News Roundup

DrupalCon Orlando 2027 Early Bird registration opens on 14 September 2026 with a $650 general admission rate. Regular registration is set at $850, while late and onsite registration rises to $1,200, putting every main paid tier above Chicago 2026. The $550 early-to-late gap makes registration timing a larger cost factor for attendees planning for Orlando.

Smart Image Optimizer provides automated WebP and AVIF conversion for JPEG and PNG images on Drupal 10 and 11 sites. The module supports configurable quality, bulk processing, image-style derivative handling, and optional removal of original files, while its current 1.0.1 release includes a Drupal 10.2+ and 11 compatibility fix. The project is available on Drupal.org but is not currently covered by Drupal's security advisory policy.

Drupal teams are absorbing fast-moving AI work, deeper performance changes, and new expectations around how Drupal expertise is packaged and delivered. Four DrupalCamp Poland speakers tell The DropTimes where they think the practical learning lies.

Harvard Web Publishing is continuing live Drupal training this autumn as part of a wider support model for the university's HarvardSites platform. HUIT's FY25 annual report records 1,899 migrated websites, while a survey of 149 site builders found a satisfaction score of 3.4 out of five and 45% of respondents neutral or dissatisfied. For Drupal teams running large distributed estates, the findings highlight the operational role of training, guidance, and governance alongside the platform itself.

Drupal core contributors are reviewing a Drupal 12 proposal for a node reference limitation first reported during Drupal 8. The setting would let reference fields include unpublished nodes according to permissions the current user already holds. The change could remove a long-standing obstacle in staged and moderated publishing workflows without expanding editor privileges.

Chad Capellman reflects on Drupal GovCon 2026 and how AI is changing his view of Drupal's role. He describes hands-on work with Drupal AI assistants, automated content tasks, conversational site building, and AI-supported search across large collections of content. He argues that Drupal's flexibility and extensibility can provide useful foundations for orchestrating AI alongside established content-management workflows.

OpenAI has launched Daybreak for Frontline Defenders, committing $1 billion in subsidised Daybreak access alongside training, technical support and partnerships. The programme starts with the United States, where open-source maintainers and essential-service organisations are among the priority groups, with the subsidised access targeted for use over six months. Drupal maintainers and public-sector Drupal teams may fit those categories, but OpenAI has not announced Drupal-specific eligibility or participation.

Varbase Starter 1.0.0 became the project's first stable release on 6 September 2026. The site template combines 24 Drupal CMS and Varbase recipes with Vartheme BS5, search, editorial workflow, a Canvas-built home page, and demo content. The release gives the Drupal community a stable example of an established distribution adopting recipe-based site assembly alongside Drupal CMS.

UI Suite says Rajab Natshah's team is extending the Display Builder AI strategy to include UI Kit, Penpot and automated design-token workflows. The module already supports prompt-based page building, but the newer design-system workflow has not been demonstrated end to end. Drupal's Design Tokens API, committed to the core main branch on 7 September 2026, provides related infrastructure as that strategy develops.

Drupal core 12.0.0-alpha1 was released on 2 September 2026 as the first tagged pre-release in the Drupal 12 cycle. It requires PHP 8.5, moves to Symfony 8.1 and Guzzle 8, and removes several deprecated core extensions. Module, theme and distribution maintainers can begin compatibility testing now, but the alpha is not supported for production use and further dependency changes are expected before beta1.

DDEV released version 1.25.4 on 2 September 2026 with automatic database seeding and reset, global configuration, and MySQL 9.7 support. The release also adds new Linux package repositories and several fixes affecting Drupal projects. For Drupal teams, the changes reduce repeated setup work and make shared local development configuration easier to maintain.

Drupal's GitLab Templates project has a tested Twig coding-standards job ready for contributed projects, with default activation deferred until Drupal 11.5. Drupal core adopted Twig CS Fixer in July 2026, adding automated checks for Twig templates to its continuous integration pipeline. The contrib rollout will give project maintainers a shared standards check without requiring their own Twig linting setup.

