ECA's in-context customization removes the learning curve barrier. A lightning bolt icon appears next to form fields with applicable templates. Click it, select a template, configure parameters - done. No need to understand events, conditions, or tokens. Templates are ECA models with special template tokens that define where they apply and what users can customize. Technical users can transition directly to the full modeler from context. The result: automation and site customization become accessible to everyone, not just developers. Build templates once, apply them dozens of times across contexts.
The Drupal AI Summit in New York City brought together developers, strategists, designers, and agencies for a full day of talks, demos, and conversations about where Drupal will go next in the age of AI. What struck me most wasn't any single talk or demo, it was the common belief that the Drupal community needs to come together to shape this future responsibly.
Here are the core themes, and the talks that stood out.
Matthew Saunders kicked off the day with a framing that anchored everything that followed: "Drupal is becoming an AI harness." As organizations move AI from experimentation into practical operations, the focus should shift from which AI model is used to the system that orchestrates and governs those models.
An AI harness, as Saunders defined it, connects models to essential organizational requirements: structured data, governance, human oversight, and workflow automation. With 25 years of experience managing structured content, APIs, and permissions, Drupal is positioned to act as that operational layer.
Saunders also highlighted the Drupal AI Initiative — a community-led effort with 30+ partner organizations focused on coordinating responsible AI capabilities and avoiding vendor lock-in through community-driven innovation. A core value of the summit, repeated throughout the day, was the importance of a "human × AI partnership" — ensuring AI augments professional expertise rather than replacing it.
These were just a few of the ideas surfaced during the sessions:
Vibecoding for prototypes, Drupal for systems that last. Josh Koenig cautioned that while generative AI can rapidly build websites and democratize web creation by allowing users to assemble functional interfaces without traditional development hurdles, "vibe coding" often lacks long-term maintainability, governance, and structural integrity. The result is frequently "spaghetti code" that becomes difficult for teams to manage as projects grow in complexity. This is where Drupal can shine. The takeaway: use AI to prototype fast, but use Drupal to build systems that last — sustainable, reliable, and integrated into existing professional workflows.
Orchestrating autonomous agents. The future, according to Koenig, lies in turning AI into a teammate. Today's AI-driven web development is largely a "single-player" experience — just an individual talking to a computer. The next chapter is about building orchestrated workflows where multiple stakeholders collaborate within a controlled environment, ensuring consistency across a large ecosystem of websites. Drupal is well-positioned to be that orchestration layer — not just a platform with AI features, but an AI-friendly ecosystem that supports protocols like the Model Context Protocol (MCP), allowing it to act as a structured source of content and context for external AI agents.
Context-driven AI. Without structured context, AI outputs are off-brand, non-compliant, or just generic — what Kristen Pol memorably calls "AI slop." As Pol put it, context is the difference between "AI that guesses" and "AI that gets it." Her project, the Context Control Center (CCC), also known as the AI Context module, provides a centralized hub within Drupal to capture and manage an organization's rules, policies, and guidelines, then map them directly to AI features. Instead of relying on vague prompts or scattered style guides, CCC treats context as managed content — with familiar Drupal capabilities like revisioning, scheduling, and scoping by workflow, language, or site section. That means an organization can declare rules and have them applied consistently across every AI output.
From UX to AX (Agent Experience). Brands now need to design experiences not just for humans, but for the AI agents acting on their behalf. As more website traffic comes from AI agents and crawlers rather than human visitors, organizations have to think about how their content, components, and APIs are "consumed" by machines — and how to ensure brand voice, accuracy, and trust are preserved when an agent is the one mediating the experience.
Data sovereignty and trust. Particularly relevant for the public sector, Amazee's Jeroen Spitaels emphasized guarantees of no data retention and no training on user data as essential for public sector institutions. For governments, universities, and any organization handling sensitive information, it's not enough for AI to be powerful — it has to be trustworthy, transparent, and sovereign. That means knowing exactly where your data lives, who has access, and being certain it isn't quietly being used to train someone else's model.
Every summit has sessions that move beyond the conceptual and get specific. These three stood out because they tackled the operational realities of actually deploying AI — and what it takes to do it well.
John Doyle's session on implementing AI teams and workflows was one of the day's standouts because it tackled the operational reality of AI — not just the tech.
His core idea: stop thinking about AI as isolated prompts and start building "digital teammates" — governed agents with defined owners, SLAs, and clear inputs and outputs. That's a profound reframing. A digital teammate isn't a tool you use; it's a team member you onboard, manage, and hold accountable.
Doyle made a strong case for Drupal as the ideal platform for AI orchestration thanks to its API-first architecture, structured content model, and workflow states. He demoed AI integrated directly into a Drupal interface, generating content drafts based on predefined project briefs and design systems.
His operational advice was refreshingly grounded:
This is exactly the playbook organizations need if they want to actually deploy AI without breaking trust. At the end of his talk, I was able to speak with him, and he mentioned they had piloted this approach at Digital Polygon, and it was very successful.
John Tran, CTO of Image X, delivered the kind of real-world example I wanted to see. His session detailed how Drupal can be transformed from a static content management system into a dynamic, AI-orchestrated experience platform using AG-UI (Agent-to-User Interaction).
