Planet Drupal

A business spends hundreds of thousands of dollars with a developer or agency to build an eCommerce website, endures years of instability and missed deadlines, and then concludes that the platform just doesn’t work. They start eyeing Shopify or whatever choice platform the first consultant they engage recommends, hoping the grass will be greener. Meanwhile, the actual issue—an underqualified or negligent service provider—walks away unexamined.

Developer problems are often disguised as platform problems. We’ve seen this situation many times with Drupal Commerce implementations that aren’t performing as desired. We’ve even solved issues merchants put up with for years in a matter of hours. It’s not that we’re special, though we do know our own platform better than anyone else. We believe any competent Drupal developer would also be able to identify and solve these issues, possibly just as quickly.

So how do you tell the difference? How do you know your issues stem from your developer, and not your platform?

Below, we’ll give you the language and the lens to evaluate whether your developer is actually serving you well, or whether they’re the reason your Drupal Commerce site feels like it's held together with duct tape and bubblegum.

How some developers get in over their heads

A company needs a Drupal website with eCommerce capabilities, so they search for a Drupal developer. Maybe they already have a Drupal website and want to add some commerce features. Either way, they find a freelancer who has built blogs, nonprofit sites, and maybe a university portal with some advanced functionality. That person says, "Sure, I can handle commerce. It’s just another module." For a basic eCommerce website with minimal traffic, maybe they can.

Read more

Search behaviour is changing as AI-generated answers take over SERPs, reducing clicks and redefining performance metrics. Understand the AI impact on CTR, SEO, and why your marketing strategy needs to adapt.

When Views meets Drupal Canvas -- getting dynamic content into your Canvas page John Locke Tue, 04/21/2026 - 08:00

From early days, "views" has been the killer feature of Drupal. Views is a powerful querying tool built into Drupal that allows dynamic lists and displays of content to be created without writing custom code.

Read more

Successes and failures

I am continually experiencing both successes and failures while playing in my Drupal (AI) playground. My failures usually come from expecting too much of an AI, especially when I ask it to do too many things in a single prompt. My successes with AI come when I keep things useful, simple, and achievable.

Building something useful, simple, and achievable with AI

As I've learned about and maintained new ecosystems in Drupal, I like to review all available plugins. For the Webform module, I created reports for elements, handlers, variants, and exporters. For ECA, I developed an ECA Report module. For the Meta Tag module, I contributed a patch to get a Meta Tag plugin report committed. I think having a way to browse a module's or ecosystem's plugins helps developers understand what tools are available. A Drush command for exporting plugin definitions could be used by both humans and AI.

In the past, creating and maintaining a report could be time-consuming. The new reality is that AI makes it easier to build and maintain simple things like reports. One of the most common anecdotes I hear from non-technical people who "vibe code" is that they are building websites or reports to display information.

My goal was to create a report that lists all plugin managers, plugin definitions, and individual plugin details.

There ain’t nothing fancy here

Read more

Confused about which Drupal migration tools you actually need? This guide breaks down the essential toolkit and when to bring in expert services.

When building a Drupal site, we want to control how our content looks in different contexts, e.g. the full display for standalone or the card display for overview pages. In Part 2 of this series we compare how Drupal Canvas and Display Builder handle display configuration by building a node display for a blog content type. 

See how we optimized the administrative workflows, making it easy to manage numerous websites simultaneously and launch new instances on demand.

Proposal for an LLM policy for Drupal Core contribution

I've been following and participating in the conversation about applying AI tools to the Drupal core issue queue, and the broader community. I've been listening, reading, and experimenting quite a bit in and out of Drupal. It's been a wild ride since last December and for the past few weeks a few things started to solidify.

theodore April 21, 2026

In Episode 549, Randy Fay and Stas Zhuk join us to discuss what DDEV is, recent improvements, and where it's headed. Module of the week is the DDEV Drupal Contrib add-on. Randy and Stas discuss priorities like reliability, consistent UX, add-ons discoverability, and new features including revamped ddev share with Cloudflare and rootless Podman support. They also cover coder.ddev.com, a cloud-based DDEV environment built on coder.com for easier onboarding and contribution, plus sustainability, community support, and challenges such as AI-driven PR volume and Stas's development constraints in Ukraine.

