News Roundup

Scott Falconer used an Acquia Engage Paris session to argue that Drupal’s governance model makes it suitable for AI-agent workflows. He pointed to structured content, permissions, workflow controls, integrations, and security as foundations for agents acting on managed content. Drupal teams still need those capabilities to become easier for external agents to discover, invoke, and verify.

UpGuard identified 2,167 government and education domains in copyright takedown records that indicate likely use in parasite SEO campaigns. Cybersecurity writer Dark Marc separately documented movie-themed spam files in public upload directories, including paths associated with Drupal Webform. Drupal administrators should prevent untrusted files from being stored in publicly accessible locations and investigate unexpected indexed content.

Dries Buytaert has proposed two terms for distinguishing open-source code that is simply shared from projects maintained as shared infrastructure. “License-only Open Source” and “Stewarded Open Source” separate licence rights from security response, releases, governance, infrastructure, and long-term care. For Drupal organisations, the distinction provides a vocabulary for discussing dependency risk and the funding required to maintain widely used software.

AmyJune Hineline presented five accessibility checks for social media at Drupal Camp Asheville 2026. Her guidance covered alt text, caption review, CamelCase hashtags, information placed outside images, and readable post structure. Drupal teams can build the checks into event promotion, newsletters, and other publishing workflows.

Pantheon co-founder Josh Koenig and Fast Forward founding partner Jason Yarrington discussed PHP, JavaScript, and agency platform planning in a livestream on 11 July 2026. They connected developer preferences and browser-based application work to hiring, architecture, and client conversations while rejecting the claim that PHP is obsolete. For Drupal agencies, the discussion points toward hybrid front ends, reusable design systems, and clearer planning for long-term maintenance.

Documentation from CERN, GovCMS, and Stanford Sites shows three ways to govern large Drupal services. Their models divide responsibility through central distributions, service tiers, module controls, and named site ownership. For Drupal teams, the comparison shows why every customisation needs a maintainer, an upgrade path, and a support boundary.

Bluefly.io will host Webform maintainer Jacob Rockowitz for a Google Meet Town Hall on 23 July 2026. The discussion will cover his use of AI coding agents, recent Webform work, and a possible screen-sharing demonstration. Drupal developers and site builders can hear directly how a contributed-module maintainer is adapting development and maintenance practices.

Károly Négyesi has described a Temporal integration for Drupal in a Tag1 Consulting blog post. The integration separates deterministic workflows from Drupal-based activities and uses event history, retry policies, heartbeats, and workers to support long-running processes. It gives Drupal teams another model for workloads that require more recovery and orchestration control than the core Batch and Queue APIs provide.

EvolveDigital NYC has opened speaker submissions for its 19–20 November 2026 summit at Civic Hall in New York City. Organisers are accepting proposals across eight tracks, including EvolveDrupal, technology and artificial intelligence, digital craftsmanship, WordPress, design, and open source technologies. Drupal practitioners can submit case studies and other session proposals until 28 August.

Michael Anello built an automated tracker for Drupal modules and recipes that declare a hard dependency on the AI module. The scripts verify project type, dependency, and Drupal compatibility before adding release, activity, and security information where available. The resulting ecosystem tables are now included in the AI Dashboard module’s documentation.

Skynet Technologies USA LLC provides a Drupal module for adding visitor-facing accessibility controls to websites. The project connects a configurable toolbar with optional vendor-managed dashboard, reporting, remediation, and audit services. Drupal teams should treat it as a personalisation layer rather than a substitute for accessible code, content review, and manual testing.

New Relic, an observability software company, will end Drupal 7 and Drupal 9 monitoring support in its PHP agent on 15 October 2026. The company says affected installations will lose Drupal-specific insights and may produce incorrect alerts from stale or missing metrics. Teams still operating these versions need to include monitoring changes in migration and incident-response planning.

Juho Vepsäläinen’s 2026 Journal of Web Engineering paper argues that developers should begin with modern HTML before adding heavier frontend abstractions. The paper does not discuss Drupal directly, but it raises questions that can be applied to server rendering, Twig, render arrays, Single Directory Components, and JavaScript use. For the Drupal community, the practical value is a clearer test for when frontend tools support Drupal’s rendering model and when they add avoidable complexity.

US restrictions and review processes affecting Anthropic and OpenAI models have shown how quickly access to closed AI systems can change. Open-weight models and multi-provider routing give teams more deployment options, but they also add operational, security, and cost responsibilities. For Drupal teams, the practical task is to keep permissions, review, logging, and provider replacement inside the site architecture.