The technical foundation is semantic search — using embedding models and vector databases to map relationships between content, focusing on intent, context, and meaning rather than keywords. That allows the system to retrieve highly relevant information even when the user's phrasing is conversational.
The proof-of-concept for an advanced implementation of an AI chatbot was great to see. The system:
Tran's future vision is for Drupal to handle the orchestration of these experiences natively — moving away from rigid, pre-built pages toward fully dynamic, component-based websites where the entire site experience is generated or assembled on-the-fly based on the user's specific goals, all while maintaining site governance and using standard Drupal form-handling workflows.
Just as importantly, because the AG-UI toolkit is agent-agnostic, it prevents vendor lock-in — allowing developers to switch between LLM providers or agent frameworks without rebuilding the front-end experience.
This is what "richer interactivity" looks like in practice. It's still a chatbot at its core, but with a level of engagement and contextual awareness that genuinely solves problems rather than just answering questions. This felt less like a novelty and more like a higher-order assistant doing meaningful work.
The Acquia session from Martin Anderson-Clutz framed something every digital team needs to wrestle with: in the evolving role of websites and an AI-first internet, content has to go everywhere — not just to your website, but to AI crawlers, agents, and downstream experiences you don't directly control.
To meet that reality, Anderson-Clutz advocated for three keys to a modern DXP:
Agile Content Engine. Beyond traditional drafting and publishing, organizations need to use AI to accelerate planning and ideation, optimize content post-publication for conversion, and embrace structured content in formats like JSON and Markdown for true omnichannel delivery.
Robust Experience Layer. As users increasingly turn to websites to validate purchase decisions rather than for education, the site's role shifts toward frictionless brand onboarding (social proof, case studies, technical specs) and context-aware AI that keeps brand voice accurate, on-brand, and aligned with strategic objectives.
Agent-Friendly Architecture. With non-human traffic rising, websites must be built for AI agents as primary users. That means treating "APIs as the new UI" — standardizing on machine-readable formats, adopting emerging agent-to-agent protocols, and designing systems that offer packageable "skills" or recipes for modular, autonomous agent interaction.
His core argument: Drupal is uniquely positioned as a leading, AI-ready platform because of its emphasis on structured content, enterprise governance, and community-driven innovation.
The takeaway: in a world where your content is increasingly consumed by machines before it ever reaches a human, the platforms that win will be the ones that treat AI agents as primary users — and Drupal is already there.
If one line captured the spirit of the day, it was this: "Drupal has quietly become one of the most AI-ready platforms available."
While much of the AI conversation centers on flashy chatbots and proprietary tools, Drupal has been steadily building exactly what AI agents need to do real work. That's not marketing spin — it's the natural outcome of 25 years of disciplined engineering around content structure, governance, and openness. The very things that made Drupal a leader in the structured-content era are the things AI agents require to operate reliably, safely, and at scale.
The Drupal community isn't just adapting to AI. It's quietly becoming one of the most credible, agent-ready platforms on the open web — and the summit made it clear we're just getting started.
The conversations at the Drupal AI Summit don't end in a conference room. Tag1's AI Applied Series is our ongoing effort to think out loud about what responsible, practical AI looks like in real work, written by the people actually doing it. We invite you to join us there.
Bring practical, proven AI adoption strategies to your organization, let's start a conversation! We'd love to hear from you.
read moreWe are pleased to announce that Peter Hinssen will be the keynote speaker at the Enterprise Drupal Summit Europe 2026 in Rotterdam on 28 September 2026.
Peter Hinssen will open the summit with a session on how organizations deal with continuous disruption and long-term digital change — a topic he has spent decades researching, writing about, and bringing to stages around the world.
With over 1,500 keynote presentations delivered to Fortune 1000 companies and leading organisations globally, Peter brings a rare combination of strategic depth, clarity, and a dry sense of humour that turns strategy into clarity.
He is also the bestselling author of six business books, most recently The Uncertainty Principle (2025), a guide for leaders navigating what he calls the "Never Normal" — a world where disruption is not an exception but the baseline.
The summit focuses on AI in enterprise environments, where change is structural rather than incremental. Peter's keynote sets the strategic context for the day's discussions across three key themes:
Because in enterprise environments, the question is no longer whether to adopt AI, but how to do it strategically.
Enterprise Drupal Summit Europe 2026 brings together practitioners and decision-makers working on AI (and Drupal) at scale.
The program focuses on real implementations, architecture decisions, and operational lessons from enterprise and public sector environments.
A room full of decision-makers, and there's a seat with your name on it.
More information: summit.enterprisedrupal.eu
We are pleased to announce that Peter Hinssen will be the keynote speaker at the Enterprise Drupal Summit Europe 2026 in Rotterdam on 28 September 2026.
Peter Hinssen will open the summit with a session on how organizations deal with continuous disruption and long-term digital change — a topic he has spent decades researching, writing about, and bringing to stages around the world.
With over 1,500 keynote presentations delivered to Fortune 1000 companies and leading organisations globally, Peter brings a rare combination of strategic depth, clarity, and a dry sense of humour that turns strategy into clarity.
He is also the bestselling author of six business books, most recently The Uncertainty Principle (2025), a guide for leaders navigating what he calls the "Never Normal" — a world where disruption is not an exception but the baseline.
