News Roundup

DrupalCamp Tokyo 2026 has released its session schedule ahead of the event on 27 June 2026. The programme includes a keynote by James Abrahams, a video message from Dries Buytaert, and sessions on AI, Drupal development, security, and community topics. The event will take place at SCSK Corporation Toyosu Front in Tokyo.

David Dowell has proposed a Module Families system for Drupal.org to improve the discovery and evaluation of contributed modules. The concept would group related projects and present structured comparison information such as install counts, maintenance status, and Drupal CMS inclusion. The proposal seeks to provide a clearer context for module selection while preserving choice within the Drupal ecosystem.

WordCamp Europe 2026 will take place from 4–6 June in Kraków, Poland. The conference follows the release of WordPress 7.0 and includes more than 50 talks and workshops alongside Contributor Day. Artificial intelligence, accessibility, security and enterprise publishing are among the event's recurring themes.

Mark Conroy has published a monthly summary of his LocalGov Drupal contributions for May 2026. The update covers work on the Modules List project, LocalGov Microsites and wider LocalGov Drupal development. The reported activities include bug fixes, testing improvements, release management and ongoing platform maintenance.

WebWash has published a tutorial comparing three Drupal site-building approaches. The guide examines traditional Drupal workflows, UI Suite with Display Builder, and Drupal Canvas. It concludes that the preferred approach depends largely on whether site builders or content editors drive page creation and maintenance.

Form File Usage is a new Drupal module developed by Alexander Shabanov. The project automates file usage tracking for custom Form API implementations and CKEditor 5 content. It manages file status transitions, usage records and cleanup processes that developers often implement manually.

GitHub engineers have proposed a framework for validating autonomous AI agents. The approach uses graph-based execution modelling and dominator analysis to identify the states required for successful task completion. The authors report that the method improved failure detection in experiments involving GitHub Copilot agent workflows.

Dries Buytaert has used Salesforce's planned acquisition of Contentful to examine the concept of digital sovereignty. He argues that a company's national identity can change through acquisition, potentially shifting legal obligations and governance structures. The post highlights open source software as a mechanism for preserving long-term choice and control.

ImageX has published a guide to common Drupal and web-development acronyms. The article explains terminology related to content management, infrastructure, security and marketing. It is intended to help readers better understand the technologies and concepts used in modern websites.

Francesco Maria Battaglia shares reflections from Drupal Dev Days Athens. The event marked his first major international Drupal conference and his first English-language conference presentation. He writes about mentorship, inclusion, and the role community plays in open source participation.

Proximify Inc. has published an analysis of the approaching end of support for Kentico Xperience 13. The company argues that the migration path to Xperience by Kentico may require substantial redevelopment effort. The post examines how the deadline could affect CMS procurement planning at universities.

Drew Robinson of Gaia Resources has published a reflection on DrupalSouth Wellington 2026. The post examines community contribution, Drupal CMS, AI-assisted development and government accessibility initiatives. Robinson concludes that Drupal's continued growth depends on the people who build and support the project.

Carlos Ospina has published a blog post describing the evolution of his AI-assisted development tooling. The article introduces a concept called agentic recipes, intended to coordinate feature-level implementation workflows for AI agents. Ospina presents the idea as a possible solution to recurring orchestration challenges in complex projects.

A participant account of Drupal Pivot Boston describes a more optimistic atmosphere than the inaugural gathering in Ghent. The author says attendees left the event with a manifesto and a call to action, although no details were released. The post highlights increased participation from Drupal leadership and continued discussion of economic pressures and artificial intelligence.

The Drupal AI Learners Club will host a live migration experiment on 4 June 2026. Angie Byron will attempt to use Claude Dynamic Workflows to upgrade a Drupal 7 blog to Drupal 11 during a public session. The event aims to explore the strengths and limitations of AI-assisted development on a complex legacy software project.

The Drupal Security Team has published advisory SA-CONTRIB-2026-038 for the AlternativeCommerce (Basket) project. The issue stems from unsafe deserialization of user-supplied data and may lead to PHP Object Injection. Sites running Basket versions earlier than 2.1.17 are advised to upgrade immediately.