For show notes visit: https://www.talkingDrupal.com/549

Read more

Europe is finally getting serious about digital sovereignty, and getting it half right. The instinct to “Buy European” is sound, but the frameworks being built around it are solving for the wrong variable. Ownership and headquarters are snapshots; they tell you where power sits today, not where it will sit after the next acquisition. Skype had every European credential imaginable. Microsoft shut it down in 2025.

The missing piece is durability. Dries and Nicholas argue, convincingly, that a sovereignty score without an open-source licensing requirement is a sovereignty score with an expiry date. The GPL licence did not stop Oracle from acquiring Sun Microsystems, but it ensured that MySQL could not be discontinued. MariaDB exists today because someone had the legal right to fork before the deal closed. That right is structural; it does not depend on which flag flies over the headquarters.

The forthcoming Cloud and AI Development Act is the real test. Europe can use it to define what makes sovereignty resilient: open licensing as a hard gate for mission-critical procurement, and supply chain assessments that distinguish between dependencies that can be replaced quickly and those that would take years to rebuild. Anything short of that risks becoming a checklist rather than a strategy.

With that, here are the key stories from the past week.

Read more

Original article posted by Christoph Breidert on 1xINTERNET website

Over a decade ago, I co-founded 1xINTERNET on the conviction that Drupal was the best platform for ambitious web applications. That bet paid off. But recently, as AI began disrupting our industry, I found myself facing an unfamiliar feeling: uncertainty. For the first time in my career, the path forward wasn't entirely clear.

If you are a decision-maker navigating this shift, you likely feel the same way. We are all trying to figure out how to leverage AI's huge potential without compromising enterprise security, compliance, or content quality.

The good news is that while the broader AI landscape remains turbulent, the direction for content management systems is becoming clear.

Christoph Breidert

Christoph Breidert facilitating a Drupal AI workshop at DrupalCon Chicago 2026.

When the Drupal AI Initiative was founded in June 2025 by 1xINTERNET, Acquia, DropSolid, FreelyGive, and Salsa Digital, our mission was to chart that exact path. Today, alongside Niels Aers, my role is to manage the AI product direction so that organizations can confidently bring AI into production.

Read more

Read moreAgents need somewhere to live. And once content becomes data, the CMS that holds it becomes strategic.

Drupal Is No Longer Just a CMS Decision. It’s an AI Infrastructure Decision.

drupalSaturday, April 18, 2026 - 12:35

Reusable fixes often remain confined to individual projects, forcing developers to solve the same problems repeatedly. erdfisch has expanded its internal DevBits system into a publicly accessible archive, exposing working Drupal code snippets drawn directly from project work. The collection prioritises immediate implementation over explanation, making internal solutions available without reshaping them into long-form documentation.

I co-founded 1xINTERNET on the conviction that Drupal was the right platform for ambitious web applications. AI changed that certainty. Here is what the Drupal AI Initiative is building, what organizations are getting first, and why the direction is clear.

Site templates are available through two distinct pathways, each serving different needs within the community.

The official Drupal.org Marketplace provides a curated collection of site templates that meet certain quality standards, and are built on top of Drupal CMS as a foundation.

Community templates offer an alternative pathway for innovation and experimentation without the constraints of the curation process, by publishing the template as a general project on Drupal.org.

Official Marketplace Site Templates

The Drupal.org Marketplace are built on top of Drupal CMS, and curated to provide new users with confidence that they're starting with a consistent, solid and professionally built foundation that follows established best practices.

Key characteristics

• Templates undergo a review processes

• Must follow Drupal CMS best practices for security, accessibility (WCAG 2.2 AA), performance, and code quality

• In the beginning, focus is solely on growing Drupal CMS adoption; site templates accelerate adoption of Drupal CMS by providing context relevant demo content and Drupal Canvas-compatible theme

• Clear documentation, maintenance commitments, and user support expectations

• Currently open to Drupal Certified Partners (for organizations) and Ripplemakers (for individuals or very small companies). Apply to become a creator here.