The summit focuses on AI in enterprise environments, where change is structural rather than incremental. Peter's keynote sets the strategic context for the day's discussions across three key themes:
Because in enterprise environments, the question is no longer whether to adopt AI, but how to do it strategically.
Enterprise Drupal Summit Europe 2026 brings together practitioners and decision-makers working on AI (and Drupal) at scale.
The program focuses on real implementations, architecture decisions, and operational lessons from enterprise and public sector environments.
A room full of decision-makers, and there's a seat with your name on it.
More information: summit.enterprisedrupal.eu
In Open Source software, competition works differently than in proprietary software.
Companies compete through their own products and services, but they all depend on the same commons: the software, the community, the project's reputation, and the shared work that helps people trust and adopt it.
That shared foundation creates a different kind of responsibility: sharing a commons means sharing the work of keeping it strong.
The Open Source companies I admire most show up in two ways. They compete on the merits of their own products: features, support, and price. And they help sustain the commons: through code, documentation, security, marketing, events, education, sponsorships, and more.
Over the past year, Pantheon, one of Acquia's competitors in the Drupal market, has focused much of its messaging on attacking Acquia, including making our private equity ownership part of its story.
I have no quarrel with Pantheon's products or the people who build them. Competition is healthy. My concern is with marketing that attacks another Drupal company, often with misleading or unwarranted messaging.
I've spent nearly twenty years building Acquia through different stages and ownership models. Acquia has grown from a startup into a company backed first by venture capital and later by private equity. Every ownership model creates different pressures, but ownership determines far from everything.
Customers don't choose a platform because of an ownership model. They choose it because it works, because they can get help, and because they trust it will keep getting better.
No one benefits from unwarranted vendor attacks. They benefit when companies build better products, contribute to Drupal, and help more people adopt it.
For an Open Source company, the test is not only what they build for themselves. It is what they help build for everyone.
An Open Source license defines what companies are allowed to do. It sets the floor.
Above that floor is a social contract. No one enforces it, but every healthy Open Source ecosystem depends on it.
Stewardship is what companies choose to do beyond the license: contribute code, fund security work, support maintainers, improve documentation, sponsor events, promote adoption, and more.
Drupal thrives because people and organizations honor the social contract and choose to do more than the license requires.
Drupal.org credit is one public signal of that commitment. Acquia is the largest single corporate contributor to Drupal, but the wider community contributes far more than any one company.
In the past year, Acquia engineers earned 2,955 weighted credits on Drupal issues, plus 164 from the Drupal Security Team.
These contributions are good for Acquia, for Drupal, and for every organization that builds on Drupal, including our competitors.
In the same period, Pantheon earned 30 issue credits and 2 security credits. Credits don't capture every form of contribution, and Pantheon contributes in other ways too. Even so, the gap is substantial.
I don't usually write publicly about competitors. It's not how I want to spend my voice.
Before writing this, I asked myself a simple question: if a major company contributing to Drupal were under sustained attack from another major Drupal company, would I feel a responsibility as Drupal's founder and project lead to speak up?
I would.
The fact that Acquia is the company being attacked made me slower to respond, but it doesn't change the answer.
When companies built on Drupal spend their energy attacking each other instead of growing the project, it bothers me. It's not good for Drupal.
I'm not writing this believing it will change anyone's marketing and sales tactics. I'm writing it because what we let pass now will shape what is acceptable in Drupal years from now.
Communities like ours evolve their social contract through moments like this, when we say in public what we expect of each other. If this post contributes to a healthier social contract taking hold, I'm happy.
Every company that builds on Drupal depends on the same commons. Every company has a choice about whether to help sustain it, and how much. Drupal gets stronger when more of us invest in it.
My invitation to every company that builds on Drupal is simple: let's compete on the merits of our products and services, not by attacking each other. Let's serve customers well, contribute where we can, and put our energy into helping more organizations choose Drupal in the first place.
That is the social contract I'd like all of us to live by. I want Acquia to be judged by that same standard: what we ship, how well we serve customers, how much we contribute, and whether Drupal is stronger because of our work.
Not by who owns us. Not by claims made about us. By whether we keep building, contributing, and helping the ecosystem grow.
I have said what I wanted to say, and I won't turn this into an ongoing debate or respond to social media comments on this. My focus is on building and contributing.
read moreCybersecurity remained a central concern across enterprise and open-source ecosystems this month as multiple high-profile incidents and critical vulnerability disclosures affected widely deployed platforms. Security teams continued to face pressure to patch faster, monitor exposed systems more closely, and respond to a growing volume of actively exploited vulnerabilities.
Verizon’s 2026 Data Breach Investigations Report found that the exploitation of vulnerabilities overtook stolen credentials as the leading initial access method in analysed breaches for the first time. Microsoft’s May Patch Tuesday also addressed roughly 120 vulnerabilities affecting Office, SharePoint Server, and Windows enterprise infrastructure.
The open-source sector saw renewed urgency around patch management after the Drupal Security Team released SA-CORE-2026-004, a highly critical SQL injection vulnerability affecting supported Drupal core versions using PostgreSQL databases. The advisory prompted emergency patching efforts across enterprise Drupal deployments.