Developer Steffen Haase has released Beacon, an open-source PHP starter framework for server-rendered applications. The project combines routing, Twig templates, authentication, validation, migrations and other common components into one Composer package. Drupal developers may find it useful as a compact example of Symfony components and familiar PHP patterns outside Drupal itself.

Four Drupal-related events take place from 20 to 26 July 2026. DrupalEasy continues its online component course, The DropTimes hosts an open town hall, amazee.io and Fastly present an edge security webinar, and Drupalers Association Pune holds an in-person meetup on authentication and production AI agents. The schedule provides options for structured training, editorial participation, infrastructure learning, and local community discussion.

Salsa Digital has completed an IRAP assessment of its Rules as Code service against the Information Security Manual’s OFFICIAL: Sensitive level controls. Written responses from the company describe separately assessed service, application, and hosting layers involving Salsa Digital, Assemblic, and QuantCDN. Agencies can procure the service through Category 3 DXP of the Drupal Services Panel, but they remain responsible for reviewing the evidence and authorising their own implementations.

LocalGov Publications Importer converts uploaded PDFs into structured HTML publications within LocalGov Drupal. Stable release 1.1.0 supports Drupal 10 and Drupal 11, with optional AI formatting provided through a submodule. The module provides council editors with an editable starting point to improve accessibility and maintain long-form public information.

Registration has opened for DrupalCamp Colorado 2026, taking place from 26 to 28 August at the Lowry Conference Center in Denver. Paid training on Drupal CMS, Drupal Canvas, chatbot design, and AI-assisted content workflows will precede two free conference days with keynotes, community sessions, contribution sprints, and lightning talks. Drupal community members can register for the training, the camp programme, or both.

Ahmad Khalil will present AI Drupal Concierge on 7 August 2026 in London, Ontario. The free session will introduce an AI-powered Drupal experience developed by ImageX and positioned as extending beyond a conventional chatbot. Drupal and AI practitioners can attend in person and discuss the project with the presenter.

The Drupal Security Team published three moderately critical core advisories on 15 July 2026. The issues involve Layout Builder labels, HTMX attributes, and access checks for private image derivatives, with exploitation dependent on specific permissions or configurations. Sites should update to a supported release, and some contributed-project maintainers may need to review related hardening.

Pamela Barone has published version 2.0 of the Drupal CMS product strategy on Drupal.org. The update identifies agencies and professional developers as the primary audience for the builder experience while retaining marketers and content creators as the end users. It also reframes AI, hosting partnerships, and the June 2028 timeline as parts of the project’s route to wider adoption.

AWS has outlined controls for workload location, data access, encryption, resilience, and sovereign infrastructure. The European Commission’s 2026 framework scores providers across 48 criteria grouped into eight sovereignty categories. For Drupal teams handling regulated sites, the practical question is whether evidence covers the full application stack, including access, keys, recovery, transfers, and exit planning.

The Drupal Association has appointed Tiffany Farriss as interim CEO after Tim Doyle stepped down. Farriss is expected to serve for six to 12 months while strengthening the organisation’s financial and operational foundation and preparing for a permanent leadership search. The transition matters to the Drupal community because the Association operates shared infrastructure and services that support the project.

DrupalCon Rotterdam 2026 organisers have published the session schedule for the event from 28 September 2026 to 1 October 2026. The programme lists summit programming, the Driesnote, Drupal CMS sessions, AI and agentic architecture sessions, digital sovereignty talks, accessibility topics, security coverage, and contribution activities. For the Drupal community, the schedule shows how product work, infrastructure concerns, and contribution programming are being grouped across the four-day event.

Juicer Social Feed lets Drupal site builders add hosted Juicer.io social feeds as configurable blocks. The module supports source filtering, post limits, layout controls, and pagination for feeds from multiple social platforms. For Drupal teams, it offers a Drupal-native placement path while Juicer handles aggregation and feed management outside the site.

The Enterprise AI Summit has highlighted three case-study sessions for its 28 September 2026 programme in Rotterdam. The sessions cover an EPSO candidate support system in 24 EU languages, American Diabetes Association editorial workflows on Drupal, and World Cancer Day moderation support for sensitive user-submitted stories. For the Drupal community, the update points to AI use cases in support, publishing, and campaign moderation, while the published material still leaves architecture and validation details to the sessions.

Roman Chekhaniuk has published Quiz Maker 2.0.0-beta1 on Drupal.org for Drupal 11 and Drupal 12. The beta adds staged quizzes, conditional flow, a visual editor, pluggable scoring, multilingual support, and portable quiz transfer. The release gives Drupal site builders a more structured way to create branching assessments while the 1.x branch remains available for older sites.

