News Roundup

Drupal founder Dries Buytaert has proposed a simple procurement test based on official Open Source contribution records. He argues that buyers should be able to establish within about a minute whether a vendor contributes, how its contribution compares with others, and whether its work covers relevant parts of a project. Drupal's contribution-credit system provides his main example of how projects can record and assess work that supports their ecosystems.

DrupalSouth is seeking candidates for its 2026 Steering Committee election across Australia and New Zealand. Candidates must self-nominate and, if elected, join Linux Australia and commit to a two-year volunteer term with regular committee and event meetings. The five-member committee oversees governance continuity, conference support, budgets, and regional Drupal community initiatives.

Matt Glaman has completed a broad overhaul of simplytest.me across its testing, sandbox, project-data, and frontend workflows. The changes reduce repeated requests to Drupal.org and Tugboat, address patch-related build failures, add launch validation and aggregate statistics, and redesign the user interface. The work strengthens a service used by newcomers, developers, trainers, and others who need temporary Drupal environments.

The Drupal Association Board is seeking community feedback through its first global Drupal Ecosystem Retrospective. Participants are asked to identify fragile areas, issues needing reinforcement, established strengths, and external threats. Responses will inform the Board's discussions ahead of its retreat at DrupalCon Rotterdam.

PHP 8.6.0 Beta 3 arrived on 10 September 2026 as the final scheduled beta before release candidates. The build primarily addresses bugs as the runtime moves toward general availability in November. Drupal core is already testing against PHP 8.6, while compatibility work for Drupal 12 remains under active tracking.

LocalGov Drupal has announced five presentations for its Community Meetup: Show & Tell on 17 September 2026. The lineup covers Visit Newark & Sherwood, LocalGov Mail, a Charts paragraph type, Quorum, and content design work at Luton, with each slot capped at seven minutes. The format gives councils and suppliers a concise way to share recent work with the wider LocalGov Drupal community.

The European Commission has proposed a single regulation to replace three European Union procurement directives adopted in 2014. The draft explicitly addresses open-source solutions alongside software licensing, cybersecurity, resilience and supplier origin. If adopted, the framework could affect how Drupal agencies and hosting providers demonstrate technology control, continuity, security and supplier dependencies in public tenders.

Oomph and Adapt USA are now operating as Pare & Co following Oomph’s 2025 acquisition of the US business. The company’s Drupal.org profile, now under the Pare & Co name, says its Drupal work dates to 2008. Pare & Co is also listed as a Bronze Drupal Certified Partner and a Silver partner in the Drupal AI Initiative.

Acquia has launched new branding that places “Powered by Drupal” beneath its name. The company is repositioning Acquia Source around content management, digital assets, governance, and AI in a shared workspace. Co-founder Dries Buytaert says the stronger Drupal positioning is intended to make the platform's role in Acquia more visible again.

Bluefly.io will host Ashraf Abed, founder of Drupito, for an online town hall on 17 September 2026. Abed will demonstrate Drupito, a marketplace for building, hosting, and selling Drupal site starters and themes. The session gives Drupal practitioners a live introduction to the platform and its approach to reusable site building.

Alejandro Moreno López examines what happens when AI can generate software faster than people can reasonably review it. He connects package hallucinations, security incidents, and growing volumes of generated code to a wider problem of trust and maintainability. He argues that Drupal’s established building blocks could give AI-assisted development more structure and less custom code.

Google released Chrome 153 on 8 September 2026, starting Chrome’s new two-week Stable release cycle. The release contains 230 security fixes, including five Critical vulnerabilities, and Google says an exploit for a separate V8 flaw exists in the wild. For Drupal teams, the faster cadence shortens the interval for compatibility checks across administrative interfaces, JavaScript integrations, and Canvas.

Cyber Resilience Act reporting obligations for manufacturers of covered digital products took effect in the European Union on 11 September 2026. Manufacturers must give an early warning within 24 hours and a fuller notification within 72 hours for actively exploited vulnerabilities and severe security incidents. For Drupal-related businesses, the reporting question turns on whether they manufacture an in-scope product and whether an upstream flaw is exploitable in it, while separate reporting duties for open-source software stewards begin on 11 December 2027.

