Feed aggregator

We analyzed 79 months of Chrome UX Report field data covering every Drupal and WordPress site Google measures — 2.9 million origins in July 2026 alone. Drupal has led on Core Web Vitals in every single month since 2020, and the entire gap traces to one metric. The numbers, the honest caveats, and what to fix on whichever platform you run.

A training day can introduce a workflow. Thursday's speakers are asking what happens when Drupal systems must survive staff turnover or move content safely between environments.

Waiting for your hosting panel to grow a Drupal CMS platform? The wait ended in late 2025: it has been running on Ægir for many months, rebuilt from the upstream Composer template as BOA releases ship, tracking the version the Drupal project currently publishes. Enabling it is one symbol in a platform list your account already carries, installing a site on it is the usual short panel task, and one honest warning applies: the interactive browser wizard does not run here, the complete package installs unattended, and the deliberately plain front page it greets you with is exactly what a healthy install looks like. From that minute the machine treats it as a normal Drupal 11 site: nightly backups, one-task HTTPS, cloning, Drush, and calm platform-to-platform updates by design – on a server where Pressflow 6, Drupal 7 and Backdrop veterans still serve next door, because continuity here means the whole line stays alive at once.

In April 2022 I wrote about decoupling configuration with Config Pages, and ended it with a guess at where I'd go next:

One of my future experiments with Druxt will be to look at the options of using the Drupal Consumers module alongside Drupal theme settings as a solution.

That experiment is now a module. Decoupled Settings serves the site and theme configuration Drupal already holds over JSON:API, and lets every frontend override just the values it needs. It went up on Drupal.org this week.

Core's JSON:API is an entity API. Content entities and config entities alike, so node types, image styles and views are all in there. What it has never exposed is simple configuration, and there's a good argument that it shouldn't by default, because plenty of what sits in system.site is nobody's business.

But a decoupled frontend still needs the boring stuff:

• The site name, for the document title
• The slogan
• The logo and the favicon
• The front page path, so the router knows what "home" means

So every decoupled build solves it locally, and most of the ways to solve it end up keeping a second copy of the site name somewhere.

Continue reading →

I added a new feature to my blog: a list of related posts at the bottom of each post. I implemented it using embeddings, and this note documents how.

I looked at how other content management systems identify related posts: most use shared tags, backlinks, manual curation, or embeddings. I chose embeddings, which compare the meaning of each post, because they can uncover connections without shared tags, existing links, or manual curation.

Embeddings turn meaning into numbers

An embedding model reads text and returns a vector: a long list of numbers. The model I use, bge-base-en-v1.5 from the Beijing Academy of Artificial Intelligence (BAAI), returns 768 numbers for each post. I started with a smaller model that returns 384 numbers and moved up because the matches were better. BAAI's own benchmarks point the same way, though the gap is modest.

You can think of those 768 numbers as coordinates in a high-dimensional meaning space, where each dimension captures some pattern the model learned from text. For one of my posts, the first handful of those coordinates looks something like this:

[ 0.021, -0.045, 0.038, -0.012, 0.007, ..., 0.019 ]   (768 numbers total)

Conceptually, it is a bit like tagging each blog post with hundreds of auto-generated tags, except that these tags are unnamed (they are just numbers) and distributed (meaning is spread across all of them). Together, the 768 numbers place the post near other posts with similar meaning.

This is what lets two posts match even when they use different words. During training, the model learns that certain words and phrases appear in similar contexts or play similar roles, so it places them near each other in the space. It does not need "car" and "automobile" to share any letters to learn that they are used in related ways.

Read more

A tool to painlessly update a heavily patched Drupal site

Picture a Drupal 10.6 website with a several months stale composer.json: 120 contrib modules, 47 patches. You need to update it to Drupal 11.4. Many hours will be spent checking  I don't want to deal with this several times a year so I improved the Drupal-Code-Query MCP server with a few more tools. 

theodore August 26, 2026

Take Away Moshe Weitzman, Sr. Architect & Project Lead at Tag1 and the first American to contribute to the Drupal platform, attended LaraCon US 2026 in Boston and shares the concrete takeaways.

