Drupal has long relied on organisations and individuals who contribute beyond their immediate needs. Yet that responsibility remains unevenly distributed. According to figures published by the Drupal Association in February 2025, just 219 of the 1,440 organisations active on Drupal.org accounted for 96% of recorded contributions in 2024. The challenge is not simply attracting more contributors, but making responsibility for Drupal's upkeep more widely shared.
Two proposals outlined by Drupal Association Interim CEO Tiffany Farriss on 28 October 2026 suggest how that might happen. A broader Drupal Certified programme could recognise makers, patrons and advocates, extending recognition beyond agencies. Alongside it, a dedicated maintainers fund could help organisations without development capacity financially support the people maintaining software they depend on.
Together, these proposals revisit Dries Buytaert's long-standing makers-and-takers argument. They also raise questions about what counts as a fair contribution. Financial support cannot automatically substitute for technical responsibility, and certification must recognise different capacities without favouring organisations that can afford to pay. How funding reaches maintainers, and how their work is valued, will matter as much as the proposed framework itself.
Neither proposal has been implemented. Their significance lies in an attempt to move from contribution as an expectation placed on a committed minority towards a responsibility shared across the ecosystem. Drupal will remain freely available, but sustaining that freedom requires continuing work. The real test is whether more beneficiaries can help support it without compromising the openness and independence that make Drupal worth maintaining.
Follow The DropTimes on LinkedIn and Bluesky, or join #thedroptimes on Drupal Slack. Allen Jason wrote and curated this issue of Editor’s Pick.
Drupal Association interim CEO Tiffany Farriss has outlined plans to broaden the Drupal Certified Partner programme. The proposal would recognise makers, patrons and advocates while introducing shared maintenance expectations and a funding route for maintainers. The changes could allow more organisations to demonstrate their support for Drupal, although the new requirements and funding arrangements have not been finalised.
The Drupal Association announced changes to its contribution credit system on 21 October 2026. Core issues now carry 15 credits and core security advisories 150, while additional maintainer roles qualify for sponsorship recognition. The changes affect how contributing organisations are recognised in the Drupal Marketplace and assessed for partner status.
The Drupal Security Team published 39 contributed-project security advisories on 28 October 2026, including an actively exploited vulnerability in Drupal Commerce. The disclosures also identify payment, authentication, content import and access-control weaknesses, alongside incomplete earlier fixes. Affected Drupal site operators need to update supported modules, investigate possible consequences and remove projects that no longer receive security fixes.
Centarro has published order-audit guidance after receiving two reports of attempted fraudulent orders on live Drupal Commerce sites. The maintainer identified four database checks and said the underlying vulnerability may have been exploitable in certain configurations since 2020. Merchants are advised to update affected installations and investigate suspicious transactions, including orders with inconsistent payment records or altered prices.
Drupal.org's AI contribution policy requires contributors to review their submissions, take responsibility for the results and disclose significant AI assistance. Repeated low-quality submissions can lead to temporary or permanent bans, while separate instructions for AI coding agents are being evaluated in Drupal core. Contributors must understand what their tools produce, verify their work and remain engaged with maintainers.
AI coding agents can generate outdated Drupal code or overlook important requirements when they lack project-specific context. A practical workflow combines repository instructions, Drupal-specific skills, automated checks and tools for inspecting a local site. Developers can use these safeguards to reduce avoidable errors while retaining responsibility for reviewing and understanding every change.
Drupal's AI ecosystem has grown to hundreds of contributed modules built around the AI module, which more than 24,000 sites report using. This tracker groups the maintained projects by the job they do, such as alt text, site search with cited answers, AI agents, connections for outside assistants, workflows and cost tracking, and lists one module for each job. Each entry shows reported installs, the newest release and whether Drupal's security advisories cover it, as checked on Drupal.org.
QED42 has introduced X to Drupal, an AI-assisted framework tested through the migration of its own 646-page Webflow website to Drupal 11. Senior backend engineer Souvik Pal describes the content modelling failures, verification problems and security decisions uncovered during development. The experience offers Drupal teams practical lessons about automated migration and the work that still requires human oversight.
Drupal core committer Théodore Biadala has developed WordPal to convert WordPress block themes into Drupal themes and page structures for Canvas and Display Builder. Its public gallery reports thousands of completed conversions, but visual similarity does not guarantee fully editable components or production readiness. Biadala explains the WordPress Playground-based process, conversion limits, update challenges and the security review still needed before wider deployment.
Gábor Hojtsy has released Dashi, a Drupal CMS site template that carries forward the Umami food magazine demo. It includes English and Spanish content, editable Canvas pages and translation tools, although the first release has two known compatibility problems. Drupal users can try Dashi through simplytest.me or install it locally using documented workarounds.
Stuart Clark released the first stable version of the Vale module for Drupal on 28 October 2026. It checks selected text fields against editorial style rules when content is validated through forms or application interfaces. Drupal publishing teams can apply shared rules across editing workflows, but enforcement depends on configuration and how content is saved.
Six contributors to DrupalCon Rotterdam's Government Summit have assessed Switzerland's decision to introduce an open-source workplace alongside Microsoft 365. Their responses examine migration risks, costs, staff adoption and the dependencies that can survive a change in software. The discussion connects government technology choices with open standards, public procurement and collaborative Drupal projects.
Dutch government bodies and SURF signed an agreement on 1 October 2026 to make open source a permanent part of their operations. Jan ten Hoor of iO discusses the company's Drupal for Government platform and its move towards broader open-source collaboration. His perspective raises practical questions about shared development, governance and long-term maintenance of Drupal-based public services.
Colour psychology is not a universal formula. Anne Stefanyk of Kanopi Studios shares three practical approaches to audience research, consistent colour choices in Drupal and accessible contrast for better website design.
Alessandro Feijó has revived the Beta of Outer-Core, a persistent browser-based space strategy game first developed in 2008. The game continues to operate on Drupal 6, while its separate public portal uses Drupal 11. The project offers Drupal developers a case study in maintaining complex application behaviour while planning a major platform migration.
The DropTimes reviewed its editorial direction and September activities during its Open Townhall on 28 October 2026. The team discussed a move towards fewer, more thoroughly researched stories, alongside publishing results and progress on the Editorial Working Group. Drupal contributors were invited to help identify overlooked topics, support event reporting and participate in future editorial planning.
