Questions about the pace of advanced artificial intelligence are no longer confined to the research teams building it. Former OpenAI safety leader David Robinson described his decision to leave the company in a 3 October essay for The Atlantic, challenging the assumption that developers can release increasingly capable systems and address risks as they emerge. Former Anthropic researcher Jacob Coxon had raised concerns about competition between AI laboratories in a September interview with WIRED. Their warnings point to a conflict between the speed of development and the time required to evaluate its consequences. Neither departure demonstrates that the industry has actually slowed down.
That tension has reached public hearings and internal disputes. At a 5 October hearing, New York City Council members questioned representatives of major AI companies and heard testimony from former researchers at Anthropic, OpenAI and Google DeepMind. Three other former OpenAI safety researchers, Jasmine Wang, Tomek Korbak and Mikita Balesni, subsequently disputed the company's stated grounds for their dismissal. They warned that uncertainty over acceptable contact with external evaluators could discourage scrutiny. OpenAI rejected the suggestion that they had been dismissed for raising safety concerns and said its policies on sensitive information had been breached. The underlying dispute remains unresolved.
Public oversight offers a possible route beyond those competing accounts, but proposals must be distinguished from protections already in force. New York City lawmakers have discussed third-party validation, reporting and protections for people who flag risks. These measures would need to be enacted and implemented before their practical effect could be assessed. Independent evaluation also raises a harder question than whether a company publishes safety reports: who receives the findings, who can challenge the evidence and who has the authority to require a change before deployment? A review process may identify dangers without having the power to alter a release decision.
These questions extend beyond arguments about catastrophic AI scenarios. Organisations that develop or operate software routinely face uncertainty, conflicting incentives and decisions that affect people outside their own teams. Open-source communities confront some of those problems through public issue histories, reviews and shared maintenance, although those processes are not substitutes for the legal and institutional oversight proposed for advanced AI. What matters is whether concerns can move from warnings to decisions, with clear accountability when evidence is contested. The question is not only whether someone is willing to say that development should slow, but whether anyone outside the organisation can make that warning count.
Henadzi Koltun, founder and CEO of Attico, speaks with The DropTimes about building a business around Drupal and open source. He discusses long-term engineering, headless architecture, AI oversight and accessibility as an organisational responsibility. Across the interview, he argues that sustainable growth depends on resisting unnecessary complexity and protecting quality over time.
The Drupal Security Team published 26 contributed-project advisories on 7 October 2026, covering 25 projects. Block AJAX carries the batch's only highly critical rating, while seven notices are critical and two projects are now unsupported. Several remedies also require manual configuration changes, database updates, cache clears or submodule removal after updating.
Michael Lenahan created a temporary jobs board for DrupalCon Rotterdam after finding work through a personal connection at DrupalCon Vienna. Eight employer listings appeared on both a digital spreadsheet and a physical board, and job seekers could get recommendations from other attendees. Lenahan hopes others will repeat the experiment at future Drupal events, particularly local DrupalCamps.
Drupal 11.5 deprecates the .module file extension as core continues moving hooks and procedural logic into classes and services. Most hooks can use object-oriented implementations with PHP attributes, while special cases and public procedural APIs need more careful migration. Existing .module files continue to load until Drupal 13, giving maintainers time to convert code and preserve backwards compatibility where needed.
GovCMS has extended its existing Drupal Services Panel to 30 September 2027 while the replacement procurement moves forward. The new Drupal and Digital Experience Platform services tender closed on 7 October and is expected to support government entities across three service categories. The planned replacement arrangement has an initial three-year term with extension options of up to three additional years.
The Drupal Association has launched a pilot that brings advocacy work into Drupal's contribution-credit system. Eligible work includes articles, talks, videos, translations, podcasts, tutorials and thoughtful amplification, with quarterly-theme contributions earning double credit. The programme also sets limits on self-promotion and asks contributors to support claims with verifiable evidence.
The Drupal Security Team has welcomed Pierre Rudloff, Joseph Zhao, Bram Driesen and Swan Kalata as full members after provisional service. Their public contribution records show experience across vulnerability reporting, security fixes, advisory coordination, Drupal core and community work. The 8 October announcement was published after the membership changes had already taken effect.
CVE-2026-59944 affects Composer package binary handling and is rated Medium with a CVSS 3.1 score of 6.1. A malicious or compromised dependency can abuse a symlinked binary path to make Composer alter permissions on a file outside the package directory. Drupal teams should update Composer to 2.10.3 or 2.2.30 or later and check the Composer executable used across development, CI and deployment environments.
Drupal AI Context, also known as Context Control Center, has reached RC1 after five beta releases. The release covers 62 credited issues across administration, context selection, upgrade stability, Drupal 10 compatibility and QA, while integrations continue across AI CKEditor, AI Translate and AI Validations. The team is targeting 1.0 in about a month, subject to release-candidate testing.
Local Drupal Association Japan held its founding assembly on 26 September 2026 and applied to Tokyo for NPO establishment certification two days later. The voluntary association begins activities in October through working groups covering Drupal projects, communications, events and external relations. Legal incorporation will follow only after Tokyo certification and a separate registration process.
Paragraphs Bundles 2.0 and Views Slideshow VVJS 2.0.1 introduce upgrade paths that need preparation. Paragraphs Bundles 2.0 is a one-way migration with CSS and ID changes, while VVJS 2.0.1 converts saved 1.x Views to the new schema and requires VVJ Core to be updated first. Both newer branches require Drupal 11.3 or Drupal 12 and PHP 8.3 or later.
Solo 1.0.36 fixes a fatal regression introduced in 1.0.35 for Drupal 10 and Drupal 11.0–11.2. The release replaces 38 direct service lookups with class resolution, restores compatibility with older library-discovery APIs and adds Drupal 10 CI coverage. Subthemes generated from 1.0.35 still need a manual change in their .theme file.
Drupal Patch Check is a Composer plugin for auditing patched Drupal sites before and during upgrades. It can identify patches that still apply, fixes already present upstream, conflicts and cases that cannot yet be judged, while rerolling some broken patches and pinning remote merge-request patches locally. The analysis uses a Très Bien Tech remote service, with --dry-run available to show the exact request before it is sent.
AI Neuron connects Drupal AI with the Neuron PHP framework in both directions. Drupal-configured providers, models and keys become available to Neuron, while Neuron agents, tools and workflows can be implemented as Drupal plugins with durable state and on-site logging. Tool API integration and Drupal AI agent bridging are still planned, and the project currently has no supported stable release.
Gemini Provider 1.1.0 adds image embeddings to Drupal AI, allowing modules to work with vectors generated from images or combined image-and-text inputs. The release also updates default Gemini models, enables streamed CKEditor responses and improves handling of image and audio files. Existing installations should review their selected models, and sites using gemini-embedding-2 without an explicit chunk size should reindex AI Search.
Cloudflare Purge 3.1.4 adds Drupal 12 compatibility while keeping support for Drupal 10 and 11. The release fixes error handling for failed Cloudflare API requests under Guzzle 8, where an API failure could otherwise trigger an undefined-method fatal error. No database update is required, but maintainers should rebuild Drupal caches after updating.
