News Roundup

amazee.io and amazee.ai are bringing AI governance, data sovereignty, and model access to DrupalCon Rotterdam 2026. Thomas Schröpfer and Tag1’s Hank VanZile will examine shadow AI, private gateway infrastructure, and Scolta as an implementation spanning Drupal, Laravel, and WordPress. For Drupal teams, the session focuses on the operational controls that become necessary when AI moves from experiments into maintained production systems.

Pantheon will demonstrate an outside-in Drupal workflow at DrupalCon Rotterdam 2026 on 29 September. Josh Koenig and Alejandro Moreno Lopez will show a purpose-built agent running on Google’s Gemini Enterprise Agent Platform and communicating with Drupal through its MCP Server interface and related tooling. The session tests a model in which selected work can begin outside Drupal while Drupal continues to define the site capabilities and permissions available to the agent.

Seven DrupalCon Rotterdam speaker groups examine production AI workflows, trusted answers, generative search, Drupal AI products, modern video delivery, HTMX, and open-source community sustainability across 28–30 September 2026. Their examples focus on observability, source quality, explicit tradeoffs, maintainable architecture, and ownership after an implementation begins working. For Drupal teams, the common question is how to recognise failure and unfinished work when the visible result already looks successful.

Speakers across eight DrupalCon Rotterdam session groups examine how structure makes migration, AI-assisted development, personalisation, enterprise editing, team health, and measurement more manageable. Their examples range from AI Content Migrate and an AI-assisted Drupal Canvas migration to an NHS careers platform covering more than 350 roles and clean-code practices for machine-generated code. For Drupal teams, the sessions show how content models, governance, tests, team practices, and meaningful metrics can keep faster systems understandable and maintainable.

DrupalCon Rotterdam speakers are examining how Workspaces, agentic AI, accessibility tools, and controlled answer systems divide work between automation and people. Ajit Shinde, Adam Nagy and David Galeano focus on governed changes and explicit approval, while Daniel Angelov, John Jameson, Christopher Torgalson, and Junaid Masoodi test the limits of automated accessibility. Antonella Picarella adds a public-sector AI case in which Drupal controls the content available to an assistance system and turns user questions into editorial feedback.

Josh Koenig describes Pantheon’s “outside-in” approach to Drupal AI ahead of a live demonstration at DrupalCon Rotterdam 2026. The demo connects a Drupal agent running through Gemini Enterprise with MCP Server capabilities intended to let external agents perform approved Drupal tasks. For Drupal teams, the approach shifts part of the AI discussion from embedding features inside the CMS towards exposing governed site-building and publishing capabilities to enterprise agent platforms.

Dropsolid says its Diamond sponsorship of DrupalCon Rotterdam 2026 reflects a wider investment in Drupal as an open foundation for governed artificial intelligence. Dominique De Cooman connects customer work on trusted answers and AI Search with Drupal's content structures, permissions, workflows and emerging AI governance capabilities. The company's Rotterdam programme places that argument beside product architecture, AI failure cases and lessons from the European Personnel Selection Office implementation.

The Enterprise AI Summit will bring business and digital leaders to the SS Rotterdam on 28 September 2026 for a day focused on enterprise uses of Drupal and artificial intelligence. Featured cases cover multilingual candidate support at EPSO, governed organisational context, the University of Waterloo admissions experience, World Cancer Day moderation, and AI used in American Diabetes Association editorial workflows. For Drupal teams, the sessions show how source grounding, institutional context, human review, sovereignty and existing platform architecture shape production AI.

NASCIO and Forrester have identified five recurring tensions shaping state technology modernisation. Georgia's GovHub and Australia's GovCMS show how shared Drupal platforms distribute common standards, platform investment, recurring costs, and agency control. For Drupal readers, the cases show that public-sector modernisation depends on governance and sustainable operating models as well as CMS architecture.

Recent Drupal core, contributed-project and ecosystem updates cover filename handling, recipe translation, workflow editing, template evaluation and hosting permissions. Drupal 12 filename hardening is committed but not yet packaged, Recipe Interface Translation Integration is in alpha, Workflow Modeler 1.0.9 is stable, and the simplytest.me and BOA capabilities are already available. Drupal teams need to respond according to the affected workflow and release state rather than treat the changes as a single update requirement.

Site Verification, Timezone Picker and Navigation Extra have published updates affecting major-version upgrades, timezone selection and Content menu administration. Site Verification 3.0.2 is now the current stable 3.x release after an initial fix for a Drupal 10-to-11 upgrade sequence, while Timezone Picker has reached 1.0.0 and Navigation Extra has released 1.0.5. The changes give affected teams targeted maintenance or site-building actions rather than a general Drupal security response.