Drupal community events scheduled from 2 to 6 June 2026 include an online Code of Conduct incident response workshop and meetups in Oxford and Edinburgh. Oaisys will also hold an AI practitioners meetup in Pune, hosted by QED42. The week’s events cover community governance, local Drupal discussion, social networking and applied AI practice.

Drupal AI 1.4.0 introduces new framework and developer tooling for AI-powered Drupal implementations. The release adds streaming guardrails, failover foundations, automation integrations, and new Drush generation commands. Marcus Johansson demonstrated the new capabilities in a video published alongside the release.

Drupal Forge has published the Driesnote Chicago demonstration as a reusable template environment. The template allows users to explore AI-assisted Drupal publishing and optimisation workflows presented during DrupalCon Chicago 2026. Features include content generation, page review, FAQ creation, schema generation, and performance testing.

Dan Frost examines how organisations respond to security advisories and software updates. The article argues that testing, rollback planning, and operational preparedness are often more important than deployment speed alone. It presents security response as an ongoing operational discipline rather than a race to apply patches.

Composer 2.10 introduces native malware protection powered by threat intelligence from Aikido Security. The release also adds a unified policy framework covering malware, security advisories, and abandoned packages. Additional updates include dependency-management enhancements and developer workflow improvements.Packagist

CKEditor will host a webinar on 25 June 2026 about using AI across structured editing interfaces. The session will cover multi-root editors, multiple editor instances, and context-aware AI features. Ondřej Chrastina will interview Witek Socha during the one-hour event.

Amber Matz explores the impact of AI-assisted contributions on open source project maintenance. The article draws on a conversation with DDEV maintainer Randy Fay about reviewing substantial AI-generated pull requests. It highlights how questions of trust, responsibility, and expertise are becoming increasingly important as AI tools reshape software development workflows.

Ravikant examines the role content editors play in maintaining Drupal accessibility. The guide covers headings, alt text, links, tables, and editorial publishing practices. It also highlights Drupal tools that help identify accessibility issues during content creation.

Aaron Wolfe describes a Drupal architecture for managing complex legal intake workflows. The implementation uses reusable Webform datasets grouped into packet-based processes. Shared submission data and workflow tracking help reduce repetitive form entry and improve usability.

Nino Marrazzo has released drupal_rag, an alpha-stage Drupal 11 module for Retrieval-Augmented Generation workflows. The module uses Ollama for embeddings and PostgreSQL with pgvector for semantic retrieval. It allows Drupal content to be queried in natural language without relying on external AI services.

Joost de Valk examines the limits of Open Source First procurement policies in Europe. The essay argues that open-source licensing alone does not prevent infrastructure centralisation or governance capture. It calls for public funding models that support shared and independently governed digital infrastructure.

Organisers of the first DrupalCan Summit have opened a survey seeking feedback on event location and ticket pricing. The responses will help guide planning for the 2027 gathering. Community members are encouraged to share their preferences before event decisions are finalised.

Daniel Veza explores semantic search and Retrieval-Augmented Generation workflows using OpenSearch and Drupal. The presentation examines vector embeddings, hybrid search, and AI-assisted answer generation. OpenSearch configuration, retrieval accuracy, and implementation trade-offs are discussed throughout the session.

Michael Anello has published a DrupalEasy quick tip about adapting to GitLab-based Drupal issue queues. The article discusses notification settings, issue tracking, and subscription behaviour. It highlights several workflow differences contributors may encounter during the transition.

Dominique De Cooman examines how AI is changing software platform economics. The article argues that software markets are moving from fragmentation toward rebundled platforms focused on governance and orchestration. Open-source and proprietary approaches to that transition are compared throughout the essay.

Talking Drupal episode 554 features Scott Tolinski discussing developer education and his history with Drupal. The conversation explores changes in frontend development, learning platforms, and modern web technologies. The episode also highlights the Views Row SDC module and component-based theming workflows.

José Fernandes argues that Drupal is strong as a platform for AI-powered content consumption, but difficult for AI-assisted software development. The article examines architectural factors that contribute to both outcomes. It also proposes developer-tooling improvements to help AI agents work more effectively with Drupal.

Phil Norton has begun a Drupal 11 tutorial series focused on building a custom link directory. The implementation uses custom entities, Views, Chromium-based screenshots, and automated content ingestion. The article also explores Drupal 11 hooks and crawler-based workflows.

