News Roundup

CISA added two PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalogue on 26 October 2026, with a listed due date of 29 October. The records identify forensic-triage requirements under the applicable federal directive, while Specbee reports patching or mitigating exposure across more than 30 Drupal sites. Drupal hosting teams should verify their PHP installations and assess available evidence of earlier exploitation attempts.

Drupal's AI ecosystem has grown to hundreds of contributed modules built around the AI module, which more than 24,000 sites report using. This tracker groups the maintained projects by the job they do, such as alt text, site search with cited answers, AI agents, connections for outside assistants, workflows and cost tracking, and lists one module for each job. Each entry shows reported installs, the newest release and whether Drupal's security advisories cover it, as checked on Drupal.org.

DruxtJS has released version 0.25.0, its first JavaScript core package update since 2023. The release introduces server-side caching, fewer duplicate Drupal API requests and automatic display schema refresh when enabled. Developers can reduce backend traffic in decoupled Drupal applications, although the improvements require suitable cache settings and the framework still depends on Nuxt 2.

Drupal core committer Théodore Biadala has developed WordPal to convert WordPress block themes into Drupal themes and page structures for Canvas and Display Builder. Its public gallery reports thousands of completed conversions, but visual similarity does not guarantee fully editable components or production readiness. Biadala explains the WordPress Playground-based process, conversion limits, update challenges and the security review still needed before wider deployment.

Composer published version 2.11.0-RC1 on 22 October 2026. The release candidate removes a temporary download fallback setting and introduces an optional waiting period for newly published packages. Drupal teams using private dependencies and automated deployments may need to review their build configurations before upgrading.

Symfony launched a four-week online AI and MCP hackathon on 26 October 2026. Participants can build working applications, submit demonstrations and report problems before the technologies reach their first stable releases. The testing period is relevant to Drupal developers because Drupal AI and MCP Server already have documented connections to these PHP technologies.

Six contributors to DrupalCon Rotterdam's Government Summit have assessed Switzerland's decision to introduce an open-source workplace alongside Microsoft 365. Their responses examine migration risks, costs, staff adoption and the dependencies that can survive a change in software. The discussion connects government technology choices with open standards, public procurement and collaborative Drupal projects.

Gábor Hojtsy released Plural Forms Manager 3.1.0 for Drupal on 21 October 2026. It adds checks for missing plural translations and improves how language rules are preserved during imports and exports. Multilingual site teams can use the module to find errors that might otherwise affect published content.

Alessandro Feijó has revived the Beta of Outer-Core, a persistent browser-based space strategy game first developed in 2008. The game continues to operate on Drupal 6, while its separate public portal uses Drupal 11. The project offers Drupal developers a case study in maintaining complex application behaviour while planning a major platform migration.

The US Defense Human Resources Activity issued a sources-sought notice on 20 October 2026 for two civilian personnel websites. The draft requirements cover Drupal maintenance, secure cloud hosting, accessibility compliance and custom development. The notice follows a six-month extension of an existing contract and does not represent a new award.

GovCMS has announced a 10% subscription price increase effective 1 November 2026 for new subscriptions and renewals starting from that date. Existing prepaid subscriptions retain their current terms until renewal. The official pricing page reviewed still shows rates effective from November 2025, so agencies should confirm revised amounts through GovCMS.

Drupal.org's AI contribution policy requires contributors to review their submissions, take responsibility for the results and disclose significant AI assistance. Repeated low-quality submissions can lead to temporary or permanent bans, while separate instructions for AI coding agents are being evaluated in Drupal core. Contributors must understand what their tools produce, verify their work and remain engaged with maintainers.

The DropTimes will host its October Open Townhall on 28 October 2026 at 21:00 IST. The Zoom meeting continues the publication's open discussions about editorial priorities, community initiatives and reporting suggestions. Drupal contributors, developers, event organisers and readers can join the conversation and share feedback.

Colour psychology is not a universal formula. Anne Stefanyk of Kanopi Studios shares three practical approaches to audience research, consistent colour choices in Drupal and accessible contrast for better website design.

Inc. included Vancouver-based ImageX on its 2026 Power Partners list on 20 October. The agency appears in the AI, Technology and Development category and was also recognised in 2023 and 2025. For the Drupal community, the award recognises the agency's business services rather than a particular Drupal product or implementation.