The Drupal Security Team published 36 contributed-project security advisories on 23 September 2026, including 20 for Webform. Five advisories are rated Critical, led by an 18/25 Webform remote code execution issue whose exploitability depends on a specific form configuration. Site operators need to match installed project versions to the security releases and review the features, permissions and integrations that determine actual exposure.

Drupal 12 core development will require Node.js 24 when core's JavaScript development dependencies are installed. The change exposed Nightwatch test incompatibilities, and the resulting corrections were backported to Drupal 11.3 and 11.4 without raising their Node.js requirement. Raven 7.6 separately changes when Sentry initialises and adds performance tracing for console commands.

Zoocha CEO Will Huggins told The DropTimes why the agency sees supporting DrupalCon Rotterdam as part of its broader responsibility to give back to Drupal. Responsible AI, human oversight, investment in the Drupal AI Initiative, and stronger global marketing are among the priorities shaping its participation. His comments connect event sponsorship with broader questions about how Drupal organisations contribute, govern AI, and communicate the platform’s value.

Drupal AI, Commerce Stripe and LocalGov Microsites Domain Alias published releases on 16 September 2026. The updates address AI workflow defects, broader Stripe Payment Element support and predictable environment-specific aliases for microsites. Drupal teams can use the releases to resolve workflow problems, expand payment-method handling or make microsites reachable before their production domains are ready.

David Ortega Porras outlines the architecture behind a headless Drupal 11 platform for governing digital health assets in a public healthcare ecosystem. Drupal Commerce models assets and lifecycle states while identity, BPMN workflows, Kafka messaging, FHIR terminology and observability remain integrated specialist services. The approach shows how Drupal can provide the business model, APIs and governance layer while supporting digital sovereignty through open standards and explicit system boundaries.

The DropTimes held its September Open Townhall online on 22 September 2026 at 15:30 UTC. Discussion covered Drupal job discovery, advocacy themes, AI visibility, event coverage and ways for community members to participate in editorial planning. The meeting identified possible routes for contribution through reporting, distribution, topic selection and user-group programming.

Companies including GitHub, Google, IBM, Microsoft and Red Hat have signed an OpenSSF commitment supporting sustainable funding models for public package registries and participation as enterprise customers. Packagist is among the registries named, while the commitment supports continued free access for individual developers and small organisations and leaves pricing decisions to individual registries. Drupal projects are distributed through packages.drupal.org, while Drupal sites also depend on Composer and third-party PHP packages supplied through the wider registry ecosystem.

The Dev AI Summit at DrupalCon Rotterdam will run on 28 September 2026 with a programme for developers and technical practitioners. Sessions address AI-assisted contribution, workflow orchestration, governed context, guardrails, cost control and author review. For Drupal teams, the programme provides practical examples of the controls surrounding AI as it moves from experiments into production workflows.

Drupal core's current main branch still shows 15 of the 28 maintainer vacancies advertised in 2025 as unassigned. Twelve original vacancy areas received maintainers, although Settings Tray later left the current roster, while REST subsequently became a new vacancy. The comparison shows which 2025 openings were filled, remain unassigned, or disappeared as Drupal core changed.

DrupalCon Rotterdam sponsor Big Blue Door says shared public-sector platforms, practical AI use, and exchange with other practitioners are shaping its plans for the conference. Its responses connect those themes with LocalGov Drupal and the first live LocalNHS Drupal implementation at Bristol NHS Foundation Trust. For Drupal teams, the examples put reuse, governance, and cross-organisation collaboration at the centre of the public-sector platform discussion.

Stuart Clark has documented the Druxt 1.3.x release line, which replaces the Drupal module's hardcoded JSON:API resource list with administrator-controlled configuration. Version 1.3.0 preserves the existing resource set on upgrade, adds selectable configuration resources, and changes default CORS handling for browser preflight requests. Decoupled Drupal teams can expose settings such as editor configuration, image styles, and workflow information without maintaining a patch to Druxt's resource list.

Entity Adapter provides an interface-based way to attach domain-specific behaviour to Drupal objects without replacing their classes. Adapter implementations are discovered during service-container compilation, registered as autowired services, and requested through the interfaces they expose. The approach can reduce direct dependencies on field names and bundle implementations when the same domain behaviour is needed across several parts of an application.

