Feed aggregator

Build a reliable local Drupal environment with DDEV. Follow the steps to start a new site, import an existing project, and export the code, database, and uploaded files needed to recreate it elsewhere.

Working with AI, developer Brandon Thomas says he has recreated seven Adobe applications as open-source alternatives through ArtCraft. His pitch promises familiar tools without subscriptions, with code people can inspect, modify and keep. For users frustrated by proprietary terms, the attraction is a credible alternative they can make their own.

Credibility takes time to establish. PhotoCraft’s documentation describes an early alpha that is not yet a Photoshop replacement for daily professional work. Its future usefulness will depend on continuing improvements, compatibility and support, alongside the freedom its licence provides.

Drupal founder Dries Buytaert explains that distinction in his essay on licence-only and stewarded open source. Both are open source, but stewardship adds an ongoing commitment to the software and the people who depend on it. Maintainers fix failures, coordinate releases and respond to security issues, while organisations help fund the infrastructure and continuity that adoption requires.

Drupal illustrates why that continuing care matters. Its community and supporting organisations sustain a shared platform that users can retain while choosing different providers to host, extend or support it. The opportunity for new AI-built alternatives is to develop comparable continuity around their code. Established projects, including Drupal, must keep demonstrating that their stewardship delivers dependable software and meaningful choice.

Read more

Website teams can generate new pages faster than they can govern them. Pantheon's P1 beta tests a different approach to sharing that responsibility.

The image above shows me holding a plant that represents a small piece of code or an idea I want to share with someone else. To me, sharing code feels like planting something in someone else's garden. The analogy of open-source code and projects as plants and gardens appeals to me because plants are organic and essential to sustaining life, and the gardens we plant require significant planning and care. Open-source contributions come in all shapes and sizes, like gardens and the plants they hold, and both need maintenance. Some gardens require more maintenance than others.

My past two posts/tales focused on building and maintaining a Drupal module using AI, and now I want to discuss contributing to a module using AI. To continue my garden analogy, the projects I maintain are like my personal gardens.

Personal garden

By building and maintaining a Drupal module, I have control over my personal garden, but it exists within a community of gardens. I can decide which code/plants stay or go. Ultimately, I am responsible for the health of the project/garden. My project/garden is part of the Drupal gardens community (pun/irony intended). I am hyper-aware of the Drupal community where my Drupal garden lives.

Read more

An AI-generated video that looks real has to be declared to the people watching it, and on a site the declaration has to be both on the page and inside the file. Here I follow how AI Disclosure, the module I created on drupal.org within the Drupal AI Initiative, does it. Images have an article of their own, and so does audio. A video needs a label when it is a deep fake: when it credibly shows a person, a place, an object or an event that exists or could exist, and whoever watches it would take it as real. A synthetic avatar presenting a company's results falls within it, if the viewer mistakes it for a real person. A cartoon or a clearly fictional video keeps the label in a lighter form, next to the video rather than on it. The obligation falls on the publisher, under Article 50(4) of the AI Act, and it applies from 2 August 2026.

Six hats off to DrupalCon Rotterdam

Most of the year my six hats take turns. At DrupalCon they all show up at once, and I end up wearing a "hat tower". Rotterdam last month was an absolute whirlwind again, and I came home tired but buzzing with energy. Here is the view from under each hat.

Gábor Hojtsy Sat, 10/17/2026 - 18:02

There’s an incredible amount of things happening in the world of Drupal and AI. It’s very exciting, but almost impossible to keep up with. I’d been planning for a while to seriously dive into agentic coding. I feel a little late to the party, but at the same time, I get the impression that many organizations haven’t got the faintest idea that this revolution is happening.

Until now, I’d mainly been experimenting with frontier models like ChatGPT and Claude through their AI chat interfaces. But I’ve finally found the time to take the plunge into agentic coding myself.

Get to know Drupal CMS, Canvas and Mercury for rapid prototyping Description At my day job, we recently had a client who wanted to bring us a project but had to persuade a large group of stakeholders. I was able to create a functioning version of the site they described in less than 2 hours. admin Fri, 16 Oct 2026 - 17:43

At my day job, we recently had a client who wanted to bring us a project but had to persuade a large group of stakeholders. I was able to create a functioning version of the site they described in less than 2 hours.

BigCommerce is a SaaS platform that has earned its reputation with B2B sellers. Its B2B Edition handles selling with quotes, its catalog supports far more product options than most SaaS platforms, and its open APIs make it friendlier to integrations than many of its competitors. If your business fits neatly inside its walls, it's a legitimate choice. Many distributors and manufacturers have found success on the platform.

