Feed aggregator

Today we are talking about Security, Vulnerabilities, and how to avoid exposure with guest Dave Welch. We'll also cover Security Scanner as our module of the week.

For show notes visit: https://www.talkingDrupal.com/567

Read more

Open Source is usually described as a licensing model, a development model, or a production model. All three descriptions are useful, but they leave something out. Every Open Source ecosystem is also a cost-allocation system.

Keeping software relevant and dependable requires people to write code, review contributions, prepare releases, investigate security reports, operate infrastructure, write documentation, answer questions, and support upgrades and migrations. Someone always bears those costs.

A proprietary vendor can tie access to payment: every license or subscription sold helps fund developers, security work, infrastructure, and releases.

Open Source breaks the link between access and payment. Anyone can redistribute the software at any price, including zero. Payment is therefore not a condition of using or redistributing it, and those rights do not themselves provide a durable mechanism for funding production and maintenance.

But separating payment from access does not make the costs disappear. Costs are distributed across maintainers, employers, foundations, sponsors, and users. A maintainer may volunteer their time. An employer may pay a developer to contribute. A foundation may operate infrastructure.

Because these costs are distributed rather than collected through a single transaction, they are harder to see and harder to fund.

Technical choices often shape where those costs fall. That allocation is not always deliberate; it can emerge slowly from decisions that were individually reasonable and become visible only years later.

Drupal's update service recently gave me a good example. Drupal sites periodically contact updates.drupal.org to ask whether new versions of Drupal or any installed add-ons are available. Drupal calls these add-ons "contributed projects", such as modules and themes maintained by members of the community.

Read more

Six Small ECA Models That Make Drupal Editors Happy Jürgen Haas Thu 27 Aug 2026 - 17:30

This article introduces six new ECA Guide library recipes that improve the Drupal content editing experience through small, focused changes. They can draft metadata on first save, add access-aware edit links to teasers, prevent invalid dependent select values, offer field-level actions, fill several form fields without saving, and show contextual guidance beside a form. The point is not to apply all six recipes unchanged. They are well-architected starting points for a real editorial irritation. For editors, that means less repeated work and fewer avoidable mistakes. For organisations, it means more consistent content and a practical route to improving the CMS without turning every detail into a custom development project. The article also gives a simple choice: Field Widget Actions for one field, Form API Ajax for several form fields, and HTMX endpoints for nearby content. Production concerns still matter, especially permissions, validation, managed data, and AI review.

Rebuilding a data-driven Drupal site: From ctools plugins to Layout Builder blocks

In the previous post, I described why we chose Layout Builder and how Layout Builder IPE restored the frontend editing workflow we had used with Panels IPE.

With the editing workflow in place, we still had to rebuild the elements that editors placed on their pages.

The Drupal 7 site used custom ctools content type plugins for maps, charts, figures, lists and tables. Editors placed and configured these plugins, while the plugins retrieved the information and rendered the result. I will call both these ctools plugins and the block plugins that replaced them page elements.

berliner Thu, 08/27/2026 - 15:06

Tags

• layout builder
• blocks
• plugins
• architecture

We rounded up 16 Drupal AI modules and sorted them for you. Deploy now, pilot on staging, or just keep an eye on it. Check it out!

Help DDEV Grow: Star Us on GitHub

If you use DDEV, a simple way to mention the project is to star the GitHub repository. Head over to github.com/ddev/ddev↗ and click Star. It takes five seconds, and it can help us — a star count is one of the things new users, sponsors, and and AI check before trusting an open source tool. If you're already a star, thank you!

DDEV IntelliJ/PhpStorm Plugin Lands in the DDEV Org

The DDEV Integration plugin for IntelliJ/PhpStorm↗, maintained by @AkibaAT, has been transferred into the ddev GitHub organization. This was on our 2026 plans list, and it's great to see it land. Awesome maintainer AkibaAT has kept the plugin in excellent shape, and this move gives it a permanent home alongside the rest of the DDEV ecosystem.