Five Drupal and open-source community events are scheduled between 28 and 31 October 2026, including online sessions and gatherings in Portugal and Italy. The programmes cover accessibility advocacy, artificial intelligence, legacy Drupal migrations and open-source collaboration. Developers, site builders and community members can join technical demonstrations, discussions and in-person activities.

Drupal released three core maintenance updates on 21 October 2026. The releases update software dependencies and replace a deprecated PHP assertion setting in Apache configuration. Site administrators should review their configurations when applying the patches.

Southwestern Ontario Drupal Camp returns to Kitchener-Waterloo, Canada, on 23 and 24 October 2026. Its expanded programme includes an AI keynote, Drupal in a Day training and contribution time, with sponsorship keeping admission free. Organiser Megan McDermott says regional events help students and professionals access learning opportunities without the travel costs associated with larger conferences.

Southwestern Ontario Drupal Camp takes place on 23 and 24 October 2026 in Kitchener-Waterloo, Canada. Nine speakers shared insights with The DropTimes about artificial intelligence, accessibility, cloud infrastructure, Drupal CMS and module modernisation. The event combines technical presentations with practical training and opportunities to contribute to Drupal.

Drupal contributor Carlos Ospina has released vibe-config, a set of AI agent skills for creating Drupal backends for Next.js applications. The project uses existing Drupal modules and configuration to provide content management, authentication and API access. Its initial release supports local development, with community testing requested for macOS and Windows.

The AI Disclosure module for Drupal now supports spoken declarations for qualifying AI-generated audio alongside video labelling. Its October beta release can prepare audio files with audible notices and produce video copies with visible disclosure icons. The functionality gives Drupal publishers additional transparency tools while leaving legal classification and compliance decisions with site operators.

FlowDrop released three stable updates on 17 and 18 October 2026. The releases introduce testing inside the workflow editor and address problems with cancellation, resumed execution and operator responses. Drupal teams using FlowDrop should also review database updates, chat configuration and integration compatibility before upgrading.

The Drupal Association says Drupal.org has received the PHP security fixes and is undergoing a retrospective infrastructure audit. Amazon detected attempts to exploit PHP2Shell before the vulnerabilities were publicly disclosed, while new guidance identifies records worth examining. Drupal site operators are being urged to preserve evidence and investigate suspicious activity rather than relying on patch status alone.

Drupal 12 is in beta ahead of its target stable release in December 2026, and security support for Drupal 10 ends on 9 December 2026. The 12.0.0 alpha and beta releases set a minimum platform of PHP 8.5, Symfony 8.1 and PHPUnit 12.5, drop database updates from before Drupal 11.3.0, and move nine core modules and three themes to contributed projects. Site owners on Drupal 11 can check readiness today with Upgrade Status, PHPStan Drupal and Drupal Rector, and should require contributed replacements with Composer before upgrading rather than uninstalling removed core extensions.

The Drupal Security Team published 34 contributed-project security advisories on 21 October 2026. The vulnerabilities include remote code execution, authentication failures, cross-site scripting and restricted-file exposure across 31 projects. Administrators need project-specific fixes while also checking compatibility ahead of Drupal 12.

Drupal contributor Jürgen Haas has proposed a charter-first approach to the International Drupal Federation. His plan would establish the organisation's governance and responsibilities before prospective members consider joining and paying fees. The proposal contributes to an existing community discussion and has not been formally adopted.

Pamela Barone built a working Drupal CMS prototype in a two-hour period using Canvas and Mercury. Projects by Tojio and Mars with JAKALA offer a wider perspective on reusable components: they can accelerate implementation, but design, integration and stakeholder decisions still determine delivery.

Symfony has announced a new controller locking feature for its upcoming 8.2 release. The feature automatically manages locks and can reject conflicting requests or make them wait. Drupal already has its own locking API, but using this Symfony feature would require additional integration.

DrupalCamp Italy 2026 takes place in Bologna on 22 October, with six speakers sharing original insights with The Drop Times ahead of the event. Their experiences cover public-sector platforms, AI-assisted migrations, enterprise security, decoupled architecture and content editing. The accounts offer practical lessons for developers, architects, site builders and editorial teams working with Drupal.

GitHub has made AI Scan for pull requests generally available with support for PHP. The feature flags possible vulnerabilities and suggests fixes but cannot block merges or scan changes from forks. Drupal teams using GitHub can evaluate it, while Drupal.org's GitLab workflow remains outside its scope.