Security agencies continued to warn about the growing number of actively exploited vulnerabilities tracked in CISA’s Known Exploited Vulnerabilities catalogue.
Elsewhere in the open-source ecosystem, discussion turned toward the widening gap between technological capability and public perception. In a recent post, Dries Buytaert argued that Drupal’s reputation has not kept pace with its technical evolution despite continued investment in structured content architecture, APIs, and AI-oriented tooling.
The discussion reflects a broader challenge facing mature open-source platforms competing for visibility against newer frameworks with stronger marketing momentum. Community perception increasingly shapes how projects are evaluated alongside technical capability, governance maturity, and long-term sustainability.
That said, let us now look at the major developments covered in Volume 4, Issue 21 of The Drop Times weekly newsletter, Editor’s Pick. Story listings are now permanently shifted to teaser blocks below, and we will no longer duplicate linked headlines within the Letter from the Editor.
Additional developments from across the Drupal ecosystem were published during the week. Readers can follow The Drop Times on LinkedIn, Twitter, Bluesky, and Facebook for ongoing updates. The publication is also active on Drupal Slack in the #thedroptimes channel.
Allen Jason
Junior Sub-editor
The Drop Times
Managing a patchwork of digital systems? Discover why 2026 is the year for membership bodies and charities to trade platform fragmentation for integration.
read moreManaging a patchwork of digital systems? Discover why 2026 is the year for membership bodies and charities to trade platform fragmentation for integration.
read moreToday we are talking about Web Education, Level up Tutorials, and life after Drupal with guest Scott Tolinski. We'll also cover Views Row SDC as our module of the week.
For show notes visit: https://www.talkingDrupal.com/554
TopicsScott Tolinski - tolin.ski stolinski
HostsNic Laflin - nLighteneddevelopment.com nicxvan John Picozzi - epam.com johnpicozzi Bernardo Martinez - bernardm28
MOTW CorrespondentMartin Anderson-Clutz - mandclu.com mandclu
A problem I've been struggling with for a while now is managing my bookmarks. Every time I come across an interesting article I want to read, a good resource I want to keep, or a neat tool I want to try I create a bookmark.
Over time I have collected a large collection of bookmarks so when I add a new one to the list it gets lots in the pile. I've tried to create directories to keep "new" bookmarks or organise them into sections, but I always end up scrabbling to find them.
The problem is that web browsers don't allow you to categorise or search bookmarks so I can never find them again. Also when I swap browsers (which I have done twice this year) I end up having to migrate them over and set up synchronising between computers. This always removes the favicons of the sites so I have even more trouble finding the right link.
After losing yet another bookmark again recently I decided to do something about it. I realised that #! code was the best place for it as I'm always logged into the site, so I set about creating a link directory on the site. I didn't just want a big list of links though. In my mind a good link directory takes a screenshot of the site when the link is created so that it is easy to see what links are there from the screenshot of the original site.
In this article I will go through how I set up the link directory, how links are added, and how the site is able to take screenshots of the links as they are added to the directory.
To store the links I created a content type called "Link" and added a few fields to it.
read moreThe rain had been falling on the city for weeks.
Not real rain. The kind that falls on the internet — a constant drumbeat of probes, scans, and automated fists rattling every doorknob on every block, every hour of the day. Most people don't hear it. That's fine. That's what we're here for.
My name doesn't matter. Call me the op. I run a small shop — we keep websites alive, patch the holes before the wrong people find them, and make sure that when something goes sideways, there's always a way back. It's not glamorous work. But this spring? This spring was something else.
How many Drupal Core change records (CR) has there been over the years? Is it a manageable amount for contrib maintainers? How many are about something new or deprecated? This is what it looks like since 2018. For visual effect I grouped CRs in 4 buckets:
AI is accelerating content creation, making estate-scale governance critical. Learn the 5 dimensions of content governance and why it must live natively in your CMS.
read moreKeyword search struggles with natural language and exploratory questions. Daniel walked the DrupalSouth 2026 audience through how OpenSearch and Skpr enable semantic search that understands intent and meaning, and how Retrieval-Augmented Generation (RAG) transforms results into clear, human-friendly answers grounded in your actual content.
Last week, the PreviousNext team headed over to Wellington for DrupalSouth 2026, and what a week it was.
The highlight of the week was the Splash Awards - and this year, we are honoured to have won:
Congratulations to Lee and Adam! Both deserved the recognition for their active work with the Drupal Community.
The Best in Show win for Cancer Australia makes this a remarkable run. PreviousNext has now won Best in Show three times back to back. Here's the full picture:
Wellington was also a milestone for Skpr's, which officially launched in the New Zealand market at DrupalSouth. If you haven't seen or heard about Skpr yet, now is a good time!
From there, it was all about the Drupal community. We spent the week reconnecting with familiar faces, meeting new ones, and having the kinds of conversations that don't happen over email.
We had six PreviousNext team members take the stage this year:
We were also thrilled to have Lara Saunders from Bond University join us at DrupalSouth this year. It's always great to see clients engage with the broader Drupal community.
We're incredibly proud of the team - and grateful to the clients and community who make this kind of recognition possible. See you all next year on the Gold Coast!
Drupal core includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks.
