News Roundup

Three in-person Drupal events are scheduled between 10 and 12 September 2026 in Germany, Poland, and India. Drupal User Group Ruhr will gather in Bochum, DrupalCamp Poland will run a one-day conference in Wrocław, and Drupal Ahmedabad will meet at cmsMinds. The week gives Drupal community members regional opportunities for technical learning, discussion, and in-person connection.

Omega8 recounts how it used AI coding agents to rebuild documentation for the BOA Drupal and Backdrop hosting stack. The company says an early attempt produced fabricated and misinterpreted material, while a later workflow tied documentation claims back to the underlying code before expanding into testing and maintenance work. For Drupal infrastructure teams, the experience illustrates the value of domain expertise and traceable verification when agents work across long-lived systems.

Symfony Reprise 1.0.0 establishes a stable public API for Symfony projects using Vite or Rsbuild. The milestone follows work on copied assets, manifest consistency, integrity handling, testing, and migration from Webpack Encore. For Drupal readers, the release is upstream Symfony ecosystem context rather than a change to Drupal's own frontend tooling.

Markdownify 1.2.0 adds YAML frontmatter with metadata and structured data to Markdown representations of Drupal content. The release can draw information from Drupal fields, Metatag, and Schema Metatag, while also adding view-mode selection and broader Markdown support for Views pages. Drupal sites using Markdown output for developers, bots, or AI agents can provide those consumers with more page context alongside the converted content.

Security researchers have published new findings on a March supply-chain campaign that compromised Trivy tooling before reaching LiteLLM. Later analysis indicates that most of the wider credential collection began before the malicious LiteLLM packages appeared, while the contributed Drupal provider connects sites to a separately operated LiteLLM instance. For Drupal teams using that integration, the incident illustrates an external service dependency without showing that Drupal itself was compromised.

Lucas Cunico Kalinowski argues that some mistakes in AI-assisted Drupal development can survive tests, linters, and successful deployments without producing an obvious error. His examples involve permission-aware caching, cache expiry, content-list invalidation, and configuration synchronisation. For Drupal teams using coding agents, he recommends concentrating human review on places where core depends on contextual or lifecycle information being declared explicitly.

DrupalAsia Connect India 2027 has opened its call for speakers, with proposals due 18 September 2026. The event will run from 21–23 January 2027 at IIT Bombay in Mumbai, with 45-minute talks and 20-minute lightning talks across seven tracks. Speakers may submit up to two proposals, and accepted sessions receive one free event ticket.

FlowDrop 2.4.0 adds Port Shapes that let workflow ports carry named concepts such as orders, invoices, and conversations. The editor displays those types and offers connections only between matching ports, while administrators and modules can define the available shapes. For Drupal teams building larger orchestration graphs, the change makes the meaning of connections more explicit while keeping the feature specific to FlowDrop.

Carlos Ospina proposes separating durable instructions from technical guidance and environment-specific context in AI agent workflows. Drawing on his Drupal development tooling, he describes guides, decisions, and process recipes as distinct layers that can change independently. For Drupal teams, the idea highlights both the need to keep agent context current and the possibility that richer stored context can make some models more inclined to agree rather than challenge.

Will Huggins argues that organisations should prepare Drupal content and services for AI agents as well as human visitors. He points to structured content, metadata, relationships, roles, and permissions as ways to help automated systems interpret information and operate within defined limits. For Drupal teams, the argument connects existing governance practices with the Drupal AI Initiative's Inside AI and Outside AI workstreams.

StepSecurity says its threat-intelligence team tracked 56 software supply-chain compromises over the previous 12 months. The company says the incidents involved trusted packages, GitHub Actions, and developer tooling, with recurring exposure around credentials, mutable references, and build environments. For Drupal teams, the Laravel-Lang compromise provides a relevant Composer example of how a trusted dependency can become a path for malicious code and CI credential theft.

GovCMS has made Rules as Code available as a production capability for government agencies using the platform. Its first production implementation is the GovCMS Eligibility Checker, while new functionality allows existing sites to connect with the OpenFisca rules engine. For Drupal teams, the release provides a production government example of policy logic being maintained separately from the front-end service that uses it.