Read more

We analyzed 79 months of Chrome UX Report field data covering every Drupal and WordPress site Google measures — 2.9 million origins in July 2026 alone. Drupal has led on Core Web Vitals in every single month since 2020, and the entire gap traces to one metric. The numbers, the honest caveats, and what to fix on whichever platform you run.

A training day can introduce a workflow. Thursday's speakers are asking what happens when Drupal systems must survive staff turnover or move content safely between environments.

Waiting for your hosting panel to grow a Drupal CMS platform? The wait ended in late 2025: it has been running on Ægir for many months, rebuilt from the upstream Composer template as BOA releases ship, tracking the version the Drupal project currently publishes. Enabling it is one symbol in a platform list your account already carries, installing a site on it is the usual short panel task, and one honest warning applies: the interactive browser wizard does not run here, the complete package installs unattended, and the deliberately plain front page it greets you with is exactly what a healthy install looks like. From that minute the machine treats it as a normal Drupal 11 site: nightly backups, one-task HTTPS, cloning, Drush, and calm platform-to-platform updates by design – on a server where Pressflow 6, Drupal 7 and Backdrop veterans still serve next door, because continuity here means the whole line stays alive at once.

In April 2022 I wrote about decoupling configuration with Config Pages, and ended it with a guess at where I'd go next:

One of my future experiments with Druxt will be to look at the options of using the Drupal Consumers module alongside Drupal theme settings as a solution.

That experiment is now a module. Decoupled Settings serves the site and theme configuration Drupal already holds over JSON:API, and lets every frontend override just the values it needs. It went up on Drupal.org this week.

Core's JSON:API is an entity API. Content entities and config entities alike, so node types, image styles and views are all in there. What it has never exposed is simple configuration, and there's a good argument that it shouldn't by default, because plenty of what sits in system.site is nobody's business.

But a decoupled frontend still needs the boring stuff:

• The site name, for the document title
• The slogan
• The logo and the favicon
• The front page path, so the router knows what "home" means

So every decoupled build solves it locally, and most of the ways to solve it end up keeping a second copy of the site name somewhere.

Continue reading →

I added a new feature to my blog: a list of related posts at the bottom of each post. I implemented it using embeddings, and this note documents how.

I looked at how other content management systems identify related posts: most use shared tags, backlinks, manual curation, or embeddings. I chose embeddings, which compare the meaning of each post, because they can uncover connections without shared tags, existing links, or manual curation.

Embeddings turn meaning into numbers

An embedding model reads text and returns a vector: a long list of numbers. The model I use, bge-base-en-v1.5 from the Beijing Academy of Artificial Intelligence (BAAI), returns 768 numbers for each post. I started with a smaller model that returns 384 numbers and moved up because the matches were better. BAAI's own benchmarks point the same way, though the gap is modest.

You can think of those 768 numbers as coordinates in a high-dimensional meaning space, where each dimension captures some pattern the model learned from text. For one of my posts, the first handful of those coordinates looks something like this:

[ 0.021, -0.045, 0.038, -0.012, 0.007, ..., 0.019 ]   (768 numbers total)

Conceptually, it is a bit like tagging each blog post with hundreds of auto-generated tags, except that these tags are unnamed (they are just numbers) and distributed (meaning is spread across all of them). Together, the 768 numbers place the post near other posts with similar meaning.

This is what lets two posts match even when they use different words. During training, the model learns that certain words and phrases appear in similar contexts or play similar roles, so it places them near each other in the space. It does not need "car" and "automobile" to share any letters to learn that they are used in related ways.

Read more

A tool to painlessly update a heavily patched Drupal site

Picture a Drupal 10.6 website with a several months stale composer.json: 120 contrib modules, 47 patches. You need to update it to Drupal 11.4. Many hours will be spent checking  I don't want to deal with this several times a year so I improved the Drupal-Code-Query MCP server with a few more tools. 

theodore August 26, 2026

Take Away Moshe Weitzman, Sr. Architect & Project Lead at Tag1 and the first American to contribute to the Drupal platform, attended LaraCon US 2026 in Boston and shares the concrete takeaways.

