of the week.

For show notes visit: https://www.talkingDrupal.com/574

Read more

A tool that tracks every pull request, pipeline and local site can quickly become another source of noise. DevDeck's developer decided the answer lies in how loudly it speaks, not what it hides.

Join us THURSDAY, October 15 at 1pm ET / 10am PT, for our regularly scheduled call to chat about all things Drupal and nonprofits. (Convert to your local time zone.)

We don't have anything specific on the agenda this month, so we'll have plenty of time to discuss anything that's on our minds at the intersection of Drupal and nonprofits. Got something specific you want to talk about? Feel free to share ahead of time in our collaborative Google document at https://nten.org/drupal/notes!

All nonprofit Drupal devs and users, regardless of experience level, are always welcome on this call.

This free call is sponsored by NTEN.org and open to everyone.

Information on joining the meeting can be found in our collaborative Google document.

My website has a custom photo album module that I've maintained for about twenty years. It helps me manage more than ten thousand photos. In my DrupalCon Rotterdam keynote, I talked about making that module work with AI assistants. You can watch that part of the keynote. I didn't have time on stage to go into the details, so I'm doing that in this post.

To let assistants find and edit my photos, I used the contributed Tool module, which provides Tool API, to expose my module's operations as tools. These include finding photos and updating a photo's caption or alt text.

Most of these tools are public methods on Drupal services I already had, like the one that searches my photos. A few PHP attributes are usually enough for Tool API to expose an existing method, so AI assistants can call it over MCP, the Model Context Protocol.

To describe a tool to other software, Tool API needs to know what data it accepts and returns: what each value is called, what type it is and what it means.

My album module doesn't store photos as Drupal entities (I know, I know), so Drupal has no field definitions for them. Instead, it keeps them in its own database table and loads each photo into an instance of Image, a plain PHP class. I added PHP attributes to the getters for the properties I wanted to expose, like this one for the alt text:

Read more

Headers and hero sections often change between mobile and desktop layouts. Faster first paint depends on which styles a site sends first.

Drupal 11.4.10 addresses three core security vulnerabilities, including a critical remote code execution flaw. Site owners should prioritize the appropriate core update and check whether separate Gin or Entity List updates also apply.

Try the Drupal AI demo! The Drupal AI demo was unveiled at DrupalCon Rotterdam. It showcases how you can use AI in your Drupal site right now. Darren Oh Wed, 10/14/2026 - 14:59

Tags

• Drupal
• Drupal Forge

• Read more about Try the Drupal AI demo!
• Log in or register to post comments

Project: Drupal coreProject machine name: drupalDate: 2026-October-14Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross-site scriptingAffected versions: >= 10.3.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2CVE IDs: CVE-2026-108514Description: 

The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission.

Solution: 

Install the latest version:

Drupal 11

• If you use Drupal 11.4.x, update to Drupal 11.4.10.
• If you use Drupal 11.3.x, update to Drupal 11.3.19.
• Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

Read more

Project: Drupal coreProject machine name: drupalDate: 2026-October-14Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:UncommonVulnerability: Cross-site scriptingAffected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2CVE IDs: CVE-2026-108515Description: 

The Drupal core Link module provides a field type that can be used for internal and external URLs.

The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities.

Solution: 

Install the latest version:

Drupal 11

• If you use Drupal 11.4.x, update to Drupal 11.4.10.
• If you use Drupal 11.3.x, update to Drupal 11.3.19.
• Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

Read more

Project: Drupal coreProject machine name: drupalDate: 2026-October-14Security risk: Critical 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Remote code executionAffected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2CVE IDs: CVE-2026-108097Description: 

A remote code execution vulnerability exists within the Field UI module in Drupal core.

The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality.

The vulnerability can be mitigated by uninstalling the core Field UI module (field_ui), which will provide protection while sites are updated.

Drupal Steward protection:

This issue is being protected by Drupal Steward. Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered.

Solution: 

Install the latest version:

Drupal 11

Read more

A council-developed publishing platform has completed an international standards review. Two initially unmet requirements reveal what the assessment demanded.

Drupal 11.4.9 addresses a shifting navigation sidebar, updates CKEditor 5, and makes editor toolbar configuration more flexible through recipes. Here’s what the release means for content teams, developers, and site owners.

We read all 462 case studies on drupal.org and coded every migration that says how long it took. Median: 7.5 months from kickoff to launch. Small relaunches took weeks; multi-site platforms took a year or more.