A vulnerability in this API allows an attacker to send specially crafted requests, resulting in arbitrary SQL injection for sites using PostgreSQL databases. This can lead to information disclosure, and in some cases privilege escalation, remote code execution, or other attacks.
This vulnerability can be exploited by anonymous users.
This vulnerability only affects sites using PostgreSQL. However, the dependency updates in this release apply to all sites.
The Drupal releases for supported branches (11.3, 11.2, 10.6, and 10.5) in this advisory also include security updates for Symfony and Twig. Those projects have released important Security Advisories that were coordinated with this Drupal release, and Drupal is affected by some of the vulnerabilities.
Depending on your site configuration and contrib modules, you may be vulnerable to one or more of these upstream issues, so updating these dependencies is highly recommended whether the SQL Injection vulnerability affects you or not. It is also recommended to review which user roles have the ability to update Twig templates, for example via Views or contributed modules.
Install the latest version.
The following releases will be available as soon as automated release packaging is complete. You may receive a 404 in the interim. The updates may also be available on Packagist sooner.
Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.) Due to this issue's severity, the unsupported releases and patches for unsupported versions are provided as a best effort. Those unsupported versions will still have other, previously disclosed security vulnerabilities.
Recently, I contributed an AI-powered Schema.org JSON-LD module to Drupal that uses AI automators to generate Schema.org JSON-LD, building a knowledge graph that improves SEO/AEO by making it easier for machines to understand your website. The module was built with AI in 4 days, whereas the Schema.org Blueprints module with a similar goal took 4 years. I have been so shocked by how efficiently AI can code and build software that I realized, "AI ate my work, and I need to be okay with that." I wrote about how I am adjusting to this new "AI" normal.
A slightly different reckoning is unfolding for our websites because AI is consuming our content, thereby reducing traffic. Providing Schema.org JSON-LD is one way to feed the machines. AIs are becoming the front page of most websites. To adapt to this new "AI" normal, where an AI is the gatekeeper to your website, we need to evolve our approach to building and managing our websites.
Adaptation
Personally, "adaptation" feels like the right word to describe the challenge and change we, developers, site builders, managers, and owners, are facing right now. Adaptation is forced upon us by external constraints or opportunities, depending on your point of view, to evolve our approach to building and sharing information. There is a much larger discussion about the impact of AI on who we are, what we are building, and how we build. For now, I want to focus on what Drupal-built websites need to consider to adapt and keep up with the rapidly evolving digital landscape, which is largely out of our control.
Out of our control
How AIs are consuming our websites is out of our control. If you look back at how websites continually bent and tweaked to get a bump in page ranking, implementing now-defunct things like AMP (Accelerated Mobile Pages) because Google told us to,...Read More
read moreLast week at Drupal South, Pamela Barone delivered a keynote on Drupal CMS. Her talk is one of the clearest articulations I've seen of what Drupal CMS is, why it exists, and where it's headed. That shouldn't come as a surprise because Pam is the Product Lead for Drupal CMS.
Pam quoted a familiar Drupal saying: Drupal makes hard things possible, but it also makes easy things hard.
. The room laughed because it's true.
Her keynote makes the case that Drupal CMS is making Drupal easier across the board: visual page editing, a gentler on ramp for new developers, and project economics that finally work for smaller budgets. Larger organizations such as universities, governments, and Fortune 2000 companies want those same advantages, which is why Drupal CMS matters at every scale.
Pam also explains how Drupal CMS sits on top of Drupal Core, why it is not a Drupal distribution, how it gives digital agencies leverage, what site templates unlock, and how Drupal Canvas reshapes the page building experience.
If you watch one Drupal video this week, make it Pam's!
read moreWe are proud to share that the Drupal Association has been awarded a grant from the Alpha-Omega Project, a project of The Linux Foundation, which seeks to help open source projects identify and mitigate security vulnerabilities.
As AI-generated commits and AI-driven security threats become the norm, open-source ecosystems must evolve rapidly. This funding directly strengthens the already mature Drupal Security Team, ensuring our core ecosystem is hardened against the modern, AI-age vulnerabilities.
The funding provided by Alpha-Omega will enable the Drupal Security Team to build the program we need to stay ahead in this fast moving environment. Drupal’s already excellent security position will be even better going forward.
~ Tim Doyle, CEO at Drupal Association.
Security has been a defining pillar of the Drupal ecosystem. This collaboration with the Alpha-Omega Project underscores our ongoing commitment to open-source resilience, solidifying Drupal's position as the gold standard for secure enterprise content management.
Drupal is, and will continue to be, one of the most secure CMS platforms in the world.
We are proud to share that the Drupal Association has been awarded a grant from the Alpha-Omega Project, a project of The Linux Foundation, which seeks to help open source projects identify and mitigate security vulnerabilities.
As AI-generated commits and AI-driven security threats become the norm, open-source ecosystems must evolve rapidly. This funding directly strengthens the already mature Drupal Security Team, ensuring our core ecosystem is hardened against the modern, AI-age vulnerabilities.
The funding provided by Alpha-Omega will enable the Drupal Security Team to build the program we need to stay ahead in this fast moving environment. Drupal’s already excellent security position will be even better going forward.
