News Roundup

Théodore Biadala has added a hosted Model Context Protocol server to Drupal Code Query. The interface exposes its existing core and contrib dataset through tools for code search, API-change analysis, project compatibility, dependency relationships, usage trends, and historical test coupling. Drupal maintainers can use those queries when investigating upgrades, core API changes, and readiness for target versions such as Drupal 12.

Cheppers has published an ExperienceKit guide on organising and governing Drupal libraries built with Single Directory Components. The article covers props, slots, component tiers, documentation, accessibility review, versioning, and gradual migration from established theme patterns. For Drupal teams, it frames SDC governance as the layer that keeps reusable components predictable for developers, editors, page builders, and automated systems.

Jérôme Tchania has released the stable 1.0 line of AI Metering for tracking Drupal AI token usage and estimated costs. The module records calls across registered providers, reports usage by user and role, and can enforce monthly quotas through local fallback or pre-flight blocking. Version 1.0.2 also corrects metering, cost-estimation, and quota issues discovered after the first stable release.

Janna Malikova has won the 2026 Drupal Association Community At-Large Board election. She received 141 approvals in an eight-candidate contest in which 307 of 1,274 eligible members participated. Her two-year term begins on 1 November, when she succeeds Alejandro Moreno in the community-elected seat after identifying small site builders, small businesses, and documentation as priorities.

Provider Map 1.0.0-alpha1 was released on 17 August 2026 for Drupal 10.3 and 11. The module combines provider records imported from CSV files with GeoJSON service regions and renders the map as inline SVG without an external mapping library or tile server. It gives Drupal sites a specialised directory model for showing who serves a defined area rather than who is closest to a point.

Eight Drupal events are scheduled from 31 August through 7 September 2026, including three online events and five hybrid or in-person gatherings. The schedule covers AI integration, front-end certification preparation, data privacy, semantic search, Drupal Canvas, Single Directory Components, and Drupal 11 discussion. The week gives Drupal developers and site builders options for both structured learning and local community participation.

Lucas Cunico Kalinowski has released Drupal Cache Playground, an interactive browser-based tool for learning how Drupal caching behaves. Users can model cache tags, contexts, expiry, and lazy building before sending simulated traffic and watching cache variations appear or disappear. The tool gives developers, QA teams, and trainers a visual way to understand cache interactions that can be difficult to predict from individual API concepts alone.

Acquia DAM now provides an MCP Server that connects compatible AI assistants to digital asset libraries through the Model Context Protocol. Authenticated users can search permitted assets, retrieve asset details and CDN links, and inspect metadata while retaining their existing DAM permissions. The initial release is read-only and is available to customers with the REST API feature enabled.

Bluefly.io will host Jay Callicott for a Decoupled.io demonstration at 18:00 UTC on 28 August 2026. The platform combines managed Drupal hosting with GraphQL, JSON:API, artificial intelligence features, and Model Context Protocol tooling. The session gives Drupal teams evaluating decoupled architecture a live look at the platform's hosting and AI agent integration approach.

Webform module maintainer Jacob Rockowitz has stripped back the AGENTS.md file and agent skills used in his AI-assisted Drupal workflow after moving to newer coding models. He says improved planning reduced the need for some additional guidance, and after removing AI Best Practices for Drupal he observed no significant decline in code quality with his current models, though he still sees those skills as useful for older and cheaper models. His experience raises a broader question about which programming skills developers continue to exercise as coding agents take on more implementation work.

Joomla and Umbraco released security fixes on 18 August 2026 for vulnerabilities affecting their CMS products and related components. Joomla fixed ten issues, including a multi-factor authentication bypass and several access-control failures, while Umbraco patched a High-severity authorization flaw that can lead to code execution when an attacker has a low-privilege backoffice account. For Drupal agencies maintaining mixed CMS estates, the releases highlight the operational risks of unsupported branches and inconsistent authorization checks.

John Doyle, CEO at Digital Polygon, and Ashraf Abed, founder of Drupito, will present a webinar at 17:00 UTC on 31 August 2026 about matching Drupal delivery models to project requirements. The session will compare managed platforms and custom builds using content models, integration count, governance, internal capacity and five-year ownership costs. For Drupal teams, the discussion is intended to support earlier decisions about scope, budget and how much custom development a project needs.