Drupal core maintainers released Drupal 11.4.3 on 14 July 2026 as a production-ready bugfix release for Drupal 11. The release fixes a route-discovery regression, stream-wrapper service errors, attribute route registration problems, and other core bugs. For Drupal teams on the 11.4 branch, it adds another maintenance point after earlier fixes for Composer scaffolding and Search update-path regressions.

Bert Boerland’s LinkedIn essay argues that sovereignty, governance, and cost are unresolved infrastructure problems for Drupal. Community replies connected his proposal to FAIR-style package federation, Drupal.org funding, public-sector procurement, and software supply-chain security. The debate frames resilience as a practical question of who funds, governs, and verifies the infrastructure Drupal depends on.

A Head in the Cloud panel brought Drupal, TYPO3, Contao and Neos representatives into one discussion on open source CMS sustainability. Martin Helmich’s account covered contributor pipelines, volunteer labour, corporate participation, regulation, PHP-based CMS ecosystems and digital sovereignty. For Drupal readers, the discussion connects contribution systems with public-sector questions about sustainable open digital infrastructure.

Canonical identifies persistent gaps in how organisations manage open source software supply chains. The research points to vulnerability concerns, fragmented dependency visibility, manual security checks, patching delays, and uneven team ownership. For Drupal teams, the findings reinforce the need to treat Composer packages, Linux platforms, containers, and deployment pipelines as part of site security governance.

ImageX has published an overview of colour management options for Drupal websites. The article covers theme CSS, admin theme settings, colour fields, Layout Builder styles, CKEditor tools, and Single-Directory Components. For Drupal teams, the practical issue is how to expose colour choices to editors without weakening brand consistency, accessibility, or maintainability.

Drupal 11.4 adds an experimental native command-line interface to the core, according to the Drupal 11.4 release announcement. The feature uses Symfony Console, so core and enabled modules can expose discoverable commands through Drupal itself. For the Drupal community, this marks a cautious transition toward core-supported command-line workflows, while Drush remains important for existing projects.

Steffen Rühlmann has published an undpaul Drupal tip on changing the length of a populated text field. The post explains why Drupal blocks standard Entity API updates when existing data could be affected. It outlines a lower-level post-update approach that widens the database column, aligns Drupal’s stored schema information, updates configuration, and clears cached definitions.

A Reddit discussion asked how programmers stand out when AI can generate working code. Jacob Rockowitz’s Drupal-focused blog argues that AI rewards curiosity and can widen the gap between developers who understand their output and those who do not. Drupal.org guidance, METR research, and GitLab’s 2026 survey point to the same pressure: code generation may get faster, but validation, security, and governance remain human responsibilities.

Christian López Espínola has published a technical post about JSON handling in Drupal Canvas. The post explains how different database engines changed JSON key order in ways that made some tests fail in continuous integration while passing locally. The issue gives Drupal developers a practical reminder to avoid order-sensitive comparisons when stored JSON data may move across database backends.

The DropTimes will host its July 2026 Open Townhall on 22 July 2026 at 15:30 UTC on Zoom. The session will cover editorial updates, contributor coordination, outreach priorities, and feedback from Drupal community members. The meeting gives contributors, readers, agencies, and organizers a practical way to follow and discuss TDT’s community-facing work.

DrupalForge has published a blog post arguing that cloud development can reduce first-start friction for Drupal users. The post connects browser-based development environments with Drupal CMS, Drupal Canvas, recipes, AI tools, templates, demos, training, and team collaboration. The story is relevant because Drupal’s onboarding work increasingly depends on people being able to try, build, and share Drupal without extensive setup.

DrupalACT has listed its July 2026 meetup for Wednesday 15 July 2026 in Canberra, with online access also available. The schedule includes a community update, a presentation by Al O'Neill, and a session by Brynn Briedis on theming for Drupal Canvas. For Drupal community members in Australia, the meetup provides a local forum for project updates, practical discussion, and in-person networking.

Pacific Northwest Drupal Summit has opened its 2026 call for speakers. Proposals are due by 31 July 2026 for the regional Drupal camp in Vancouver. The call gives Drupal community members a clear window to propose talks, panels, workshops, and training.

'Click Here Labs' has released the Entity Reference View Mode Selector (ERVMS) module for Drupal. The module lets editors choose the display view mode for each referenced entity directly from the content editing form using Drupal's existing view mode system. It gives editorial teams greater control over presentation while reducing the need for custom development and content duplication.