Laracon US came to my hometown of Boston this year, and a few weeks later I'm still glowing. Here are the moments that stuck with me.

Whimsy-Driven Development

My favorite session was Whimsy-Driven Development by Christina Martinez. Watch it if you want to rekindle the joy of building software. We can build anything we can imagine today, and Christina gives us permission and encouragement to do exactly that. I joined her Silly Software Club on the spot. I haven't built any silly software yet, but I did make a silly image announcing my blended family's upcoming vacation to Mexico.

Moshe's family beach photo, mariachi-style: sombreros, guitars. Akumal 26' Mas guacamole por favor.

Read more

For Drupal sites with logged-in experiences, the integration can use existing user attributes to segment journeys and activity, extending Rybbit beyond anonymous traffic reporting.

Building a Drupal module? We built Module Scout that uses AI to search Drupal.org’s live project directory and help you find existing modules before you start from scratch.

On 19 August 2026, the Drupal.org security advisory page included several contributed projects that the security team marked unsupported because of known security issues. That is not just another update notice. A site owner needs to know whether the module is used on their site and what to do when there is no fixed release. On 19 August 2026, the Drupal.org security advisory page listed several contributed projects that were marked unsupported because of security issues. Examples included Screenshot, Link content parser and Gammu SMS Daemon. A week earlier, advisories also included Quick Tabs, External Authentication, Entity Share Websub, Diff and Commerce PayPal. Not every advisory affects every Drupal site. Some modules are very specific. Some risks apply only under certain…

If AI can build an application from a simple description, why do we still need software developers?It is a question I have been thinking about recently. AI can now generate code, create interfaces, work with databases, connect APIs and turn an idea into a working prototype surprisingly quickly. I use AI in my own development work, and it has changed the way I build things. Tasks that once took hours can often be completed much faster, and experimenting with new ideas has become much easier.

No one decides to have an inconsistent university website. It happens one reasonable decision at a time: a department needs a page and the central team is booked, so a local admin builds it. A lab hires a student to make something "more modern." A program office, tired of waiting, spins up a page builder subscription on a corporate card. Each choice makes sense in the moment. Sum a decade of them across two hundred departments, and you get the site every university web team recognizes: thousands of pages, dozens of visual dialects, and a governance document nobody has opened since it was ratified.

A DAM decision changes more than where images are stored. Drupal teams also have to decide which system owns metadata, approvals, transformations, rights, and the published asset lifecycle.

For most of the web’s history, we have designed digital experiences around a simple assumption: a person will visit our website. That person might arrive through a search engine, follow a campaign link, scan a QR code, or maybe even type the URL into their browser.

AI is changing that... dramatically and rapidly!

People are now asking AI assistants to research products, compare services, explain policies, recommend suppliers and complete tasks on their behalf. Sometimes, they might not even consciously choose AI and are simply guided by seemingly familiar tools like Google 'AI Overviews'. Either way, instead of visiting ten websites, a customer may ask one assistant to gather the relevant information and present a recommendation. 

In the near future, that AI assistant could be doing more than reading a web page: checking product availability, requesting information, preparing an application, arranging an appointment or even completing a transaction.

Your next website visitor may not be a person at all, but an AI agent acting on their behalf, which raises a serious question:

Can AI systems understand our organisation, trust our information and interact with our services safely?

Getting to know your new audience

To be useful, AI assistants need to find the right information, understand its meaning and decide whether it is current and trustworthy.

A prospective student asking an assistant to compare courses across several universities, a buyer requesting a shortlist of products that meet detailed technical, ethical and budget requirements - both are now part of your website’s audience.

While human visitors use navigation, page layouts, graphic cues and calls to action, AI systems depend more heavily on structured information, descriptive metadata, clear relationships and reliable access to data.

Read more