Kevin Quillen has released Canvas Fields 1.0.0-alpha1, a contributed module that adds standard Drupal fields to Canvas Page entities. The module supports fields such as text, entity references, and lists for tagging, filtering, search, and content relationships, although not every field type or widget is supported. For Drupal 11 and 12 sites, it provides a bridge between Canvas page building and Drupal's structured-content workflows.

Drupal's /llms.txt module released version 1.1.1 on 16 August 2026 with two bug fixes. One prevents an edge case in Views-token handling from producing an unexpected-error page when the expected content-section field is absent. The other removes a PHP warning during outbound URL processing, making this a targeted maintenance update for sites using the module.

WordPress released version 7.0.4 on 12 August 2026 to fix CVE-2026-65640, a high-severity remote code execution vulnerability. Exploitation requires a malicious user with file-upload capability and a server using both Imagick and Ghostscript, and patched releases now extend through the 4.7 branch. For Drupal teams using comparable media-processing stacks, the case highlights why external image and document processors need to be considered part of a site's security boundary.

Jerome Fitzgerald, minister of economic affairs for The Bahamas, proposed four priorities for Caribbean digital sovereignty at the 41st CANTO Annual Conference and Trade Exhibition. They cover a regional sovereignty compact, federated cloud infrastructure, sovereignty requirements for public technology contracts, and treatment of Caribbean data as an economic, cultural and national security asset. For Drupal teams serving Caribbean public-sector organisations, the proposals point to procurement expectations around open standards, portability, auditability and provider exit.

Lucas Hedding, a Drupal core authentication and authorization subsystem maintainer, has outlined an AI-assisted proposal for modernising Drupal core authentication. He says Claude helped process more than 1,200 open issues and organise the findings into a YAML-based pluggable authentication flow, but no code has been written. The planning issue gives Drupal contributors a phased architecture to review before implementation begins.

DrupalCamp Colorado 2026 begins with optional paid training on 26 August 2026 before the free camp runs on 27–28 August at Denver's Lowry Conference Center. The workshops cover Drupal AI content workflows, accessible authoring and conversational design, while Thursday sessions address multisite governance and staged publishing with Entity Share. For Drupal teams, the programme connects implementation choices with longer-term questions about content quality, platform ownership and production workflows.

DrupalCon Orlando 2027 is accepting applications for three volunteer roles through 15 September 2026. The openings cover speaker review, newcomer support, and community advocacy, with different time commitments and ticket benefits. The round gives Drupal community members several ways to contribute to the conference program and attendee experience before the March 2027 event.

Symfony founder Fabien Potencier announced a four-person Symfony AI Core Team on 13 August 2026, led by Christopher Hertel. Symfony says the project now spans more than 90 packages and has received contributions from more than 160 people through over 3,800 commits and 1,600 merged pull requests. The governance change has direct relevance for Drupal AI, whose contributors are evaluating Symfony AI components as a possible replacement for parts of Drupal AI’s existing provider abstraction.

Australia’s Department of Finance has released a request for tender for a new GovCMS Drupal Services and Digital Experience Platform Services Panel. The tender closes on 7 October 2026, with services expected to begin in the third quarter of the 2026–27 financial year. The procurement will determine the next approved supplier arrangement for Drupal and digital experience services used across Australian government agencies.

ECA 3.1.6 was released on 17 August 2026 with 19 resolved issues and support for Drupal 11.3 and Drupal 12. It fixes configuration schema, token handling, access checks, and the upgrade path from ECA 2.1 to 3.1 after ECA 3.1.5 added a Guide Library source for Project Browser and tighter migration-process controls. The two August releases combine new integration capabilities with follow-up fixes for configuration, upgrades, and Drupal 12 compatibility.

Lee Mills has published a DDEV configuration for running Umbraco on .NET 10 in containers. The setup uses DDEV's generic project model with Kestrel and Azure SQL Edge, and a fresh clone can be started with one DDEV command. For Drupal developers, the experiment shows how DDEV's local development architecture can be adapted to a non-PHP CMS while remaining a bespoke setup rather than a reusable add-on.

Mike Herchel has shared a first-hand preview of the Hyatt Regency Grand Cypress Resort ahead of DrupalCon Orlando 2027. He highlights the compact conference layout, a $259 nightly group rate without a resort fee, and plans for a Drupal community talent show. The preview gives attendees an early look at how the resort-based venue will differ from the downtown settings used for many previous DrupalCons.