Martin Anderson-Clutz connects two Drupal GovCon keynotes on deliberate change and team resilience in an article republished on Drupal.org. Mike Madison argues for continuous improvement and collective support for change, while Kerry Greer focuses on trust, clarity, shared knowledge, and purpose when disruption is imposed. Anderson-Clutz applies those ideas to the Drupal AI Initiative, framing its collaborative work as an example of pairing technical change with resilient teams.

Two online sessions taking place from 14 to 21 September 2026 cover community conduct response and AI governance. The Drupal Community Working Group and Otter Tech are offering incident-response training on 15 September, while amazee.ai is holding a Shadow AI webinar on 16 September. The sessions give Drupal readers access to community-safety training and a broader discussion of organisational AI data risks.

DrevOps has released Vortex 1.41.0, codenamed Lumen, with changes to Drupal development, testing, continuous integration, and deployment workflows. The release replaces several Vortex-specific mechanisms with Drupal core or maintained ecosystem alternatives, including core Navigation, npm, core-aligned linting, and a separate security audit workflow. Existing Vortex projects need manual attention to administration modules, front-end lock files, CI settings, and some testing configuration during the upgrade.

Views Bulk Operations 4.4.8 is a stable bug-fix release for Drupal 10.3 and Drupal 11. It limits a confirmation-form count query to the current selection and removes a return-type declaration that could cause fatal errors in child action classes. For Drupal teams using VBO in administrative or editorial workflows, the update also corrects select-all, AJAX-loader, and related runtime errors.

Capgemini has published research showing limited visibility into technology dependencies among large organisations and public-sector bodies. Only 14% report fully mapped dependencies, while 36% say moving away from a critical provider would take more than a year. For Drupal operators, the findings make portability, supplier concentration, and realistic exit planning relevant beyond the choice of CMS.

Piotr Kamieniecki will deliver two DrupalCamp Poland sessions examining why language models produce convincing errors and how reasonable architectural decisions can combine into unstable Drupal systems. Paweł Bogucki will explore agentic support and maintenance, including human oversight, organisational knowledge, staffing, scalability, and the value that should remain with people. Their sessions give Drupal teams different ways to examine systems that appear to be working while producing outcomes that still require scrutiny.

Dimitris Spachos, MCPIO's maintainer, released version 1.0.0-alpha1 on 6 September 2026 as a new Model Context Protocol server project for Drupal. The module presents external AI clients with two tools for finding and running Drupal actions through Tool API, including compatible actions from MCP Tools. The alpha gives Drupal developers another MCP architecture to evaluate, but it uses an older protocol revision and is not covered by Drupal's security advisory policy.

DrupalCon Rotterdam will hold a free Drupal in a Day workshop on 1 October 2026 for university and college students and other people curious about Drupal. Participants will build a website from scratch in small groups with experienced Drupalers, with no previous knowledge required. The English-language session runs from 09:00–16:30 CEST, requires participants to bring a laptop, and has limited places.

ECA released versions 3.1.7, 3.0.15 and 2.1.24 on 7 September 2026. The patch releases refresh model and session users for every execution, combine Endpoint and Views access results, and add a permission check to the Apply Recipe action. Site owners using long-running workers, layered access models or recipe automation should review the change records before updating.

Drupal developer Ronald te Brake has built a WebMCP Integration proof of concept that lets selected Drupal forms expose structured tools to browser agents. Tests with Views and Webform show how the declarative approach can reuse Form API information, while one Webform comparison reduced tool calls and elapsed time without changing the successful result. The experiment suggests a possible browser-side complement to MCP Server and Tool API, but WebMCP and the Drupal integration remain experimental.

Drupal Ahmedabad will hold an in-person meetup at cmsMinds on 12 September 2026. The Show & Tell programme centres on Drupal projects, tools, approaches, and other practical work shared through informal demonstrations and discussion. The session gives the local Drupal community a setting to compare experiences, discuss challenges, and learn from one another.

The Drupal Security Team published 20 contributed-project advisories on 9 September 2026, nine rated Critical. Eleven affect SAML SSO - Service Provider and direct users of affected versions to upgrade to 3.2.0. The remaining advisories require project-specific responses, including a new permission for Ultimate Table Field and removal of the unsupported Patreon module.