DrupalCon Rotterdam's Government Summit will put digital sovereignty and open-source public services on the agenda on 28 September 2026. European Commission and GovCMS figures show Drupal operating at substantial public-sector scale, while Germany's Sovereign Tech Agency funds upstream work in both Drupal and PHP. The evidence does not prove systematic underfunding, but it shows why maintenance of foundational open source is becoming part of the sovereignty discussion.

Website Feedback 1.2.2 was released on 4 September 2026 for Drupal 10.3 and later Drupal 10 releases and for Drupal 11. The module lets permitted users report problems from the page they are viewing, including screenshots, attachments, and

Bluefly.io will host Aaron “Checo” Pacheco, founder and CEO of OtterMon AI, for an online town hall on 10 September 2026. OtterMon AI says its platform combines information from monitoring, security, cost, and development tools to provide a unified view of system health. Pacheco’s earlier infrastructure and product roles at Acquia give the session additional relevance for Drupal teams managing production systems.

ECA Guide now includes six recipes for recurring Drupal content-editing and form tasks. The models cover AI-assisted metadata, permission-aware edit links, dependent selects, field actions, Ajax form updates, and HTMX-based guidance. Jürgen Haas presents them as adaptable starting points that teams should inspect and modify rather than deploy unchanged.

A Drupal rebuild moves page templates from custom Drupal 7 tables into content entities that store Layout Builder sections and components. Editors can save working pages as templates and reuse them while the import process regenerates component identity and destination-specific context mappings. The approach shows how Layout Builder templates can remain reusable when page configuration depends on data and schema supplied by an external system.

Arizona State University's Fulton Schools says all phase-one faculty and lab websites were migrated from WordPress into Drupal and Webspark by 31 August 2026. Fulton Schools Web Services is still reviewing migrated sites and publishing them as they become ready, while Enterprise Technology manages the centrally supported platform. The transition gives individual sites a shared Drupal maintenance environment while their content and users remain separately managed.

Commerce Project Browser 1.0.0-alpha1 was released on 7 August 2026, adding a Project Browser source for Commerce integrations on Packagist. Other extensions expose local custom recipes, configurable API-backed catalogues, and GitLab projects through the same source architecture. For Drupal site builders, the pattern broadens discovery while leaving maintenance, installation support, and security advisory coverage dependent on each project.

The Drupal Security Team published 16 contributed-project advisories on 2 September 2026, including five rated Critical. Twelve concern access bypass, with affected functions ranging from account verification and JSON:API restrictions to content permissions and private files. Corrective releases are available, although Mailer Plus Log also requires database updates and a permissions review after upgrading.

The Drupal Security Team published 15 contributed-project security advisories on 26 August 2026, covering 14 projects. Thirteen address access bypass, information disclosure or cross-site scripting; the remaining two concern insufficient input validation and cookie forgery. The advisories provide patched releases or supported upgrade paths for affected Drupal sites.

Drupal creator Dries Buytaert argues that open-source ecosystems also function as systems for allocating costs. He uses Drupal's update service, which he says handles nearly one billion requests a month, to illustrate how infrastructure costs can accumulate separately from technical decision-making authority. His broader argument is that governance should make clear who benefits, who decides, and who bears material costs as an open-source project grows.

Three in-person Drupal events are scheduled between 10 and 12 September 2026 in Germany, Poland, and India. Drupal User Group Ruhr will gather in Bochum, DrupalCamp Poland will run a one-day conference in Wrocław, and Drupal Ahmedabad will meet at cmsMinds. The week gives Drupal community members regional opportunities for technical learning, discussion, and in-person connection.

Omega8 recounts how it used AI coding agents to rebuild documentation for the BOA Drupal and Backdrop hosting stack. The company says an early attempt produced fabricated and misinterpreted material, while a later workflow tied documentation claims back to the underlying code before expanding into testing and maintenance work. For Drupal infrastructure teams, the experience illustrates the value of domain expertise and traceable verification when agents work across long-lived systems.

Symfony Reprise 1.0.0 establishes a stable public API for Symfony projects using Vite or Rsbuild. The milestone follows work on copied assets, manifest consistency, integrity handling, testing, and migration from Webpack Encore. For Drupal readers, the release is upstream Symfony ecosystem context rather than a change to Drupal's own frontend tooling.