Jacob Rockowitz examines how AI crawlers and automated agents are changing web publishing ecosystems. The article discusses structured data, AI consumption patterns, governance challenges, and evolving user experience strategies. Drupal’s AI ecosystem and structured architecture are presented as tools for adapting to those changes.

1xINTERNET published an article examining AI Content Intelligence workflows across enterprise Drupal ecosystems. The post discusses governance, structured content analysis, orchestration, and AI observability at large operational scale. Drupal’s structured architecture and MCP integrations are presented as key enabling systems for enterprise AI governance.

Théodore Biadala published an analysis examining Drupal Core change records from 2018 through Drupal 12 development. The article focuses on deprecations, contrib adaptation patterns, and automated upgrade tooling. Rector rules and backward compatibility policies are presented as major factors reducing ecosystem disruption.

John Locke examines how AI-assisted vulnerability discovery and automated attacks are changing infrastructure security practices. The article discusses Linux kernel exploits, supply chain attacks, Drupal security response workflows, and declarative infrastructure management. Recovery planning, backup isolation, and operational resilience are presented as central themes throughout the analysis.

Todd Coen and Anthony Mangini examine how Drupal’s structured architecture aligns with emerging AI-driven content infrastructure requirements. The article discusses governance workflows, structured entities, API-first delivery, and AI-assisted publishing systems. Federal compliance, auditability, and operational control are recurring themes throughout the analysis.

The Drupal ECA project has added an in-context automation interface for form workflows. Users can apply predefined automation templates directly from form editing screens without opening the Workflow Modeler. The feature aims to reduce the learning barrier around ECA configuration while preserving access to full workflow customisation.

Thomas P. Scola Jr. has proposed the term “Agent-Managed Content System” to describe platforms designed for AI agents operating alongside human editors. The article argues that Drupal’s structured content model and governance systems align with that transition. The post also discusses emerging standards work around agent identity, discovery, and contract governance.

DrupalCon Rotterdam 2026 will host new Higher Education and Government summits before the main conference programme begins. Both events are scheduled for 28 September 2026 at the Postillion Hotel & Convention Centre WTC Rotterdam. Organisers are inviting proposals focused on collaboration, digital transformation, governance, and Drupal-based institutional infrastructure.

GitCMS compares its repository-first publishing model with Drupal’s enterprise CMS architecture. The comparison highlights markdown workflows, Git-based collaboration, static deployment, structured content, permissions, multilingual publishing, and operational complexity. The distinction is less about direct replacement and more about choosing a publishing model that fits team structure, content scale, and governance needs.

Drupal developer Jesse L. released AI Entity Intake 1.0.0-alpha1 for Drupal 10.5 and Drupal 11.2. The module converts unstructured text into draft Drupal entities for human review and approval. It supports content suggestions for nodes, taxonomy, media, commerce products, paragraphs, and group relationships.

DrupalCafeLutsk 31 is scheduled for 28 May at 19:00 EET in Lutsk, Ukraine. The event will include talks on AI-assisted Drupal workflows, Apple ecosystem technologies, and AI-driven team collaboration. Attendance is free both onsite and through the event’s YouTube stream.

CISA has directed U.S. federal agencies to patch the actively exploited Drupal vulnerability CVE-2026-9082. The flaw affects Drupal’s database abstraction API and enables unauthenticated SQL injection attacks on PostgreSQL-powered sites. Researchers and security firms have reported widespread exploitation attempts targeting thousands of Drupal installations worldwide.

Dries Buytaert has called on Drupal companies to focus on strengthening the shared open source ecosystem rather than attacking competitors. The Drupal founder argued that stewardship includes contributions to code, security, events, documentation, and adoption efforts. He said long-term trust in Drupal depends on the health of the wider community and software commons.

A new Drupal development toolkit combines Claude Code configuration with repository safety controls and coding-standard checks. The setup includes protections against exposed secrets, unsafe repository operations, and invalid commits. The project is designed for Drupal 10 and 11 workflows running with DDEV.

Priyanka Phukan examines enterprise Drupal maintenance practices covering security updates, deployment workflows, monitoring, backups, and performance optimisation. The article also discusses Drupal 11 upgrade planning, infrastructure resilience, and operational governance for large-scale Drupal platforms.