Matt Glaman has updated the phpstan-drupal playground to support bug-reproduction workflows used by coding agents. The changes add API discovery, complete share URLs, Markdown-formatted results, and more accurate HTTP responses for invalid requests and missing reproductions. Drupal contributors can now use agents to publish a PHPStan reproduction or inspect an existing share link without depending on the playground's browser interface.

Drupal developer Andres Torres Russo documented automated requests targeting WordPress REST API routes on a site running Drupal. The same route patterns appear in documented exploitation of a WordPress vulnerability chain patched in July 2026, but the available logs do not show whether a complete exploit payload was sent. The observation shows why Drupal operators need to understand how proxies, caches, web servers, and the application affect unsolicited traffic at different stages.

Zoocha CEO and co-founder Will Huggins argues that Drupal publishing could expand from pages and structured content to controlled capabilities that AI agents can use. He points to Tool API, MCP Server, Outside AI, guardrails, and Drupal's existing access controls as parts of that emerging architecture. Tool API and MCP Server remain in beta, making this an active direction for Drupal AI rather than a completed platform transition.

DrupalCon Orlando 2027 Early Bird registration opens on 14 September 2026 with a $650 general admission rate. Regular registration is set at $850, while late and onsite registration rises to $1,200, putting every main paid tier above Chicago 2026. The $550 early-to-late gap makes registration timing a larger cost factor for attendees planning for Orlando.

Smart Image Optimizer provides automated WebP and AVIF conversion for JPEG and PNG images on Drupal 10 and 11 sites. The module supports configurable quality, bulk processing, image-style derivative handling, and optional removal of original files, while its current 1.0.1 release includes a Drupal 10.2+ and 11 compatibility fix. The project is available on Drupal.org but is not currently covered by Drupal's security advisory policy.

Drupal teams are absorbing fast-moving AI work, deeper performance changes, and new expectations around how Drupal expertise is packaged and delivered. Four DrupalCamp Poland speakers tell The DropTimes where they think the practical learning lies.

Harvard Web Publishing is continuing live Drupal training this autumn as part of a wider support model for the university's HarvardSites platform. HUIT's FY25 annual report records 1,899 migrated websites, while a survey of 149 site builders found a satisfaction score of 3.4 out of five and 45% of respondents neutral or dissatisfied. For Drupal teams running large distributed estates, the findings highlight the operational role of training, guidance, and governance alongside the platform itself.

Drupal core contributors are reviewing a Drupal 12 proposal for a node reference limitation first reported during Drupal 8. The setting would let reference fields include unpublished nodes according to permissions the current user already holds. The change could remove a long-standing obstacle in staged and moderated publishing workflows without expanding editor privileges.

Chad Capellman reflects on Drupal GovCon 2026 and how AI is changing his view of Drupal's role. He describes hands-on work with Drupal AI assistants, automated content tasks, conversational site building, and AI-supported search across large collections of content. He argues that Drupal's flexibility and extensibility can provide useful foundations for orchestrating AI alongside established content-management workflows.

OpenAI has launched Daybreak for Frontline Defenders, committing $1 billion in subsidised Daybreak access alongside training, technical support and partnerships. The programme starts with the United States, where open-source maintainers and essential-service organisations are among the priority groups, with the subsidised access targeted for use over six months. Drupal maintainers and public-sector Drupal teams may fit those categories, but OpenAI has not announced Drupal-specific eligibility or participation.

Varbase Starter 1.0.0 became the project's first stable release on 6 September 2026. The site template combines 24 Drupal CMS and Varbase recipes with Vartheme BS5, search, editorial workflow, a Canvas-built home page, and demo content. The release gives the Drupal community a stable example of an established distribution adopting recipe-based site assembly alongside Drupal CMS.

UI Suite says Rajab Natshah's team is extending the Display Builder AI strategy to include UI Kit, Penpot and automated design-token workflows. The module already supports prompt-based page building, but the newer design-system workflow has not been demonstrated end to end. Drupal's Design Tokens API, committed to the core main branch on 7 September 2026, provides related infrastructure as that strategy develops.

