Planet Drupal

Panel access simplifies procurement but does not authorise a deployment. Agencies still need to review the assessment scope, findings, and residual risk against their intended use.

A new chapter for the Drupal Association - and why I want you in it Jürgen Haas Fri 17 Jul 2026 - 14:00

The Drupal Association is changing CEOs, and the community reacted with the intensity it usually reserves for controversy. Jürgen, who sent the DA a formal four-page letter of concern in May, makes the case for constructive engagement over outrage. Leadership means disappointing half the room on almost every decision - disagree with choices without turning decision-makers into enemies. The practical call to action is the 2026 board election. Become a member now to earn the right to vote. If you are already a member, vote. Show up on the quiet days, not only when the alarm goes off. A transition is rare - a moment where the direction is genuinely open.

Official Drupal 7 support ended on January 5, 2025 - yet many organizations still run sites on it in 2026. The real question is no longer “should we update?” but what platform you want for the next 5-10 years.

A practical decision guide: rebuild on Drupal 11 or Drupal CMS, migrate content, switch CMS, go static, or buy time with extended support - plus a prep checklist for pricing and board-ready options.

LocalGov Drupal Microsites Demo Module launched

Contributing to LocalGov Microsites and demoing it to others is harder than it should be, due to the lack of a demo content. But no longer ...

markconroy 16th Jul 2026

For regulated Drupal projects, choosing a cloud region settles only the easiest part of the sovereignty question. Access, key custody, operations, recovery, and exit planning determine whether the hosting claim holds.

Darren Oh links his board candidacy to a question now facing Drupal: how the project can expand adoption without adding friction for maintainers, smaller projects, and new users.

On July 15, 2026, Drupal published several core security advisories. If an organisation's website, portal or service platform runs on Drupal, now is the time to check not only the version number, but the whole update process. Drupal core July security updates: what site owners should check now On July 15, 2026, Drupal published several core security advisories. According to Drupal.org, the issues include cross-site scripting, commonly known as XSS, and information disclosure risks. The relevant fixes point to Drupal 11.4.4, Drupal 11.3.14 and Drupal 10.6.13. This does not mean every Drupal site is automatically under attack. It does mean that Drupal cannot be treated as a platform to look at "later". For a school, municipality, public-sector body, university, NGO or larger…

DDEV v1.25.3 Released

DDEV v1.25.3 is out, with:

• New Docker Compose library → Improved UX during ddev start and ddev stop; the separate ~/.ddev/bin/docker-compose binary is no longer needed
• Way Faster ddev start, ddev stop, and ddev restart → See below
• MariaDB 12.3 LTS support
• Podman and Docker rootless are no longer experimental → Both are now stable and ready for general use
• Node.js improvements → nodejs_version is preserved in .ddev/config.yaml, and you can install several Node.js versions with n install <version> inside the web container

See the release announcement and the release notes↗.

Start-Time Improvements: Test Them Yourself

ddev start in v1.25.3 runs post-healthcheck tasks concurrently (thanks to @jonesrussell), and a fixed bug in the web server startup script removes a ~10-second delay from ddev stop. In our benchmarks, ddev start from a stopped state is about 28% faster on macOS and 21% faster on Linux.

Don't take our word for it — a new script lets you benchmark the difference on your own machine:

Read more

This article is cross-posted with permission from Dries Buytaert's blog.

The Drupal Association is entering a new chapter. Tim Doyle is stepping down as CEO, and the Board has appointed Tiffany Farriss as interim CEO.

I am grateful to Tim for his leadership and his impact on the Association. He built a strong leadership team that helped guide Drupal through an ambitious period of innovation. That team is well positioned to continue supporting Drupal and its community.

Tiffany brings continuity and deep expertise to the Drupal Association. She has contributed to Drupal for many years and served on the Drupal Association Board for more than a decade, including on its Finance Committee. She helped organize DrupalCon and built and ran a successful agency in the Drupal ecosystem. She understands our project, the Association's finances, and the realities our partners, contributors, and users face.

I have worked with Tiffany for many years. She is thoughtful, deeply committed to Drupal, and unafraid of hard questions. Although her title is interim CEO, she has the full authority and confidence of the Board, as well as my full support.

We expect Tiffany to serve for six to twelve months. During that time, she will focus on strengthening the Association's financial and operational foundation and preparing it for long-term leadership. Later in that period, the Board plans to launch a search for the next permanent CEO.

