Planet Drupal

Why it is a migration, not an upgrade Drupal 10 or Drupal 11? The steps of a Drupal 7 migration The risks to keep under control What makes a migration cost more or less What if I don't migrate yet? Drupal migrations with Omitsis Drupal 7 reached its end of life on 5 January 2025. Since then it gets no security fixes from the community, and every month there are more abandoned modules, more incompatibilities with new PHP versions and more risk. If your website still runs on Drupal 7, the question is no longer whether to migrate, but how to do it without losing content, Google...

This post is being published in consultation with the Drupal Security Team.

As the maintainers of Drupal Commerce, we are advising users to upgrade immediately to the recently published releases of Commerce Core to protect against a vulnerability that may have financial impact.

We received two reports of attempts by malicious users to place fraudulent orders using a vulnerability patched in Commerce Core 3.3.13 and 8.x-2.41 (SA-CONTRIB-2026-254). Centarro and the Drupal Security Team looked for broader abuse of this issue. As of now we do not believe it was scripted or exploited beyond the initial sites.

We analyzed the issue in private with the Drupal Security Team, who coordinated the testing, packaging, and release of the module updates on October 28, 2026.

Attempted exploits have been observed on live sites

Those who reported the issue were merchants who observed suspicious activity on live sites, not merely security researchers evaluating the platform for vulnerabilities. Given that merchants observed this behavior, we highly recommend every user evaluate recent orders to determine whether or not any were fraudulently placed.

This vulnerability impacts both full-stack and headless sites, with attack vectors that differ based on the site’s architecture.

Identifying potential exploits

To determine if any of your recent orders were fraudulently placed or otherwise manipulated, evaluate them according to the following rubric organized according to exploits of increasing sophistication. Every Drupal Commerce site is unique, so you should evaluate the results of each item based on your knowledge of the legitimate behaviors your site supports.

Read more

An actively exploited Drupal Commerce vulnerability could financially affect online stores. Security updates are available, and store owners should also review their orders for inconsistencies.

Turning AI's Promise Into Practical Results at Drupal AI Summit Paris 2026

For most organizations, the question is no longer whether AI matters, but how AI fits into their own work, on what terms, and at what cost.

On December 1, 2026, the Drupal AI Summit Paris will bring together experts and organizations that have already worked through those questions, including EU institutions and medical researchers, to share what they learned.

Your summit ticket also gets you all three days of the Future of Software Technologies (FOST) conference, December 1-3, with over 300 sessions to choose from.

Marketing and Content Teams Moving Faster Without Losing Their Voice

For marketing and content teams, trustworthy content is essential. It has to sound like their brand and get published without weeks of waiting. That’s the promise of Drupal AI.

When pages drift off-brand and don't keep up with the brand, they lose their importance and credibility. They lose what sets them apart.

AI working as the editor, not the author, is the focus of this session. Bruno Bruno from 1xINTERNET will show how AI can review content against an organization’s own standards and suggest fixes, keeping hundreds of pages consistent. All while people still write the content and decide what gets published.

Landing pages are often the centerpiece of a campaign. The summit will also feature Canvas AI, showing how you can build a complete, brand-compliant landing page from a text prompt or by drag and drop, and then route it to the right people for approval. That way, the page goes live on time and in the right voice.

Read more

AI-generated Drupal code can look correct while using outdated APIs, invented fields or incomplete cache metadata. Project instructions and repeatable checks help developers identify those mistakes before committing changes.

QED42's website looked correct after an early AI-assisted migration, but its Drupal backend told a different story. Souvik Pal explains how that finding changed the framework.

With fewer routine stories and more time devoted to research, The DropTimes is examining how contributors can help determine which Drupal developments receive deeper coverage.

Do you like having secure Drupal sites? Help fund xjm. xjm Wed, 10/28/2026 - 23:00 The problem: Certain maintainer roles keep Drupal's lights on. Right now, there's a brownout.

Interim Drupal Association CEO Tiffany Farriss recently wrote about bringing to light "the work that just happens": the mostly invisible (but essential) services the Drupal Association provides to sustain the Drupal project and community. I love this description. If everything's going well, maybe you don't even know or notice. But on the other hand, maybe you should.

Image Drupal Association booth at DrupalCon Vienna 2025. Photo credit: Matthew Saunders.