Drupal core 12.0.0-alpha1 was released on 2 September 2026 as the first tagged pre-release in the Drupal 12 cycle. It requires PHP 8.5, moves to Symfony 8.1 and Guzzle 8, and removes several deprecated core extensions. Module, theme and distribution maintainers can begin compatibility testing now, but the alpha is not supported for production use and further dependency changes are expected before beta1.

DDEV released version 1.25.4 on 2 September 2026 with automatic database seeding and reset, global configuration, and MySQL 9.7 support. The release also adds new Linux package repositories and several fixes affecting Drupal projects. For Drupal teams, the changes reduce repeated setup work and make shared local development configuration easier to maintain.

Drupal's GitLab Templates project has a tested Twig coding-standards job ready for contributed projects, with default activation deferred until Drupal 11.5. Drupal core adopted Twig CS Fixer in July 2026, adding automated checks for Twig templates to its continuous integration pipeline. The contrib rollout will give project maintainers a shared standards check without requiring their own Twig linting setup.

DrupalCon Rotterdam's Government Summit will put digital sovereignty and open-source public services on the agenda on 28 September 2026. European Commission and GovCMS figures show Drupal operating at substantial public-sector scale, while Germany's Sovereign Tech Agency funds upstream work in both Drupal and PHP. The evidence does not prove systematic underfunding, but it shows why maintenance of foundational open source is becoming part of the sovereignty discussion.

Website Feedback 1.2.2 was released on 4 September 2026 for Drupal 10.3 and later Drupal 10 releases and for Drupal 11. The module lets permitted users report problems from the page they are viewing, including screenshots, attachments, and

Bluefly.io will host Aaron “Checo” Pacheco, founder and CEO of OtterMon AI, for an online town hall on 10 September 2026. OtterMon AI says its platform combines information from monitoring, security, cost, and development tools to provide a unified view of system health. Pacheco’s earlier infrastructure and product roles at Acquia give the session additional relevance for Drupal teams managing production systems.

ECA Guide now includes six recipes for recurring Drupal content-editing and form tasks. The models cover AI-assisted metadata, permission-aware edit links, dependent selects, field actions, Ajax form updates, and HTMX-based guidance. Jürgen Haas presents them as adaptable starting points that teams should inspect and modify rather than deploy unchanged.

A Drupal rebuild moves page templates from custom Drupal 7 tables into content entities that store Layout Builder sections and components. Editors can save working pages as templates and reuse them while the import process regenerates component identity and destination-specific context mappings. The approach shows how Layout Builder templates can remain reusable when page configuration depends on data and schema supplied by an external system.

Arizona State University's Fulton Schools says all phase-one faculty and lab websites were migrated from WordPress into Drupal and Webspark by 31 August 2026. Fulton Schools Web Services is still reviewing migrated sites and publishing them as they become ready, while Enterprise Technology manages the centrally supported platform. The transition gives individual sites a shared Drupal maintenance environment while their content and users remain separately managed.

Commerce Project Browser 1.0.0-alpha1 was released on 7 August 2026, adding a Project Browser source for Commerce integrations on Packagist. Other extensions expose local custom recipes, configurable API-backed catalogues, and GitLab projects through the same source architecture. For Drupal site builders, the pattern broadens discovery while leaving maintenance, installation support, and security advisory coverage dependent on each project.

The Drupal Security Team published 16 contributed-project advisories on 2 September 2026, including five rated Critical. Twelve concern access bypass, with affected functions ranging from account verification and JSON:API restrictions to content permissions and private files. Corrective releases are available, although Mailer Plus Log also requires database updates and a permissions review after upgrading.

The Drupal Security Team published 15 contributed-project security advisories on 26 August 2026, covering 14 projects. Thirteen address access bypass, information disclosure or cross-site scripting; the remaining two concern insufficient input validation and cookie forgery. The advisories provide patched releases or supported upgrade paths for affected Drupal sites.

Drupal creator Dries Buytaert argues that open-source ecosystems also function as systems for allocating costs. He uses Drupal's update service, which he says handles nearly one billion requests a month, to illustrate how infrastructure costs can accumulate separately from technical decision-making authority. His broader argument is that governance should make clear who benefits, who decides, and who bears material costs as an open-source project grows.