~ Tim Doyle, CEO at Drupal Association.
Security has been a defining pillar of the Drupal ecosystem. This collaboration with the Alpha-Omega Project underscores our ongoing commitment to open-source resilience, solidifying Drupal's position as the gold standard for secure enterprise content management.
Drupal is, and will continue to be, one of the most secure CMS platforms in the world.
Join us THURSDAY, May 21 at 1pm ET / 10am PT, for our regularly scheduled call to chat about all things Drupal and nonprofits. (Convert to your local time zone.)
We don't have anything specific on the agenda this month, so we'll have plenty of time to discuss anything that's on our minds at the intersection of Drupal and nonprofits. Got something specific you want to talk about? Feel free to share ahead of time in our collaborative Google document at https://nten.org/drupal/notes!
All nonprofit Drupal devs and users, regardless of experience level, are always welcome on this call.
This free call is sponsored by NTEN.org and open to everyone.
Information on joining the meeting can be found in our collaborative Google document.
The Enterprise Drupal Summit Europe 2026 will take place on 28 September 2026 in the SS Rotterdam.
We are now accepting session proposals.
The program focuses on Drupal in enterprise contexts, with emphasis on:
The event is aimed at practitioners and decision-makers working on enterprise digital platforms.
We are prioritizing submissions that are based on real implementations.
Relevant topics include:
Accepted formats include:
Proposals will be evaluated on:
Submissions are open via Pretalx.
Looking forward to seeing you there!
Article by: Aidan Foster, Foster Interactive
The three human skills that turn AI into a multiplier.
Creativity, strategic thinking, and articulation are the three skills that decide whether AI makes you better or just faster. - Aidan Foster
The AI discourse has one dominant message: automate faster, cut the grunt work, reduce headcount, ship more.
Most leaders are responding by getting better at execution. Better prompts. Faster workflows. More output per person.
Execution still matters. It's just not where the constraint is anymore. The leaders who pull ahead in the next three years won't be the ones who automated the most; they'll be the ones who understood where the real constraint moved.
Think back to five years ago. A new landing page meant a brief, a copywriter, a designer, a developer, a round of revisions, and three weeks of calendar time. A campaign asset required coordinating four people across two time zones for something that might run for six days before you killed it.
That friction was real. Teams were sized around it. Agencies were built on it. Budgets accounted for it. That friction is gone.
A capable team can now produce a landing page in hours. Drafts, variants, and structured content at a pace that would have required six people two years ago. The execution ceiling collapsed.
The bottleneck didn't disappear. It moved upstream, to the quality of thinking that goes in before AI touches anything.
Strategic clarity. Creative direction. Precise articulation of what you actually want.
That's where the value lives now. That's where most teams are dangerously underprepared.
A CMO walks into a strategy review and knows something is wrong. They've seen this pattern fail before, in a different market with a different product. They remember exactly how it ended.
That's not intuition in the mystical sense. It's pattern recognition built through immersion. You watch your confident calls go wrong, you figure out why, you adjust.
Strategic thinking requires experiencing consequences. You have to have been wrong, and had something depend on you being right.
Researchers studying scientists at the frontier of human knowledge found the same principle. The best of them use cultivated judgment to ask better questions, to know where to go next. AI needs to be pointed. It executes brilliantly within a defined frame. The frame has to come from somewhere.
Our sense for aesthetics, meaning and embodiment give us a vital advantage over our technological creations.
Why Human Intuition Is Still Science's Greatest Tool In The Age Of AI - Noema Magazine, 2026
Most people believe creativity is an innate trait. Either you have it or you don't. That's wrong.
86% more ideas after 3 months of training. The untrained control group barely changed.
Creativity is a muscle. It responds to reps, to practice, to deliberate exposure to new inputs. A controlled study at Radboud University found that students who went through structured creativity training nearly doubled their ideation output in under a year. The untrained group stayed completely flat. (PLOS ONE, 2020)
You cannot read your way to it. You have to do the reps.
Research across Nobel laureates and major creative contributors identified two distinct types of creativity with two distinct peak ages. Conceptual innovators - the ones who execute one brilliant overarching idea - tend to peak young. Experimental innovators - the ones who synthesize across years of accumulated experience and observation - peak in their 50s. (Galenson and Weinberg, via Big Think)
The kind of creativity that matters most in marketing is the experimental kind. The kind that gets better the more you've seen.
The senior strategist who's been in the game 15 years isn't past their creative peak. The research says they may not have hit it yet.
Articulation gets your thinking and creativity out of your head and into a form AI can use.
A VP with sharp strategic instincts and genuine creative range can still get generic output from AI if they can't extract what's in their head and structure it precisely.
Imprecise input produces generic output. Always.
The model doesn't know what your brand sounds like. It doesn't know who your buyers are, what language they use, or what keeps them up at night. It doesn't know what you've learned over three years about what actually converts.
All of that has to come from you, structured in a way AI can use. Articulation responds to deliberate practice faster than the other two. Most people never treat it as something worth developing. (Canadian Marketing Association AI Playbook, 2025)
The skills AI cannot replicate are the ones that take years to build. But knowing that doesn't help unless you act on it. Three things worth doing now:
Audit your process assumptions, not your expertise. The judgment you've built is the asset. The habits formed around the old production bottleneck are what need to change.