IncluD has independently verified three accessibility fixes in Morpht's Convivial for GovCMS starter site. Its follow-up assessment found no outstanding issues or warnings across 52 audited pages. The findings highlight why Drupal teams must continue checking components and editorial content as websites evolve.

Mercury Editor 3 reached its first stable release on 14 October 2026. The updated visual page builder adds autosaving, undo and redo controls, and an outline for navigating components. Drupal teams using Paragraphs-based layouts now have a stable upgrade option, with dependencies and customisations to review.

Dries Buytaert has documented how his Drupal photo module reuses tool and data descriptions across several interfaces. Tool API supports AI and workflow calls, while custom code connects the same definitions to OpenAPI and Drupal components. The Rosetta initiative seeks a broader approach that module maintainers could share.

Pantheon introduced P1 at its GoLive conference in Miami on 6 October 2026 and opened a limited paid beta. The platform lets people and AI agents build and review websites using approved components and shared release workflows. Drupal sites can continue managing their structured content while P1 handles the presentation and release of connected web experiences.

The DropTimes has curated three Drupal community events taking place from 19 to 25 October 2026. The programme includes online incident response training and DrupalCamps in Italy and Canada. These gatherings offer opportunities for Drupal users, developers and contributors to learn and connect.

Acquia DAM 1.1.19 introduces a standalone asset picker and an asset-usage detector for Site Studio. The release also improves focal-point handling and adds metadata field support in the Asset Library. The Drupal module supports Drupal 9.5, 10 and 11.

CKEditor has released version 49.0.0 with Shadow DOM and Trusted Types support. The update also changes its theme, AI review interface and error handling. Drupal developers can examine the upstream changes, although their availability in Drupal core is not established.

Drupal AI 1.5.0, released on 25 September 2026, separates five features into standalone projects. The release also deprecates AI Search and AI CKEditor while expanding chat processing, guardrails and automation capabilities. Site administrators need to review package changes and prepare for the planned removals in version 1.6.

Drupal contributors have moved three core maintenance targets to November 2026. The work covers stricter PHP code analysis, removal of outdated test annotations and simpler constructor code. Coordinating these changes is intended to reduce interruptions to ongoing Drupal development.

The Pacific Northwest Drupal Summit takes place in Vancouver on 17 and 18 October 2026. Speakers have shared their plans for sessions covering accessible design systems, Matrix integration, HTMX and local code quality tools. The presentations will explore practical approaches to building and maintaining Drupal websites.

Translation Template Extractor 3 has reached its first alpha release. The update replaces the module's architecture and corrects problems in how translatable strings are identified. The changes prepare an important part of Drupal's translation infrastructure for its next upgrade.

Drupal core contributors have resolved a testing issue opened in 2012. Compatible kernel tests can share database state across methods while keeping separate PHP processes. The change could shorten test runs for core and contributed modules.

Drupal developer Alexander Shumenko has released a Windows beta and Azure DevOps support for DevDeck, his desktop tool for tracking development work. The application sorts pull requests, notifications and local projects by urgency, and can share that status with coding agents on the same computer. Drupal developers can manage DDEV sites alongside their review queues, though the tool's licence restricts redistribution and modified versions.

PHP 8.6 Release Candidate 3 was published on 8 October 2026 for testing, not production use. Drupal contributors are tracking PHP 8.6 incompatibilities in upstream libraries, including a Guzzle Promises deprecation reported in October. Drupal has not declared PHP 8.6 supported for production, so site operators should use approved PHP versions.

Three Drupal site-building modules received releases on 13 October 2026. The updates address Drupal 12 compatibility, component rendering and disabled field groups. Two releases are stable, while the Field Group update remains a beta for testing.

The Drupal Security Team published five security advisories on 14 October 2026, including two Critical remote code execution vulnerabilities. The flaws affect Drupal core, the Entity List module, and the Gin administration theme, with some known attack paths requiring no authentication. Administrators should install the relevant core and contributed-project security releases to protect affected sites.

Developer Dražen Musa has released stable versions of SDC Critical CSS and Non-critical CSS for Drupal 10 and 11. One module places selected styles directly in the page, and the other loads the remaining stylesheets asynchronously. Site builders still choose the components needed for the first screen and check their layouts across devices.

Akismet Anti-Spam 1.1.0 adds Drupal 12 support and changes how webhook callbacks and sensitive configuration are handled. It also offers a one-way migration from the older community module, with consequences for stored records and form protection. Administrators should check configuration exports, proxy settings and migration steps before updating.