Markdownify 1.2.0 adds YAML frontmatter with metadata and structured data to Markdown representations of Drupal content. The release can draw information from Drupal fields, Metatag, and Schema Metatag, while also adding view-mode selection and broader Markdown support for Views pages. Drupal sites using Markdown output for developers, bots, or AI agents can provide those consumers with more page context alongside the converted content.

Security researchers have published new findings on a March supply-chain campaign that compromised Trivy tooling before reaching LiteLLM. Later analysis indicates that most of the wider credential collection began before the malicious LiteLLM packages appeared, while the contributed Drupal provider connects sites to a separately operated LiteLLM instance. For Drupal teams using that integration, the incident illustrates an external service dependency without showing that Drupal itself was compromised.

Lucas Cunico Kalinowski argues that some mistakes in AI-assisted Drupal development can survive tests, linters, and successful deployments without producing an obvious error. His examples involve permission-aware caching, cache expiry, content-list invalidation, and configuration synchronisation. For Drupal teams using coding agents, he recommends concentrating human review on places where core depends on contextual or lifecycle information being declared explicitly.

DrupalAsia Connect India 2027 has opened its call for speakers, with proposals due 18 September 2026. The event will run from 21–23 January 2027 at IIT Bombay in Mumbai, with 45-minute talks and 20-minute lightning talks across seven tracks. Speakers may submit up to two proposals, and accepted sessions receive one free event ticket.

FlowDrop 2.4.0 adds Port Shapes that let workflow ports carry named concepts such as orders, invoices, and conversations. The editor displays those types and offers connections only between matching ports, while administrators and modules can define the available shapes. For Drupal teams building larger orchestration graphs, the change makes the meaning of connections more explicit while keeping the feature specific to FlowDrop.

Carlos Ospina proposes separating durable instructions from technical guidance and environment-specific context in AI agent workflows. Drawing on his Drupal development tooling, he describes guides, decisions, and process recipes as distinct layers that can change independently. For Drupal teams, the idea highlights both the need to keep agent context current and the possibility that richer stored context can make some models more inclined to agree rather than challenge.

Will Huggins argues that organisations should prepare Drupal content and services for AI agents as well as human visitors. He points to structured content, metadata, relationships, roles, and permissions as ways to help automated systems interpret information and operate within defined limits. For Drupal teams, the argument connects existing governance practices with the Drupal AI Initiative's Inside AI and Outside AI workstreams.

StepSecurity says its threat-intelligence team tracked 56 software supply-chain compromises over the previous 12 months. The company says the incidents involved trusted packages, GitHub Actions, and developer tooling, with recurring exposure around credentials, mutable references, and build environments. For Drupal teams, the Laravel-Lang compromise provides a relevant Composer example of how a trusted dependency can become a path for malicious code and CI credential theft.

GovCMS has made Rules as Code available as a production capability for government agencies using the platform. Its first production implementation is the GovCMS Eligibility Checker, while new functionality allows existing sites to connect with the OpenFisca rules engine. For Drupal teams, the release provides a production government example of policy logic being maintained separately from the front-end service that uses it.

Drupal core committer Théodore Biadala has added Composer and patch-management tools to the Drupal-Code-Query MCP server. He says the backend uses locally indexed Drupal repositories rather than an LLM to generate compatibility and patch results, with some checks also available through read-only APIs. The tools target repetitive work in patch-heavy Drupal upgrades, while the reported improvements in speed and cost come from Biadala’s own tests.

Shawn Duncan explains how Drupal 11.3 can produce reduced HTML responses for HTMX interactions. Core can use either a dedicated route option or a wrapper format to return main content and required assets while keeping cache variants separate. For Drupal developers, the walkthrough shows how HTMX requests fit into the existing rendering, routing, and caching systems.

Image Scale and Fill Background Effect reached its first stable Drupal release on 24 August 2026 after gaining security advisory coverage. The review led to tighter validation, image-processing safeguards, automated tests, and configuration changes, while version 1.1.0 added handling for transparent images. Drupal sites can use the module to generate fixed-size image derivatives without cropping while preserving the complete source image.