Benefits

• Consistency for users who need reliable, production-ready starting points

• Quality assurance through professional review processes

• Support and maintenance commitments for long-term sustainability

Read more

Project: Drupal coreDate: 2026-April-15Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site scriptingAffected versions: >= 11.3.0 < 11.3.7CVE IDs: CVE-2026-6367Description: 

Drupal 11.3 comes with support for completing entity suggestions whilst adding a link to CKEditor 5.

The suggestions aren't sufficiently sanitized and a malicious user could trigger a stored cross site scripting attack against another user.

Solution: 

Install the latest version:

Read more

Project: Drupal coreDate: 2026-April-15Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: Gadget ChainAffected versions: >= 8.0.0 < 10.5.9 || >= 10.6.0 < 10.6.7 || >= 11.0.0 < 11.2.11 || >= 11.3.0 < 11.3.7CVE IDs: CVE-2026-6366Description: 

Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application deserializes untrusted data due to another vulnerability.

This issue is not directly exploitable.

This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). There are no such known exploits in Drupal core.

Solution: 

Install the latest version:

Read more

Project: Drupal coreDate: 2026-April-15Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: >= 8.0.0 < 10.5.9 || >= 10.6.0 < 10.6.7 || >= 11.0.0 < 11.2.11 || >= 11.3.0 < 11.3.7CVE IDs: CVE-2026-6365Description: 

Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which which can lead to a cross-site scripting (XSS) vulnerability.

Solution: 

Install the latest version:

• If you use Drupal 10.5.x, update to Drupal 10.5.9.
• If you use Drupal 10.6.x, update to Drupal 10.6.7.
• If you use Drupal 11.2.x, update to Drupal 11.2.11.
• If you use Drupal 11.3.x, update to Drupal 11.3.7.

Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)

Read more

Written by members of the DrupalCon Chicago Steering Committee.

Contributors: Stephen Mustgrave, Avi Schwab, Nikki Flores, and Rosie Gladden.

DrupalCon Chicago 2026 brought together leading experts in digital experience development, open source innovation, and enterprise technology.

The event provided a unique opportunity to connect with decision-makers, technical leaders, and innovators shaping the future of digital experiences.  More than 1,300 tech leaders, CEOs, developers, marketing executives, agencies, and enterprise decision-makers gathered to help define the future of the Open Web.

Image: Group photo in Chicago (Photo by Curt Rochon, CC BY-NC 4.0)

​A Diverse and Multilingual Global Community

Participants from 26 separate countries brought with them an estimated 15+ languages, reflecting the rich linguistic and cultural diversity of the Drupal ecosystem.  The United States (82.4%), Canada (6%), India (2%), Germany (1.2%) and Costa Rica (1.1%) were topping the list in terms of attendee numbers, with Brazil (1%), Colombia (0.8%) and the United Kingdom (0.8%) close behind.

This global span not only highlights Drupal’s widespread adoption, but also underscores the strength of a community shaped by varied perspectives, experiences, and ideas from around the world. Next year we’d love to add more blue!​

Read more

Ready to Attend MidCamp 2026? We've Got You Covered

If, like us, you’re still riding the wave from DrupalCon Chicago, MidCamp 2026 feels like it’s right around the corner! MidCamp is the perfect place to dive further into what’s next for Drupal, connect with your peers, and contribute to the momentum we’re all feeling. But first, you might need to convince your boss to invest in your growth.

No worries—we’ve got your back! We’ve created a Convince Your Boss Tool to help you articulate the incredible value you’ll bring back from MidCamp. From hands-on workshops to industry-leading insights, it’s all about empowering your team with what’s next in tech.

👉 Check out the tool now!

Get ready to:

• Outline the ROI for your company
• Highlight the unique benefits of MidCamp
• Start the conversation with confidence

Let us help you make MidCamp 2026 your next big career move.