The Drupal Security Team has scheduled security releases for a widely used contributed module on 23 September 2026 between 17:00 and 21:00 UTC. The highest-rated advisory is currently Critical at 16/25, while an updated PSA says other advisories may affect more common configurations and other contributed projects may also publish security releases that day. Drupal core is unaffected, and the announced releases will not be covered by Drupal Steward.

DrupalCamp Spain 2026 has extended its Call for Papers deadline to 27 September 2026. The event runs from 19 to 21 November at Talent Garden Madrid, with standard talks allotted 35 minutes and a maximum of 40 before a separate question period. Drupal practitioners considering a session can use the additional submission time to prepare proposals around the event’s published speaker guidance.

Compound Field 1.0.0-alpha1 lets Drupal 11.4 site builders combine existing field types into compound fields through Field UI. Sub-fields retain their own plugins, widgets, formatters and validation while their values are stored as columns in the host field table. The module remains an alpha release, and structural changes such as removing sub-fields or reducing cardinality can delete stored values.

Nick Schuch describes how Skpr is extending Compass to identify Drupal requests marked uncacheable by Dynamic Page Cache. The tracing view exposes timing, cache metadata and the component associated with a zero max-age or other poor-cacheability condition. The approach is intended to make performance problems easier to diagnose when they are otherwise hidden behind healthy edge-cache metrics.

Drupal 12.0.0-beta1 and Drupal 11.5.0-beta1 were not released during their scheduled September release week. Core contributors were still closing dependency, deprecation, testing, and release-note work as the window ended, and Drupal.org had not published a revised beta date by 21 September. Maintainers planning compatibility work therefore still have alpha1 as the latest Drupal 12 release while the November release-candidate and December stable milestones remain on the published schedule.

Entity Usage 5.0.0 is the first stable release of the module's 5.x branch and adds Drupal 12 compatibility. Sites upgrading from 2.x must rebuild their usage data, while custom tracking plugins that still use annotations need to move to PHP attributes. Drupal 10.3 and Drupal 11 sites can remain on Entity Usage 2.3, while Drupal 12 requires the 5.x line.

Three Drupal events between 22 and 28 September 2026 include online Code of Conduct incident-response training, an in-person DDEV meetup in Madrid, and the opening of DrupalCon Rotterdam. The programmes cover community incident handling, local development workflows, Drupal CMS, technical sessions, summits, and contribution. The week gives Drupal community members options for governance training, development practice, and broader conference participation.

The September 2026 edition of The DropTimes Open Townhall will take place online on 22 September at 15:30 UTC (21:00 IST). Tarun Udayaraj, head of community relations at The DropTimes, will host a discussion on ongoing work, upcoming editorial priorities, and opportunities for community contribution. The Zoom session gives Drupal contributors and other ecosystem participants a forum to raise questions, suggest stories, and provide feedback on TDT coverage.

Native Observability is a Drupal module that records what a site is doing while it handles requests so developers can investigate slow or unexpected behaviour. Version 2.0.0 replaces an earlier estimate of about 10% overhead with a measurement taken on the Drupal installation where the module runs. The change gives site operators a more useful basis for deciding how and when to run detailed monitoring on a production site.

Ralf Baumbach describes a Drupal rebuild that moves imported data objects out of the nodes used as public pages. Custom content entities retain source-system identity and relationships, while nodes control URLs, publication state, editorial metadata, and Layout Builder configuration. The separation adds integration code but prevents source imports from controlling editorial properties when the two need different lifecycles.

Will Callaghan has published four reusable tender clauses developed by Cumberland Council's Craig Barker for local-government procurement. They ask suppliers about collaborative development, product roadmaps, customer influence and support for shared standards and reusable public-sector platforms. The LocalGov Drupal connection gives councils a practical example of how collaboration and reuse can be raised before contracts are awarded.

Wolfgang Ziegler has outlined how drunomics is building OpenKnowledgebase on Drupal 11 for knowledge shared by people and AI agents. The planned platform combines Drupal permissions, review workflows and revisions with MCP access, block-level provenance, Nuxt and OpenSearch. The project applies familiar Drupal governance controls to knowledge that AI agents can read, search and contribute to.

OpenAI has released the Agents API in public beta with support for connecting agents to HTTP MCP servers and supplying credentials. Drupal's experimental Agent Access stack uses MCP and Drupal authentication to expose selected capabilities to compatible external clients under existing site permissions. Together, the documented interfaces create an interoperability test path, although no published end-to-end OpenAI and Drupal test reviewed for this story establishes a working integration.