The Document Foundation has published an argument connecting LibreOffice Technology with digital sovereignty. It points to open document formats, open-source licensing, independent governance, and public-sector deployments as ways to reduce dependence on individual suppliers. For Drupal, the relevance is comparative, particularly around standards, governance, interoperability, and long-term control over data and infrastructure.

Drupal architect Vincenzo Gambino has released AI Decoupled 1.0.0-alpha1 for connecting external applications to Drupal-managed AI. Configurable endpoints can use agents, assistants, or direct model access, with role controls, rate limits, and optional streaming where the selected processor supports it. The module gives headless Drupal teams a way to keep AI execution in Drupal while building interfaces in JavaScript applications, mobile apps, Python applications, or other external clients.

Performant Labs will host a live session on strategic AI-assisted Drupal development on 26 August 2026 with André Angelantoni and Ilya Lyaukin. They will cover structured planning, parallel-ready epics, implementation plans, and coding pipelines intended to support reliable and maintainable development. The session is relevant to Drupal teams considering how to move AI use from isolated coding tasks toward coordinated project delivery.

W3Techs data dated 25 August 2026 shows that about half of the Drupal sites it detects on major versions have reached end of life. Drupal.org separately recorded 640,801 Drupal core sites for the week beginning 16 August, with about 42.8% on end-of-life versions. The differing measurements show continued upgrade pressure while cautioning against combining the datasets into a single estimate of all Drupal installations.

Rybbit Analytics maintainer Allie Micka is considering Drupal submodules for embedded analytics dashboards and no-code event tracking. She says the next release will also be ready for Drupal 12, while most analytics development continues upstream in Rybbit itself. The proposed additions could help smaller teams monitor analytics inside Drupal and configure reporting without custom tracking code.

The Drupal Association has opened the 2026 Drupal Business Survey to people who run, lead, or help shape Drupal agencies and service providers. Responses will be aggregated and anonymized for a report on the state of the Drupal business ecosystem, and the survey closes on 7 September 2026. The Association plans to share highlights before DrupalCon Rotterdam 2026 and discuss the findings in a Birds of a Feather session.

Shibin Das, founder of FlowDrop, announced that Atelier CMS is now listed on Product Hunt after its public introduction in July 2026. The Drupal-based builder turns plain-language requests into editable pages, applies shared brand rules across a site, and leaves publication subject to human approval on a self-hosted installation. For Drupal users, the listing provides another place to assess and give feedback on a site-building interface that keeps content and hosting under the site owner’s control.

A11yTalks will host Enrico Bisenzi for its Inclusive Arts Gallery session on 26 August 2026. Bisenzi will present artists and ideas drawn from his 30-year teaching career in higher education for art, music, and dance. For accessibility-focused audiences, the session adds an arts and culture perspective to discussions usually centred on digital accessibility.

Drupal teams have several architecture choices once asset governance outgrows the core Media Library. Self-hosted, managed, Drupal-native, and SaaS systems can connect through remote delivery, synchronisation, or API-based models. The durable decision is where files, metadata, rights, transformations, and lifecycle authority live, not simply which product is selected.

The Drupal Security Team has marked 16 contributed projects unsupported for security reasons since 10 June 2026, including three more on 19 August. All 16 advisories use the standard Critical 16/25 unsupported-project rating while the underlying security investigations remain incomplete. Sites using the affected projects have no supported security release to install and are advised to uninstall them.

Proton surveyed 1,500 business leaders in the United Kingdom, Germany, and France and reports that 74% were concerned a US technology provider could disable access to a critical service. Although 94% reported some form of continuity plan, only 44% said they tested it regularly, while 54% said their organisations could not operate beyond one business day after losing cloud and digital services or suffering a cyberattack. For Drupal teams, the findings are relevant to identifying external dependencies and testing recovery, switching, and rollback procedures.

Drupal events scheduled from 24 to 30 August 2026 include an AI-focused meetup, DrupalCamp Colorado, and an online Code of Conduct workshop. The programmes cover AI-assisted page building, Drupal development, accessibility, inclusive design, and incident response. The week offers Drupal community members several ways to learn, meet peers, and develop practical community and technical skills.