Laracon US came to my hometown of Boston this year, and a few weeks later I'm still glowing. Here are the moments that stuck with me.

Whimsy-Driven Development

My favorite session was Whimsy-Driven Development by Christina Martinez. Watch it if you want to rekindle the joy of building software. We can build anything we can imagine today, and Christina gives us permission and encouragement to do exactly that. I joined her Silly Software Club on the spot. I haven't built any silly software yet, but I did make a silly image announcing my blended family's upcoming vacation to Mexico.

Moshe's family beach photo, mariachi-style: sombreros, guitars. Akumal 26' Mas guacamole por favor.

Read more

For Drupal sites with logged-in experiences, the integration can use existing user attributes to segment journeys and activity, extending Rybbit beyond anonymous traffic reporting.

Building a Drupal module? We built Module Scout that uses AI to search Drupal.org’s live project directory and help you find existing modules before you start from scratch.

On 19 August 2026, the Drupal.org security advisory page included several contributed projects that the security team marked unsupported because of known security issues. That is not just another update notice. A site owner needs to know whether the module is used on their site and what to do when there is no fixed release. On 19 August 2026, the Drupal.org security advisory page listed several contributed projects that were marked unsupported because of security issues. Examples included Screenshot, Link content parser and Gammu SMS Daemon. A week earlier, advisories also included Quick Tabs, External Authentication, Entity Share Websub, Diff and Commerce PayPal. Not every advisory affects every Drupal site. Some modules are very specific. Some risks apply only under certain…

If AI can build an application from a simple description, why do we still need software developers?It is a question I have been thinking about recently. AI can now generate code, create interfaces, work with databases, connect APIs and turn an idea into a working prototype surprisingly quickly. I use AI in my own development work, and it has changed the way I build things. Tasks that once took hours can often be completed much faster, and experimenting with new ideas has become much easier.

No one decides to have an inconsistent university website. It happens one reasonable decision at a time: a department needs a page and the central team is booked, so a local admin builds it. A lab hires a student to make something "more modern." A program office, tired of waiting, spins up a page builder subscription on a corporate card. Each choice makes sense in the moment. Sum a decade of them across two hundred departments, and you get the site every university web team recognizes: thousands of pages, dozens of visual dialects, and a governance document nobody has opened since it was ratified.

A DAM decision changes more than where images are stored. Drupal teams also have to decide which system owns metadata, approvals, transformations, rights, and the published asset lifecycle.

For most of the web’s history, we have designed digital experiences around a simple assumption: a person will visit our website. That person might arrive through a search engine, follow a campaign link, scan a QR code, or maybe even type the URL into their browser.

AI is changing that... dramatically and rapidly!

People are now asking AI assistants to research products, compare services, explain policies, recommend suppliers and complete tasks on their behalf. Sometimes, they might not even consciously choose AI and are simply guided by seemingly familiar tools like Google 'AI Overviews'. Either way, instead of visiting ten websites, a customer may ask one assistant to gather the relevant information and present a recommendation. 

In the near future, that AI assistant could be doing more than reading a web page: checking product availability, requesting information, preparing an application, arranging an appointment or even completing a transaction.

Your next website visitor may not be a person at all, but an AI agent acting on their behalf, which raises a serious question:

Can AI systems understand our organisation, trust our information and interact with our services safely?

Getting to know your new audience

To be useful, AI assistants need to find the right information, understand its meaning and decide whether it is current and trustworthy.

A prospective student asking an assistant to compare courses across several universities, a buyer requesting a shortlist of products that meet detailed technical, ethical and budget requirements - both are now part of your website’s audience.

While human visitors use navigation, page layouts, graphic cues and calls to action, AI systems depend more heavily on structured information, descriptive metadata, clear relationships and reliable access to data.