The trouble starts when your requirements don't match the platform's assumptions. Its best B2B features sit behind the top-tier plan. Gross Merchandise Value (GMV) caps force automatic upgrades as you grow. A new fee introduced in June 2026 charges a percentage on orders processed through non-embedded gateways, including offline payments like purchase orders. And when your order workflows, product types, or integrations go beyond what the platform anticipated, you're forced to work around BigCommerce rather than with it.

Drupal Commerce is an open-source alternative built on Drupal. You own the code and the data, there are no license or transaction fees, and every part of the platform, from checkout to order workflows to the product data model, can be shaped to fit how your company already works.

Read more

Today we are talking about the UN, Open Source, and Drupal with guests Tim Lehnen & Henry Poole. We'll also cover Live Update as our module of the week.

For show notes visit: https://www.talkingDrupal.com/574

Read more

A tool that tracks every pull request, pipeline and local site can quickly become another source of noise. DevDeck's developer decided the answer lies in how loudly it speaks, not what it hides.

Join us THURSDAY, October 15 at 1pm ET / 10am PT, for our regularly scheduled call to chat about all things Drupal and nonprofits. (Convert to your local time zone.)

We don't have anything specific on the agenda this month, so we'll have plenty of time to discuss anything that's on our minds at the intersection of Drupal and nonprofits. Got something specific you want to talk about? Feel free to share ahead of time in our collaborative Google document at https://nten.org/drupal/notes!

All nonprofit Drupal devs and users, regardless of experience level, are always welcome on this call.

This free call is sponsored by NTEN.org and open to everyone.

Information on joining the meeting can be found in our collaborative Google document.

My website has a custom photo album module that I've maintained for about twenty years. It helps me manage more than ten thousand photos. In my DrupalCon Rotterdam keynote, I talked about making that module work with AI assistants. You can watch that part of the keynote. I didn't have time on stage to go into the details, so I'm doing that in this post.

To let assistants find and edit my photos, I used the contributed Tool module, which provides Tool API, to expose my module's operations as tools. These include finding photos and updating a photo's caption or alt text.

Most of these tools are public methods on Drupal services I already had, like the one that searches my photos. A few PHP attributes are usually enough for Tool API to expose an existing method, so AI assistants can call it over MCP, the Model Context Protocol.

To describe a tool to other software, Tool API needs to know what data it accepts and returns: what each value is called, what type it is and what it means.

My album module doesn't store photos as Drupal entities (I know, I know), so Drupal has no field definitions for them. Instead, it keeps them in its own database table and loads each photo into an instance of Image, a plain PHP class. I added PHP attributes to the getters for the properties I wanted to expose, like this one for the alt text:

Read more

Headers and hero sections often change between mobile and desktop layouts. Faster first paint depends on which styles a site sends first.

Drupal 11.4.10 addresses three core security vulnerabilities, including a critical remote code execution flaw. Site owners should prioritize the appropriate core update and check whether separate Gin or Entity List updates also apply.

Try the Drupal AI demo! The Drupal AI demo was unveiled at DrupalCon Rotterdam. It showcases how you can use AI in your Drupal site right now. Darren Oh Wed, 10/14/2026 - 14:59

Tags

• Drupal
• Drupal Forge

• Read more about Try the Drupal AI demo!
• Log in or register to post comments

Project: Drupal coreProject machine name: drupalDate: 2026-October-14Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross-site scriptingAffected versions: >= 10.3.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2CVE IDs: CVE-2026-108514Description: 

The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission.

Solution: 

Install the latest version:

Drupal 11

• If you use Drupal 11.4.x, update to Drupal 11.4.10.
• If you use Drupal 11.3.x, update to Drupal 11.3.19.
• Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

Read more

Project: Drupal coreProject machine name: drupalDate: 2026-October-14Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:UncommonVulnerability: Cross-site scriptingAffected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2CVE IDs: CVE-2026-108515Description: 

The Drupal core Link module provides a field type that can be used for internal and external URLs.

The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities.

Solution: 

Install the latest version:

Drupal 11

• If you use Drupal 11.4.x, update to Drupal 11.4.10.
• If you use Drupal 11.3.x, update to Drupal 11.3.19.
• Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

Read more

Project: Drupal coreProject machine name: drupalDate: 2026-October-14Security risk: Critical 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Remote code executionAffected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2CVE IDs: CVE-2026-108097Description: 

A remote code execution vulnerability exists within the Field UI module in Drupal core.

The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality.

The vulnerability can be mitigated by uninstalling the core Field UI module (field_ui), which will provide protection while sites are updated.

Drupal Steward protection:

This issue is being protected by Drupal Steward. Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered.

Solution: 

Install the latest version:

Drupal 11

Read more