Drupal News Feed
This post is being published in consultation with the Drupal Security Team.As the maintainers of Drupal Commerce, we are advising users to upgrade immediately to the recently published releases of Commerce Core to protect against a vulnerability that may have financial impact.We received two reports of attempts by malicious users to place fraudulent orders using a vulnerability patched in...
An actively exploited Drupal Commerce vulnerability could financially affect online stores. Security updates are available, and store owners should also review their orders for inconsistencies.
Turning AI's Promise Into Practical Results at Drupal AI Summit Paris 2026
For most organizations, the question is no longer whether AI matters, but how AI fits into their own work, on what terms, and at what cost.
On December 1, 2026, the Drupal AI Summit Paris will bring together experts and organizations that have already worked through those questions, including EU institutions and medical...
AI-generated Drupal code can look correct while using outdated APIs, invented fields or incomplete cache metadata. Project instructions and repeatable checks help developers identify those mistakes before committing changes.
QED42's website looked correct after an early AI-assisted migration, but its Drupal backend told a different story. Souvik Pal explains how that finding changed the framework.
With fewer routine stories and more time devoted to research, The DropTimes is examining how contributors can help determine which Drupal developments receive deeper coverage.
Do you like having secure Drupal sites? Help fund xjm.
xjm
Wed, 10/28/2026 - 23:00
The problem: Certain maintainer roles keep Drupal's lights on. Right now, there's a brownout.Interim Drupal Association CEO Tiffany Farriss recently wrote about bringing to light "the work that just happens": the mostly invisible (but essential) services...
When the Drupal Association launched the Drupal AI Security Initiative with Alpha-Omega this past June, our goal was to test whether a fractional, funded team, pairing fixers, reviewers, and infrastructure engineering alongside our volunteer Security Team, could protect maintainers from an incoming wave of AI-assisted vulnerability reports.
Five months later, that anticipated wave is fully...
At DrupalCon Rotterdam, Dries asked the community to talk louder about Drupal. The platform is years ahead of its reputation, and no single organisation can close that gap alone. To that end, the Drupal Association launched the Drupal Advocacy Program: tell Drupal's story in your own voice, and earn contribution credits for it, through the same system that recognises code.
This first month has...
Within three years, I expect the technical work of moving a website from one platform to another to cost close to nothing.
The existing site gives the agent a reference implementation. It can crawl matching URLs, diff the rendered HTML, compare screenshots, and, given admin access, run the same publishing workflows to check content changes, moderation states, and permissions.
Comparing the two...