Turning innovation into momentum

Tiffany is stepping into the role at an important moment for Drupal.

Over the past few years, our community has done some of its most ambitious work. Contributors have continued to modernize Drupal Core. We launched Drupal CMS to make Drupal easier to adopt, introduced Drupal Canvas to rethink how people build, and rapidly advanced Drupal AI to change how people create and manage content.

Read more

The Drupal Association is entering a new chapter. Tim Doyle is stepping down as CEO, and the Board has appointed Tiffany Farriss as interim CEO.

I am grateful to Tim for his leadership and his impact on the Association. He built a strong leadership team that helped guide Drupal through an ambitious period of innovation. That team is well positioned to continue supporting Drupal and its community.

Tiffany brings continuity and deep expertise to the Drupal Association. She has contributed to Drupal for many years and served on the Drupal Association Board for more than a decade, including on its Finance Committee. She helped organize DrupalCon and built and ran a successful agency in the Drupal ecosystem. She understands our project, the Association's finances, and the realities our partners, contributors, and users face.

I have worked with Tiffany for many years. She is thoughtful, deeply committed to Drupal, and unafraid of hard questions. Although her title is interim CEO, she has the full authority and confidence of the Board, as well as my full support.

We expect Tiffany to serve for six to twelve months. During that time, she will focus on strengthening the Association's financial and operational foundation and preparing it for long-term leadership. Later in that period, the Board plans to launch a search for the next permanent CEO.

Turning innovation into momentum

Tiffany is stepping into the role at an important moment for Drupal.

Over the past few years, our community has done some of its most ambitious work. Contributors have continued to modernize Drupal Core. We launched Drupal CMS to make Drupal easier to adopt, introduced Drupal Canvas to rethink how people build, and rapidly advanced Drupal AI to change how people create and manage content.

Read more

Our CEO, Tim Doyle, has stepped down from his role. We are grateful to Tim for his leadership and impact on our organization. Tim has built a strong leadership team that is positioned to continue the mission and vision that he and the Board share for Drupal.

As part of this process, the Board has been working to identify Tim’s successor. We anticipate that the important work and mission of our organization will continue under new leadership, building on the strategy and plans we led during Tim’s time with Drupal.

Likewise, the Board has been working with the senior team to ensure that interim leadership will be in place to facilitate a smooth transition.

We are grateful to Tim for all of his contributions as the leader of Drupal, and we look forward to his continued success in his future endeavors.

The Drupal Association board has appointed Tiffany Farriss as the Interim CEO, who brings more than a decade of experience as a Drupal Association board member, to guide the organization and community through this transition period.

Project: Drupal coreDate: 2026-July-15Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site scriptingAffected versions: <10.6.13 || >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.0.* || 11.1.* || 11.2.*CVE IDs: CVE-2026-55805Description: 

The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting (XSS) vulnerability.

This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface.

Solution: 

Install the latest version:

Drupal 11

• If you use Drupal 11.4.x, update to Drupal 11.4.4.
• If you use Drupal 11.3.x, update to Drupal 11.3.14.
• Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

Read more

Project: Drupal coreDate: 2026-July-15Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.2.*CVE IDs: CVE-2026-15917Description: 

Drupal core 11.2 and above integrate the HTMX JavaScript library.

Drupal core's XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability.

The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes.

Solution: 

Install the latest version:

Drupal 11

• If you use Drupal 11.4.x, update to Drupal 11.4.4.
• If you use Drupal 11.3.x, update to Drupal 11.3.14.
• Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

• Drupal 10 core is not affected. However, certain contributed modules may be affected, so a Drupal 10.6 fix is included as hardening.

Drupal 8 and Drupal 9 have both reached end-of-life.

Read more

Project: Drupal coreDate: 2026-July-15Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Information disclosureAffected versions: <10.6.13 || >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.0.* || 11.1.* || 11.2.*CVE IDs: CVE-2026-15916Description: 

The Image module allows you to define and configure image fields.

The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://.

This vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images.

Information disclosure issues like this one are not generally given security advisories (as described in PSA-2023-07-12)). This fix is provided as a hardening. Contributed modules implementing custom stream wrappers may need to add similar hardenings.