The Drupal Core Leadership Team has its own version of work that "just happens", a bit similar and a bit different. We're more likely to have our work celebrated, especially by other contributors. On the other hand, though, there's plenty more going on behind the scenes… and outside the core development bubble, what we do is mostly just summarized in one line as an external dependency for someone's contributed project, strategic initiative, or web application.

Read more

When the Drupal Association launched the Drupal AI Security Initiative with Alpha-Omega this past June, our goal was to test whether a fractional, funded team, pairing fixers, reviewers, and infrastructure engineering alongside our volunteer Security Team, could protect maintainers from an incoming wave of AI-assisted vulnerability reports.

Five months later, that anticipated wave is fully visible in the public data.

From June through October 2026, Drupal published 256 security advisories. That five-month total exceeds the 250 advisories published across the previous 30 months combined. Baseline volume climbed from an average of 8 advisories per month in early 2026 to 28 in June, 74 in September, and 106 in October. The eight highest-volume publication days in our records since 2018 all landed within the last five months, peaking at 39 advisories on October 28.

The data marks the completion of our initial Clarity phase. It demonstrates why the economics of vulnerability discovery have permanently shifted and proves that funding the complete review workflow is the only reason our volunteer process kept publishing without buckling.

Monthly Drupal security advisories published from December 2023 to October 2026. The surge beginning in June 2026 reflects an increase in automated discovery velocity and disclosure throughput supported by the SEIR grant, not a shift in Drupal's codebase security.

Read more

At DrupalCon Rotterdam, Dries asked the community to talk louder about Drupal. The platform is years ahead of its reputation, and no single organisation can close that gap alone. To that end, the Drupal Association launched the Drupal Advocacy Program: tell Drupal's story in your own voice, and earn contribution credits for it, through the same system that recognises code.

This first month has been a proper pilot: we've built the program as we've gone. A month in, we think it's a success. The community is energised, we've developed a credit scoring matrix, and we've reviewed 264 pieces of advocacy. Here's the month by the numbers, the people and content that stood out, and what we’ve learned.

The first month in numbers

264 pieces of content went through review in Month 1, from nearly 150 contributors. 117 came in through the submission form; the other 147 we found ourselves. Yes, this month we did some of our own tracking. But fill in the form anyway - it's how we make sure we don't miss you, and it's how you credit your sources. And if you're submitting your own work, we're happy to review anything you've published in 2026. Your back catalog counts.

Every piece was scored against the credit matrix (below): a base value per channel, one of three tiers, doubled for content on the quarterly theme; 105 pieces earned the doubling. And if someone named you as a source in their submission, you picked up a credit too: one per attribution, 71 in total.

All up, around 2,400 contribution credits are going out for Month 1 (2,336 for content plus 71 attribution credits) through the same Drupal.org system that recognises code contribution.

Read more

Within three years, I expect the technical work of moving a website from one platform to another to cost close to nothing.

The existing site gives the agent a reference implementation. It can crawl matching URLs, diff the rendered HTML, compare screenshots, and, given admin access, run the same publishing workflows to check content changes, moderation states, and permissions.

Comparing the two systems under equivalent inputs is called differential testing. Agents work well when they can check themselves against tests. The existing site provides the baseline.

I could be wrong about the timeline, or about how close the cost gets to zero. Treat it as a business model stress test anyway: assume customers can leave whenever they want, and consider what changes for vendors, agencies, and Open Source.

Some of these changes are not new, but cheap migrations could push them much further:

Read more

I had been postponing Drupal coding standards fixes in distro OpenLucius for far too long now. There were always more interesting things to do: fixing bugs, building new features, and improving existing functionality. While code style fixes should always be applied before a GIT commit.

So this just needed to be done. But fixing hundreds of PHP CodeSniffer violations was not exactly what I wanted to spend my time on. Earlier I ran PHPCBF, the automatic fixer included with PHPCS. It fixed a lot, but there was still so much left to do.

Now, let's AI this.

Sixty-two maintained Drupal AI projects, one per job, each with its install count, latest release and security advisory status from Drupal.org.

One trace, inside and outside Drupal: a proposal for Rosetta Photo by Jason Leung on Unsplash Jürgen Haas Wed 28 Oct 2026 - 15:30

Dries Buytaert's Rosetta initiative wants Drupal modules to describe their data and operations once, so AI assistants, front ends and workflow engines can reuse them. Tools compose: a Maestro workflow can call an ECA model exposed as a tool. When that fails, Jürgen gets two unrelated traces. ECA, the AI module, FlowDrop and Maestro each record runs their own way, and no run ID crosses a system boundary. Tool API has reserved attach points for call IDs and audit records, but four callers bypass its runner. Jürgen proposes one shared API for tracing, debugging and replay. OpenTelemetry handles correlation and export. One optimized serializer records step state, storage is pluggable, and playback spans systems. He lists six open questions and invites the discussion now, before the Rosetta Sprint.