Read more

The closest thing I have to an answer Imagen Connecting systems isn't hard anymore, so what matters is what you put in the middle. I think that separates into knowledge, decisions, and the terrain those decisions run on, and the thing you'd actually be building is whatever keeps all three true.

Read more

Article by:  Martin Anderson-Clutz. Originally posted on the Acquia blog.

Drupal turns decoupled architecture into a governed AI harness, combining live visual editing with agent-ready content schemas.

Back in March, at EvolveDigital in Toronto, I ran into Preston So. He mentioned that the team behind Decoupled Days was looking for speakers, and that this year the event would be in Montréal. I was interested right away. Drupal Canvas is the most compelling answer I have seen to a problem that has followed decoupled architectures for years, and I wanted that message to reach beyond the Drupal faithful — out to the practitioners who live and breathe headless every day.

The talk I ended up giving was not really about a content management system at all. It was about how Drupal has quietly become something else: a governed harness for artificial intelligence. Here is the argument I made, the demo that seemed to land hardest with the room, and why I think 2026 is the year the trade-offs of going headless finally stop being trade-offs.

Read more

The latest three projects have limited reported use, but the pattern extends beyond their reach. For affected site teams, the recurring security response is to uninstall the project rather than install an update.

This week's release of Drupal AI Context Beta 4 added taxonomy-based context selection, priority controls, workflow states, and token-budget visibility. Kristen Pol, primary maintainer of Context Control Center, said the project is moving towards its first release candidate, while Drupal.org release notes list 70 credited issues in the beta. The additions put more structure around deciding what information reaches an AI agent before it acts.

The release arrived as Drupal founder Dries Buytaert was asking a broader question about what happens when AI makes code cheaper to produce. In a 17 August 2026 blog post, Dries argued that as application functionality becomes easier to recreate, commercial value may shift towards dependable operation: deployment, security, scaling, monitoring, and reliable service over time. His argument is about software economics rather than AI context, but it points to the same larger change: implementation is no longer the only scarce input.

The DropTimes' 18 August interview with Kristen showed where that shift meets Drupal AI. Context Control Center can use moderation, revisions, permissions, scheduling, and scopes to govern the knowledge supplied to a model, but those controls cannot guarantee how the model will respond. Requirements that cannot tolerate probabilistic behaviour still need deterministic rules, validation, access controls, or human approval.

Read more

DDEV's generic project type will run anything that brings its own web server, and people already use it for Node and other stacks. Umbraco is a less-travelled case: .NET, Kestrel, and SQL Server. I wanted to know how much of the DDEV experience still holds up there. Clone a repository, run one command, have a working site and database a few minutes later.

Most of it holds up. The result is umbraco-clean-ddev, which runs Umbraco on .NET 10 with SQL Server and Adminer, and gets a new developer going with a single ddev start. What took the time was a handful of places where DDEV expected something I had not worked out yet.

What I wanted out of it

I wanted four things out of this, and nothing more ambitious than that.

1. One command for someone joining the project
2. Nothing installed on my own machine: no SQL Server, no .NET SDK, none of the project's other dependencies.
3. Projects that stay out of each other's way.
4. A way to take a backup from Umbraco Cloud and debug against it locally.

DDEV already does all of this elsewhere. The Umbraco Cloud backup turned out to be the least transferable: ddev import-db and ddev export-db work on the database container DDEV manages, and this project omits that container entirely. Anything equivalent I would have to write myself.

Keeping the dependencies off my machine also makes the project easier to hand to someone who has never worked with .NET. The SDK and SQL Server both live in containers, so trying Umbraco does not start with installing either of them locally. Clone the repository, run one command, and the CMS is there to look at.

Read more

Nineteen months after Drupal 7's final end of life, 29.7% of all Drupal websites still run it — and half the Drupal web runs a version with no security support. The numbers, the methodology, and the four ways out. Updated quarterly.