Treat articulation as a skill to develop deliberately. Document what you know about your buyers, your brand, your market. Structure it. That structured knowledge is what separates useful AI output from generic noise.
Do the creative reps. Consistent exposure to new inputs and new problems. New disciplines.
Give yourself and your team time to be creative. Whiteboard ideas as a group. Collect interesting work and express what specifically about it grabbed your attention.
Skip the reps and your creative edge fades.
Leaders who invest in all three first will pull ahead. The advantage compounds.
Most teams I talk to are strong on execution. The upstream work - the strategic clarity, the creative direction, the structured articulation of what makes them different - is where the gap is.
That gap is also where the opportunity is.
Drop a comment. I'd like to hear how others are thinking through this.
Sources: Noema Magazine (2026), Radboud University / PLOS ONE (2020), Galenson and Weinberg / De Economist (via Big Think), Canadian Marketing Association AI Playbook (2025)
At DrupalCon Chicago, the Driesnote included a visualization with “community” as one of the three pillars of Drupal, along with “platform” and “agencies.” That framing felt memorable, and worth exploring further.
If you attended DrupalCon Chicago, you might have experienced a slightly differently shaped triangle. I don’t know the attendance numbers, but I saw technical sessions with packed rooms, while community-focused sessions had plenty of empty seats. That’s not new. It’s been true for years. People care about community, but when the schedule forces a choice between a session on AI integration and one on community health, most folks choose the technical session. I understand why. Technical work feels concrete. Community work is generally not why employers send folks to a DrupalCon.
This raises a question: how can all of us work together to close that gap without having to attend community sessions at DrupalCon?
I serve on the Community Working Group (CWG), specifically on the Community Health Team. A lot of people don’t know there are two teams inside the CWG, so here’s the short version:
Both teams matter. And beyond the CWG, the DrupalCon Code of Conduct offers advice for all of us. It includes a section titled “We are collaborative,” which says:
If and when misunderstandings occur, we encourage people to work things out between themselves where this is practical. Where support is beneficial to achieve this, participants agree to ask for help. People are encouraged to take responsibility for their words and actions and listen to constructively-presented criticism with an open mind, courtesy, and respect.
I suspect that many people read the harassment list and the reporting email and stop there. That’s understandable. Those parts exist for a reason. But the passage above describes the wide middle ground where most friction in our community occurs.
If the only two options we envision are “this is fine” and “file a report,” we end up with a lot of buried resentment, a few dramatic blowups, and not much in between. Most day-to-day friction doesn’t rise to the level of a Code of Conduct violation. It’s tone. Assumption. Misread intent. A comment in an issue queue from someone who didn’t scroll up to read what had already been said. A joke that came off differently than it was intended.
The Community Health Team’s work is to strengthen the middle. That means helping people develop the habits and skills to address friction directly, kindly, and early, so it doesn’t compound into something that needs the Conflict Resolution Team. The Code of Conduct invites everyone to do this work. Not just CWG members. Everyone.
Here are four situations I’ve seen in the community, and in some cases been part of. None of these are scripts. They’re illustrations. The point is that the Code of Conduct invites you to try, and that you’re allowed to. You don’t need permission.
If you need help figuring out the best way to handle a situation like this, the Community Health Team is available. We can help you talk through a situation, decide whether a direct conversation is possible, or offer a second perspective. You can reach out at any time. We don’t investigate, and we don’t take sides. We think with you.
The Code says “where this is practical.” Sometimes it isn’t.
We live in a world with power differences. If the person on the other side holds significant authority over your ability to contribute, a direct conversation may not be safe for you. Ongoing patterns of behavior are different from single incidents. Safety concerns are different from style concerns. And if the other person has shown they aren’t willing to engage in good faith, you are not obligated to keep trying.
Those are incidents for the Conflict Resolution Team. Those are the situations the people on that team signed up for, and you can reach them through the incident report form. Filing a report is not escalation for its own sake. It’s using the right tool for the situation.
Returning to the Driesnote, if community is one of three pillars holding up Drupal, then the pillar can’t only be carried by the folks who show up to CWG sessions. The math doesn’t work. Community health has to happen in the rooms with the technical sessions, on the Slack channels where the code review happens, or at the dinner table where someone just got interrupted for the third time.
Most of the work the Community Health Team cares about isn’t work you need a whole session to learn. It’s work you’re already in a position to do. The next time something said in an issue queue doesn’t feel right, you catch yourself venting about someone, or you see a newcomer get talked over, you have a chance to support Drupal’s community.
Community is a pillar, which means it doesn't get held up by a small group of people with CWG in their session title. It gets held up, or it doesn't, by how we talk to each other on a Tuesday afternoon when no one's watching.
Drupal’s Code of Conduct doesn’t just give you a way to report harm. It also asks you to do the smaller, harder thing first. That’s where most community health happens.
Article by: María Fernanda Silva
If you’ve spent any time around Drupal lately, you’ve probably noticed that AI is everywhere — in the keynotes, in the hallway conversations, in the issue queues. You may also have noticed that everyone else seems to know what they're doing, while you're still trying to figure out where to start.
You are not. Not even close.