Drupal projects are moving their issues from Drupal.org to GitLab work items, and ContribKanban couldn't see them. I rebuilt it so that one board tracks both.

A familiar WordPress design can now become an editable Drupal site. But what survives the conversion, who maintains the result, and how close is the experiment to working on real projects?

Drupal is 25 this year, and its code has had linters for a long time. Its words haven't, and with Drupal AI writing straight into the node form, more of them now come from a model. A search of drupal.org turns up readability scores and spellcheckers, but nothing that holds a save to your own style guide.

Vale (for Drupal) does that with the Vale prose linter. Break an error-level rule and the save is refused, or only the publish if drafts should save freely. 1.0.0 is out now for Drupal 10.3, 11 and 12, and needs the Vale binary on your server.

Vale in CI is the right tool for Markdown in a repository. Content in Drupal arrives through a save instead: the node form, a Fully Decoupled frontend over JSON:API, a workspace being published. The module checks there, on the server, whatever editor the author used.

Continue reading →

In the Open is a weekly series from Drupal Association Interim CEO Tiffany Farriss, sharing what she is hearing across the Drupal community and where the Association is headed. In this episode: why Drupal's commons is under pressure, how the Drupal Certified Partner program is evolving, and what it takes to keep free software running for the next 25 years.

"Drupal is free. The code of Drupal is free forever. But those of us who run Drupal know that running Drupal has never been free."

The following is a transcript of Tiffany's remarks, lightly edited for readability.

What I'm hearing from the community

The thing that's top of mind for me this week is reflection. I've spent a lot of time listening to folks, talking to folks, asking a lot of questions. I wanted to take a few minutes to share back some of the things I'm hearing, because these are the things motivating the changes in how I'm thinking about existing programs, and about how we might want to do things differently for the next 25 years of Drupal.

Whether it was the ecosystem survey, the business community survey, or conversations with the core release maintainers and other parts of the community, it's very clear to me that our commons is fragile. The technology of Drupal itself is a brick. It is solid. We are super proud of our security team. But the people and the funding sustaining it aren't yet in a sustainable place, and there's a lot of pressure.

That pressure is echoed in the business community. The businesses that have been very supportive of Drupal through the years, and I'm thinking not just of those 126 Drupal Certified Partners but of all of us, everyone is getting squeezed. The business survey data showed that the average deal size was down, and that pipeline expectations had gone negative for the first time in the Drupal business survey.

Read more

Take Away Jeremy Andrews, Tag1's Founding Partner and CEO, looks at PHP's early design through a former kernel developer's eyes, from hash tables for nearly everything to Drupal hooks built from strings. He shows what those trades cost Drupal 6 and 7, including hook lookups that took around 10% of page execution time, and how caching kept busy sites running.

This is Part 1 of a two-part series about the trades PHP made early on and what they have meant for Drupal performance. Part 2 covers the Java-fication of Drupal, the engine-level work that saved PHP from itself, and how Drupal came full circle, with its biggest performance gains in a decade.

Read more

Supply Chain Security for Drupal Projects admin Tue, 10/27/2026 - 14:38 Drupal Security

A developer needs a fix from a contrib module, so they open a terminal inside DDEV and run composer update. The container can reach an SSH agent and a hosting token. Composer downloads a few packages and writes a new lock file.

Nothing about that looks unusual. That is the problem.

The recent wave of supply chain attacks did not exploit Drupal. It exploited the moment a developer or a build changes dependencies with credentials in reach. The Drupal Security Team has been clear about the boundary. Its remit is code hosted on Drupal.org, and site owners are responsible for third-party libraries.

The rest of the dependency tree is ours.

We develop locally in DDEV and use Dependabot in GitHub for update pull requests. Here is how we think about protecting a Composer-based Drupal project.

The risk arrives when dependencies change

These attacks arrive with a dependency change, and a Drupal project gives them three places to run.

The first is Composer plugins. In April 2026, an attacker moved an existing intercom/intercom-php tag to a malicious commit. The malicious commit turned the library into a Composer plugin that stole credentials during install.

Read more