Drupal core committer Théodore Biadala has added Composer and patch-management tools to the Drupal-Code-Query MCP server. He says the backend uses locally indexed Drupal repositories rather than an LLM to generate compatibility and patch results, with some checks also available through read-only APIs. The tools target repetitive work in patch-heavy Drupal upgrades, while the reported improvements in speed and cost come from Biadala’s own tests.

Shawn Duncan explains how Drupal 11.3 can produce reduced HTML responses for HTMX interactions. Core can use either a dedicated route option or a wrapper format to return main content and required assets while keeping cache variants separate. For Drupal developers, the walkthrough shows how HTMX requests fit into the existing rendering, routing, and caching systems.

Image Scale and Fill Background Effect reached its first stable Drupal release on 24 August 2026 after gaining security advisory coverage. The review led to tighter validation, image-processing safeguards, automated tests, and configuration changes, while version 1.1.0 added handling for transparent images. Drupal sites can use the module to generate fixed-size image derivatives without cropping while preserving the complete source image.

Tom Hollevoet reflects on his DrupalCamp Kortrijk session about the gap between client requests and the problems behind them. He uses a simple button-change example to show why developers should ask about goals, context, risk, and success before implementation. As AI makes code faster to produce, he argues that client understanding and better questions become more important parts of Drupal delivery.

Mike Herchel will join a Bluefly Town Hall for a live demonstration of Dripyard's component-based Drupal themes. He will also discuss his new role at Acquia. The session gives Drupal developers and themers a direct look at the Dripyard approach.

WordCamp US 2026 reported 425 Contributor Day participants working in 26 teams, alongside more than 1,100 registrations for the wider event. Showcase Day sessions described Daily Kos moving millions of posts, users, and comments from a custom CMS, while The Ankler moved its newsletters from Substack to WordPress. The cases give the Drupal community current comparison points for content, community, membership, and data-control requirements in large publishing migrations.

CISA has listed CVE-2026-64849, an actively exploited MLflow vulnerability, in its Known Exploited Vulnerabilities Catalog. The flaw can let an attacker use an exposed MLflow server to reach internal services or cloud metadata and read returned data. Drupal is not affected, but teams running Drupal alongside separate AI infrastructure need to assess those services independently.

Specbee announced on 31 August 2026 that it had joined the Drupal AI Initiative as a Silver partner. Drupal says participating partners provide funding and dedicated staff while receiving benefits that include roadmap access, training and early information about developing capabilities. The model connects agency participation with funded, coordinated AI development for the wider Drupal project.

The W3C Dataset Exchange Working Group published a First Public Working Draft of the Profiles Vocabulary on 20 August 2026. PROF uses RDF to describe how specialised profiles relate to broader specifications and to supporting resources such as schemas, validation tools and guidance. Drupal projects using DCAT profile extensions such as DCAT-AP have a standards connection to the work, but the draft introduces no change to Drupal itself.

The Pacific Northwest Drupal Summit has published its 2026 session schedule for the 17–18 October event in Vancouver. Organisers loosely group the current sessions into AI Strategy, Accessibility and Design, and Case Studies and Coding, alongside a keynote and other community programme elements. Early-bird registration closes 4 September 2026, with regular registration closing 2 October 2026.

Symfony has released Symfony Language Tools, an experimental official language server for framework-aware editor support. It combines source analysis with runtime metadata to provide completion, navigation, diagnostics and related features across PHP, Twig and YAML. Drupal shares several of the underlying technologies, but Symfony does not currently document Drupal as a supported application or provide Drupal-specific setup guidance.

The U.S. Government Publishing Office is seeking Azure hosting, maintenance, and technical support for the Drupal 10-based FDLP.gov and FDLP eXchange platforms. The procurement covers a one-year base period and four option years, with requirements including FedRAMP-compliant hosting, system monitoring, application maintenance, and ongoing Drupal support. Offers are due on 10 September 2026 at 14:00 EDT.

The W3C Sustainable Web Interest Group has published the first Group Note Draft devoted to Web Sustainability Guidelines Impact Ratings. The framework combines ratings for people, planet and prosperity with an expected timeframe to help organisations prioritise guidelines. Drupal sustainability documentation references the broader Web Sustainability Guidelines, although there is no evidence that the project has adopted the new ratings.