Tom Hollevoet reflects on his DrupalCamp Kortrijk session about the gap between client requests and the problems behind them. He uses a simple button-change example to show why developers should ask about goals, context, risk, and success before implementation. As AI makes code faster to produce, he argues that client understanding and better questions become more important parts of Drupal delivery.

Mike Herchel will join a Bluefly Town Hall for a live demonstration of Dripyard's component-based Drupal themes. He will also discuss his new role at Acquia. The session gives Drupal developers and themers a direct look at the Dripyard approach.

WordCamp US 2026 reported 425 Contributor Day participants working in 26 teams, alongside more than 1,100 registrations for the wider event. Showcase Day sessions described Daily Kos moving millions of posts, users, and comments from a custom CMS, while The Ankler moved its newsletters from Substack to WordPress. The cases give the Drupal community current comparison points for content, community, membership, and data-control requirements in large publishing migrations.

CISA has listed CVE-2026-64849, an actively exploited MLflow vulnerability, in its Known Exploited Vulnerabilities Catalog. The flaw can let an attacker use an exposed MLflow server to reach internal services or cloud metadata and read returned data. Drupal is not affected, but teams running Drupal alongside separate AI infrastructure need to assess those services independently.

Specbee announced on 31 August 2026 that it had joined the Drupal AI Initiative as a Silver partner. Drupal says participating partners provide funding and dedicated staff while receiving benefits that include roadmap access, training and early information about developing capabilities. The model connects agency participation with funded, coordinated AI development for the wider Drupal project.

The W3C Dataset Exchange Working Group published a First Public Working Draft of the Profiles Vocabulary on 20 August 2026. PROF uses RDF to describe how specialised profiles relate to broader specifications and to supporting resources such as schemas, validation tools and guidance. Drupal projects using DCAT profile extensions such as DCAT-AP have a standards connection to the work, but the draft introduces no change to Drupal itself.

The Pacific Northwest Drupal Summit has published its 2026 session schedule for the 17–18 October event in Vancouver. Organisers loosely group the current sessions into AI Strategy, Accessibility and Design, and Case Studies and Coding, alongside a keynote and other community programme elements. Early-bird registration closes 4 September 2026, with regular registration closing 2 October 2026.

Symfony has released Symfony Language Tools, an experimental official language server for framework-aware editor support. It combines source analysis with runtime metadata to provide completion, navigation, diagnostics and related features across PHP, Twig and YAML. Drupal shares several of the underlying technologies, but Symfony does not currently document Drupal as a supported application or provide Drupal-specific setup guidance.

The U.S. Government Publishing Office is seeking Azure hosting, maintenance, and technical support for the Drupal 10-based FDLP.gov and FDLP eXchange platforms. The procurement covers a one-year base period and four option years, with requirements including FedRAMP-compliant hosting, system monitoring, application maintenance, and ongoing Drupal support. Offers are due on 10 September 2026 at 14:00 EDT.

The W3C Sustainable Web Interest Group has published the first Group Note Draft devoted to Web Sustainability Guidelines Impact Ratings. The framework combines ratings for people, planet and prosperity with an expected timeframe to help organisations prioritise guidelines. Drupal sustainability documentation references the broader Web Sustainability Guidelines, although there is no evidence that the project has adopted the new ratings.

Abhisek Mazumdar released ddev-langfuse 1.0.0 on 2 August 2026 for running a self-hosted Langfuse stack inside a DDEV project. The add-on starts six supporting services, generates required secrets, and creates the initial Langfuse project and credentials automatically. Built with Drupal AI development in mind, it gives teams a local environment for tracing and examining model activity without maintaining a separate Langfuse deployment.

The Drupal AI project released versions 1.4.7 and 1.3.12 on 19 August 2026. Both branches fix six defects affecting agent-memory sequencing, AI Automator targeting, agent tool configuration, provider configuration, generated-link guidance, and DeepChat positioning. Version 1.4.7 adds five further changes, including fixes for Translate Text Explorer and agent-tool configuration alongside two maintenance tasks and a shared icon addition.