Werkzaak Rivierenland has opened a European tender for a successor to its current Drupal website. The tender requires a mature open-source CMS and cites Drupal, WordPress and headless frameworks as examples of relevant supplier experience. For the Drupal community, the procurement keeps Drupal eligible while placing greater weight on simpler management, transferability and editorial autonomy.

Georgia has adopted GovRAMP as its primary framework for authorising and continuously monitoring third-party cloud services. New cloud contracts begin carrying GovRAMP-aligned requirements on 1 October 2026, with full verification requirements mandatory for covered procurements from 1 July 2027. Georgia's Drupal-based GovHub provides a practical example of why government Drupal teams need to consider the security status of cloud services around the CMS.

Digital Matters has examined recent large batches of Drupal contributed-project security advisories alongside the Drupal AI Security Initiative. The analysis compares those publication patterns with the Drupal Association’s account that AI-assisted analysis has made vulnerability discovery substantially cheaper. Digital Matters argues that advisory volume should be interpreted alongside discovery methods, severity, and the limits of Drupal’s security-coverage population rather than treated by itself as evidence of declining code quality.

Revision Graph 4.0.0 changes how the Drupal module tracks revision lineage by recording provenance when it saves revisions. The release also replaces its two-panel display with a single revision rail that distinguishes default, live, and language-specific states. Version 4.0.0 supports Drupal 11 and 12, while the earlier 3.1.1 release supports Drupal 10 and 11.

AI Integration - ECA 1.0.0 became the project's first stable release on 10 September 2026. The project exposes Drupal AI operations as ECA actions and includes assisted model building, optional agent and automator features, and controls over provider traffic. The release replaces two earlier integrations, although Drupal 12 compatibility is still described inconsistently between the release metadata and requirements text.

Drupal released security updates for supported Drupal 10 and 11 branches after a CKEditor 5 flaw exposed sites to cross-site scripting. An attacker with permission to create or edit content may be able to target a user who later accesses that content through CKEditor, including a site administrator. Supported branches have corrective releases, while Drupal 10.5.x and Drupal 11.2.x or earlier are outside security coverage.

Drupal Canvas 1.11 introduces editable, theme-independent page templates for full-page layouts. The release also adds document support in components, expands Canvas AI controls, and includes reliability and Drupal 11.5 compatibility work. Canvas 1.11 requires Drupal 11.3 or later.

Vulnerability reporter Matan Kotick says Claude found and validated a Critical SQL injection flaw in the amazee.ai Private AI Provider module in about ten minutes. He told The DropTimes that Claude identified the vulnerable code path, built a test environment, ran the exploit, and confirmed the injection worked. Drupal's advisory lists fixed releases for the affected branches and was updated on 11 September after publicly documented exploit-development methods raised the risk assessment to Critical 17/25.

Drupal AI Context beta 5 expands Context Control Center with a new consumer architecture that can serve AI automators and other integrations alongside agents. The release also adds Minimal, Relevant and Broad context-selection modes, a Roles scope, sample context items, and substantial upgrade and reliability work. Salsa Digital expects beta 5 to be the final beta before the project moves to its first release candidate.

Drupal developer Joachim Noreiko has documented how the Path Alias Views module brings Drupal path aliases into Views. The module provides fields, filters, sorting, and relationships that connect path aliases with the content entities they target. Noreiko presents the approach as a way to build content administration interfaces that organise pages around paths rather than only titles or entity identifiers.

Drupal developer Jacob Rockowitz explores the idea of a “Drupal mode” for AI agents after reflecting on his experiences with AI-assisted development. He connects the concept to Drupal’s openness, stability, scalability, and a wider discussion about the platform serving as an AI harness. Jacob presents “Drupal mode” as his extension of the Drupal AI conversation rather than an announced feature or initiative.

Drupal 11.5 introduces a post-save API for plugins, handlers, and displays in the Views subsystem. Implementations can flag when a router rebuild is required or queue plugin discovery caches for clearing, while views_invalidate_cache() is deprecated. The change gives module developers more explicit control over work triggered after Views configuration is saved.

AI Disclosure provides Drupal 10.4 and 11 sites with tools for recording how AI was involved in content and managing Article 50 disclosure decisions. Release 1.0.0-alpha2 supports European Commission icons, machine-readable metadata, audit trails, editorial workflows, reporting, and optional Tool API integration. The module supports transparency workflows but does not provide legal advice, make disclosure decisions, or certify compliance.