Solution: 

Install the latest version:

Drupal 11

Read more

Checkout is fragile. Every extra step between "I want this" and "order placed" is an opportunity for a shopper to abandon their cart entirely. And one of the most common moments of hesitation happens when a buyer realizes they added the wrong item to their cart. Maybe it was the wrong format or the wrong bundle. Or, maybe the wrong billing cycle for a donation or subscription.

The fix is simple. Navigate back to the product page, add the correct item, and remove the old one from the cart. But this friction, however small, can cost conversions.

The Commerce Product Alternative module for Drupal Commerce solves this by letting shoppers swap a product variation directly in their cart. One click. No detours.

Cart decisions, by design, shouldn't be final

Shoppers change their minds. Someone adds a hardcover book to their cart, then realizes they want the bundle that also includes the digital download. A new member selects a one-time membership fee, then notices the auto-renewal option is more cost-effective. A donor commits to a single gift, then considers whether a recurring contribution would be better.

In each of these cases, the shopper has already committed to buying something. They're in the cart. They're ready.

Why force them to start over?

Read more

Today we are talking about Aaron Winborn, The award named after him, and what winning is like with guests George DeMet & April Sides. We'll also cover Summit as our module of the week.

For show notes visit: https://www.talkingDrupal.com/561

Topics

• Who Was Aaron Winborn
• Award Origin Story
• How Winners Are Chosen
• Why Community Matters
• What Winners Share
• April Learns She Won
• Handcrafted Award Stories
• On Stage Emotions
• After Winning Reflections
• How To Contribute
• Nominations And Makers
• Surprise Award Ideas
• Wrap Up And Contacts

Resources

• TD Cafe #018 - Drupal Site Templates
• Aaron Winborn Award Winner
• Ask a wookie

Guests

April Sides - weekbeforenext George DeMet - palantir.net gdemet

Read more

In 2018 we released Commerce ifthenpay, the module that brought Multibanco references to Drupal Commerce. Seven years later, we are publishing version 3.0.0: the module's biggest evolution since then, with dynamic Multibanco references generated by the ifthenpay API, MB WAY payment retries and full support for Drupal 10 and 11.

The silent problem of locally generated references

A Multibanco reference has 9 digits, and the classic local generation algorithm reserves only 4 of them for the order number. It works perfectly up to order 9999. Beyond that, the number has to be compressed to fit, and this is where mathematics turns against the store.

Version 2.x mitigated the problem by spreading order numbers across 9000 possible combinations. It sounds like a lot, but the birthday paradox is relentless: around 112 simultaneously open references are enough for a 50% chance that two different orders share exactly the same reference. In a busy store, that means payments that can be matched to the wrong order, or never reconciled at all. Worst of all, the problem is invisible: everything seems to work, until the day a customer pays and their order stays "unpaid".

The solution: references generated by ifthenpay

Version 3.0.0 introduces a new mode on the Multibanco gateway: instead of computing the reference locally, the module requests it from the ifthenpay REST API, using the account's MB Key. The differences are structural:

Read more

The debate over open-source infrastructure often ends at agreement. Matthew Saunders wants it to continue into budgets, governance, and contributor support.

Your Drupal site is on a current version, gets security updates, and technically works - yet editing is painful and every small change waits in a developer queue. The platform is rarely the problem.

Fourteen common implementation mistakes that make a Drupal site feel broken - with symptoms, diagnosis, and fixes for each. Most cost a fraction of a rebuild to put right.

Take Away At Tag1, we believe in proving AI within our own work before recommending it to clients. This post is part of our AI Applied content series, where team members share real stories of how they're using Artificial Intelligence and the insights and lessons they learn along the way. Here, Lucas Hedding, Senior Backend Engineer & Migration Lead and Drupal core subsystem maintainer for authentication/authorization, used Claude to work through over 1,200 open issues in the Drupal auth/authZ issue queues and co-architect a new pluggable authentication system for Drupal core, without writing a single line of code.

When approaching AI, I've done so warily. Maybe it was because I was a skeptic, but my first endeavors were not glowing success stories. My first real attempt to kick the tires ended with me kicking AI to the curb and doing some regex and search/replace to finish what it started. I chalk it up to a mix of model maturity and, let's be honest, my own ill-directed uses.

But more recently I've been finding wins. I find AI very useful for writing test cases for test-driven development (TDD). It's also really good at troubleshooting. It takes a bug report, follows the code paths, and writes a failing test that reproduces the bug. When you solve the problem, you can be sure you have solved it. And more importantly, that it was even a problem in the first place.

Read more