Abhisek Mazumdar released ddev-langfuse 1.0.0 on 2 August 2026 for running a self-hosted Langfuse stack inside a DDEV project. The add-on starts six supporting services, generates required secrets, and creates the initial Langfuse project and credentials automatically. Built with Drupal AI development in mind, it gives teams a local environment for tracing and examining model activity without maintaining a separate Langfuse deployment.

The Drupal AI project released versions 1.4.7 and 1.3.12 on 19 August 2026. Both branches fix six defects affecting agent-memory sequencing, AI Automator targeting, agent tool configuration, provider configuration, generated-link guidance, and DeepChat positioning. Version 1.4.7 adds five further changes, including fixes for Translate Text Explorer and agent-tool configuration alongside two maintenance tasks and a shared icon addition.

Théodore Biadala has added a hosted Model Context Protocol server to Drupal Code Query. The interface exposes its existing core and contrib dataset through tools for code search, API-change analysis, project compatibility, dependency relationships, usage trends, and historical test coupling. Drupal maintainers can use those queries when investigating upgrades, core API changes, and readiness for target versions such as Drupal 12.

Cheppers has published an ExperienceKit guide on organising and governing Drupal libraries built with Single Directory Components. The article covers props, slots, component tiers, documentation, accessibility review, versioning, and gradual migration from established theme patterns. For Drupal teams, it frames SDC governance as the layer that keeps reusable components predictable for developers, editors, page builders, and automated systems.

Jérôme Tchania has released the stable 1.0 line of AI Metering for tracking Drupal AI token usage and estimated costs. The module records calls across registered providers, reports usage by user and role, and can enforce monthly quotas through local fallback or pre-flight blocking. Version 1.0.2 also corrects metering, cost-estimation, and quota issues discovered after the first stable release.

Janna Malikova has won the 2026 Drupal Association Community At-Large Board election. She received 141 approvals in an eight-candidate contest in which 307 of 1,274 eligible members participated. Her two-year term begins on 1 November, when she succeeds Alejandro Moreno in the community-elected seat after identifying small site builders, small businesses, and documentation as priorities.

Provider Map 1.0.0-alpha1 was released on 17 August 2026 for Drupal 10.3 and 11. The module combines provider records imported from CSV files with GeoJSON service regions and renders the map as inline SVG without an external mapping library or tile server. It gives Drupal sites a specialised directory model for showing who serves a defined area rather than who is closest to a point.

Eight Drupal events are scheduled from 31 August through 7 September 2026, including three online events and five hybrid or in-person gatherings. The schedule covers AI integration, front-end certification preparation, data privacy, semantic search, Drupal Canvas, Single Directory Components, and Drupal 11 discussion. The week gives Drupal developers and site builders options for both structured learning and local community participation.

Lucas Cunico Kalinowski has released Drupal Cache Playground, an interactive browser-based tool for learning how Drupal caching behaves. Users can model cache tags, contexts, expiry, and lazy building before sending simulated traffic and watching cache variations appear or disappear. The tool gives developers, QA teams, and trainers a visual way to understand cache interactions that can be difficult to predict from individual API concepts alone.

Acquia DAM now provides an MCP Server that connects compatible AI assistants to digital asset libraries through the Model Context Protocol. Authenticated users can search permitted assets, retrieve asset details and CDN links, and inspect metadata while retaining their existing DAM permissions. The initial release is read-only and is available to customers with the REST API feature enabled.

Bluefly.io will host Jay Callicott for a Decoupled.io demonstration at 18:00 UTC on 28 August 2026. The platform combines managed Drupal hosting with GraphQL, JSON:API, artificial intelligence features, and Model Context Protocol tooling. The session gives Drupal teams evaluating decoupled architecture a live look at the platform's hosting and AI agent integration approach.

Webform module maintainer Jacob Rockowitz has stripped back the AGENTS.md file and agent skills used in his AI-assisted Drupal workflow after moving to newer coding models. He says improved planning reduced the need for some additional guidance, and after removing AI Best Practices for Drupal he observed no significant decline in code quality with his current models, though he still sees those skills as useful for older and cheaper models. His experience raises a broader question about which programming skills developers continue to exercise as coding agents take on more implementation work.

Joomla and Umbraco released security fixes on 18 August 2026 for vulnerabilities affecting their CMS products and related components. Joomla fixed ten issues, including a multi-factor authentication bypass and several access-control failures, while Umbraco patched a High-severity authorization flaw that can lead to code execution when an attacker has a low-privilege backoffice account. For Drupal agencies maintaining mixed CMS estates, the releases highlight the operational risks of unsupported branches and inconsistent authorization checks.