Drupal Day Aveiro 2026 has opened session submissions for its 30 October event in Portugal. The call accepts Drupal-related sessions and workshops at beginner, intermediate, and advanced levels, with 20- and 45-minute duration options. Proposals close on 25 September 2026, and submitters must confirm they can attend in Aveiro.

Symfony released 7.4.16 and 8.1.4 on 7 August 2026 as maintenance updates. The releases fixed issues across dependency injection, HTTP handling, serialization, Doctrine integration, and messaging. For Drupal, Symfony 7.4 supports Drupal 11.4, while Symfony 8.1 was adopted on the main branch during Drupal 12 development and may be replaced by Symfony 8.2 before release.

Drupal developer Pravesh Poonia has published Layout Builder Audit, a contributed module for recording block-level changes made through core Layout Builder. It logs created, modified, moved, and deleted blocks alongside field differences and editor and layout metadata. Drupal.org currently provides only a development release and does not cover the project under its security advisory policy, which teams should consider when evaluating it.

Content Sync argues that AI-assisted creation is shifting the bottleneck for enterprise Drupal teams toward content governance. The post focuses on ownership, approvals, duplicated content, local adaptation, and deciding which version should remain authoritative across multisite estates. For Drupal organisations, the issue is whether faster production can be matched by reliable processes for maintaining shared content over time.

PHP 8.6 Beta 1 is now available for testing following its release on 13 August 2026. The milestone starts the soft feature freeze as the language moves toward general availability planned for 19 November. Drupal core is already testing against PHP 8.6, although Drupal does not yet list the version as supported for sites.

amazee.ai will host an online webinar on Shadow AI and data privacy on 16 September 2026 as part of Swiss {ai} Weeks. Martin Schlögl and Thomas Schröpfer will discuss how prompts, files, code, and business data may be retained, logged, used for model training, exposed through integrations, or reviewed by people after submission to public AI tools. For Drupal agencies and teams using public AI services, the topic raises practical questions about how company, customer, and regulated data are governed..

Scolta 1.2.0 introduces incremental indexing for Drupal sites and removes deleted nodes and translations from search immediately. The release also corrects facet counts after AI query expansion and changes how full builds run, resume, and report failures. Most sites can update normally, while custom content-gatherer code may need changes for the new resume parameter.

Bluefly.io will host Aaron Ellison for a LibreChart demonstration during its Town Hall on 21 August 2026. The event notice describes LibreChart as an open-source electronic medical record system built on Drupal CMS for medical mission clinics operating offline in resource-limited settings. The stated use case places Drupal CMS in a clinical environment where continuous internet connectivity may not be available.

Link Remediator 1.0.0-alpha1 was released on 15 August 2026 after maintainer Binquan Wang generalised functionality developed while supporting USDA-ARS work for a National Agricultural Library Drupal site. Binquan says the earlier workflow was tested in development and staging, then separated from site-specific content structures, environments and business rules for contrib. For Drupal teams, the release opens that workflow to wider testing while retaining review, dry-run, audited-write and rollback safeguards.

WordPress released version 7.0.3 on 6 August 2026 with 12 security fixes. The release addressed a high-severity pre-authentication login-screen XSS alongside stored XSS, server-side request forgery, multisite privilege escalation, and information disclosure issues. For Drupal readers, the release offers a comparison point for how another major open-source CMS backports core security fixes across older branches.

Canvas Icon Picker 1.0.0 was released on 10 August 2026 with support for Drupal 11.1 or later and Drupal 12. The module lets Canvas components replace selected string-property fields with a searchable browser backed by Drupal core’s Icon API. For component authors, it provides a visual way to choose icons from permitted core, contributed, and custom packs instead of entering identifiers as text.

Canvas Map 1.0.0 was released on 6 August 2026 with Google Maps and OpenStreetMap components for Drupal Canvas. Editors can set location, zoom, map centre, aspect ratio, an accessible name and provider-specific display options. The module is aimed at individual editorial maps, while Geofield, Leaflet and related tools remain the better fit for structured geospatial data and Views-based mapping.

The Drop Times used its August Open Town Hall to review July editorial, social-media, organisation, and event activity. Publishing volume fell from 185 pieces in June to 147 in July as routine external summaries were reduced and more attention went to original reporting, interviews, modules, governance, security, and events. The meeting also outlined media partnerships, a planned public media database, community participation around digital sovereignty, and efforts to take Drupal stories to wider audiences.