John Doyle, CEO at Digital Polygon, and Ashraf Abed, founder of Drupito, will present a webinar at 17:00 UTC on 31 August 2026 about matching Drupal delivery models to project requirements. The session will compare managed platforms and custom builds using content models, integration count, governance, internal capacity and five-year ownership costs. For Drupal teams, the discussion is intended to support earlier decisions about scope, budget and how much custom development a project needs.

Kevin Quillen has released Canvas Fields 1.0.0-alpha1, a contributed module that adds standard Drupal fields to Canvas Page entities. The module supports fields such as text, entity references, and lists for tagging, filtering, search, and content relationships, although not every field type or widget is supported. For Drupal 11 and 12 sites, it provides a bridge between Canvas page building and Drupal's structured-content workflows.

Drupal's /llms.txt module released version 1.1.1 on 16 August 2026 with two bug fixes. One prevents an edge case in Views-token handling from producing an unexpected-error page when the expected content-section field is absent. The other removes a PHP warning during outbound URL processing, making this a targeted maintenance update for sites using the module.

WordPress released version 7.0.4 on 12 August 2026 to fix CVE-2026-65640, a high-severity remote code execution vulnerability. Exploitation requires a malicious user with file-upload capability and a server using both Imagick and Ghostscript, and patched releases now extend through the 4.7 branch. For Drupal teams using comparable media-processing stacks, the case highlights why external image and document processors need to be considered part of a site's security boundary.

Jerome Fitzgerald, minister of economic affairs for The Bahamas, proposed four priorities for Caribbean digital sovereignty at the 41st CANTO Annual Conference and Trade Exhibition. They cover a regional sovereignty compact, federated cloud infrastructure, sovereignty requirements for public technology contracts, and treatment of Caribbean data as an economic, cultural and national security asset. For Drupal teams serving Caribbean public-sector organisations, the proposals point to procurement expectations around open standards, portability, auditability and provider exit.

Lucas Hedding, a Drupal core authentication and authorization subsystem maintainer, has outlined an AI-assisted proposal for modernising Drupal core authentication. He says Claude helped process more than 1,200 open issues and organise the findings into a YAML-based pluggable authentication flow, but no code has been written. The planning issue gives Drupal contributors a phased architecture to review before implementation begins.

DrupalCamp Colorado 2026 begins with optional paid training on 26 August 2026 before the free camp runs on 27–28 August at Denver's Lowry Conference Center. The workshops cover Drupal AI content workflows, accessible authoring and conversational design, while Thursday sessions address multisite governance and staged publishing with Entity Share. For Drupal teams, the programme connects implementation choices with longer-term questions about content quality, platform ownership and production workflows.

DrupalCon Orlando 2027 is accepting applications for three volunteer roles through 15 September 2026. The openings cover speaker review, newcomer support, and community advocacy, with different time commitments and ticket benefits. The round gives Drupal community members several ways to contribute to the conference program and attendee experience before the March 2027 event.

Symfony founder Fabien Potencier announced a four-person Symfony AI Core Team on 13 August 2026, led by Christopher Hertel. Symfony says the project now spans more than 90 packages and has received contributions from more than 160 people through over 3,800 commits and 1,600 merged pull requests. The governance change has direct relevance for Drupal AI, whose contributors are evaluating Symfony AI components as a possible replacement for parts of Drupal AI’s existing provider abstraction.

Australia’s Department of Finance has released a request for tender for a new GovCMS Drupal Services and Digital Experience Platform Services Panel. The tender closes on 7 October 2026, with services expected to begin in the third quarter of the 2026–27 financial year. The procurement will determine the next approved supplier arrangement for Drupal and digital experience services used across Australian government agencies.

ECA 3.1.6 was released on 17 August 2026 with 19 resolved issues and support for Drupal 11.3 and Drupal 12. It fixes configuration schema, token handling, access checks, and the upgrade path from ECA 2.1 to 3.1 after ECA 3.1.5 added a Guide Library source for Project Browser and tighter migration-process controls. The two August releases combine new integration capabilities with follow-up fixes for configuration, upgrades, and Drupal 12 compatibility.