Those questions — what is actually going on, and where do I even start? — are exactly what the Drupal AI Learners Club was built for.
Angie Byron (webchick) has been part of the Drupal community since 2005: core committer, one of the driving forces behind Drupal 8, and one of those people everyone seems to know. She did not come to DrupalCon Chicago 2026 planning to start anything. She came to celebrate Drupal's 25th anniversary and catch up with old friends.
But somewhere between the hallway conversations and the late-night tables, she started picking up on something: a lot of people were anxious about AI, unsure what it meant for their work, their identity as Drupal developers, their community — and quietly terrified to admit they did not have it figured out.
"I don't know what is going on, and neither do you," she would later describe as the feeling she wanted to create space for. "It's fine. Nobody knows. It's changing too fast."
That feeling stuck with her. And the Drupal AI Learners Club was born. Not as a space to hype AI, and not as a space to condemn it, but as a place to cut through the noise and talk honestly about what these tools actually do, how people are using them, and where they fall short.
The club runs on a simple premise: come as you are. Sessions are low-pressure, informal, and require no prepared presentation. Participants share their setups, their workflows, what is working, and what is not.
The first session launched on April 8, 2026, with the topic "Share Your Setup!" and brought together community members to walk through the models, modules, agents, IDEs, and tools they were actually using day-to-day.
Sessions happen whenever someone steps up to talk about something (currently, ~weekly) and are recorded, so anyone who cannot attend live can catch up afterward. And as Angie puts it, there are no stupid questions. Everyone is here to learn, including the people who have been doing this the longest.
The Drupal AI Learners Club is not here to tell you AI is the future. It’s here to make sure that wherever this is going, the Drupal community goes together — developers, site builders, contributors, and everyone in between.
There are many ways to join the club: attend a session, suggest a topic, volunteer to present, or join the organizing team. Sessions are published to a playlist on the Drupal Association YouTube channel so you can catch up anytime, and the conversation keeps going in the #ai-learners channel on Drupal Slack.
And remember, as the Spanish proverb says: there is no silly question — only silly people who do not ask.
As we migrate more projects to GitLab on git.drupalcode.org, we have discovered improvements to make in the mapping of Drupal.org project maintainers to GitLab’s project members, ensuring that it is a 2-way synchronization.
The next time you update maintainers for your project on Drupal.org, this will update all maintainers’ access in GitLab. Please review project members in GitLab, and under Activity, the Team events. Syncing is now more thorough, so there might be more maintainership and member changes than you expect.
In the next few days we plan to bulk update GitLab project members for all projects that have maintainers with “Maintain issues” on Drupal.org, granting them the project planner role in GitLab. This will enable more access for them to manage issues and merge requests in GitLab.
We reviewed all the mappings and have settled on:
Syncing is two-way, so that saving maintainers in Drupal will keep choices made in GitLab.
Reporter is very similar to planner, however it acts the same as guest for maintainership mapping. This preserves access when flipping between setting permissions in GitLab or Drupal. Access to “Maintain issues” in Drupal is mostly irrelevant with issues migrating.
Maintainer in GitLab previously did not grant “Administer maintainers.” It should because in GitLab, it allows the Manage project members permission, so it is a direct mapping.
Removing a maintainer in GitLab will
In addition to filling the gaps in the mappings, updates to maintainership in GitLab were missed, we hadn’t implemented a listener for the user_update_for_team webhook. So updating maintainers on Drupal.org will catch up all project member roles in GitLab.
Once all issues are migrated, “Maintain issues” will be removed from Drupal, and GitLab itself will be the only way to manage access below developer.
You can find the full details in the issue at #3586519: Migrate maintainers from Drupal.org projects as GitLab members
For any specific implementation questions, please comment on the issue. For general feedback, post to Drupal Slack's #gitlab-issue-feedback channel.
Join us to hear directly from the team behind an award-winning AI solution built for local government. What does genuinely useful AI in public services look like? Not a concept, not a pilot, but a working solution that saves hours of manual work, improves accessibility, and puts better content in front of citizens faster.
Southwark Council's AI-powered PDF importer for Drupal is exactly that, and it won the prestigious Digital Leaders AI Impact Award 2026.
We are delighted to invite you to a webinar where you can hear the story first-hand.
Date: Tuesday 16th June | 16:00 BST
Guest: Angie Forson, Web and Digital Programme Lead, Southwark Council
Host: James Hall, Product Lead, Websites at Everyone TV
This is a rare opportunity to hear directly from a senior stakeholder about how Drupal and AI are delivering real, measurable value in an area that truly matters: public services for the citizens of Southwark.
Angie will walk through the journey, the challenges, the outcomes, and what it means for the wider local government sector.
Manual PDF conversion has long been one of the most time-consuming tasks facing council web teams. Converting a single document can take hours. Multiply that across thousands of PDFs and the burden becomes significant, both in staff time and in the delay it creates before citizens can access accurate, accessible information.
The Southwark team, working with their partners at Chicken, built an AI-powered importer for the LocalGov Drupal Publication Module that reduces that process to minutes, often under one minute.
Each PDF passes through a three-step pipeline:
The result is an HTML representation of the PDF content, saved into a Drupal Publication and ready for review before going live. Every import is logged, so errors can be identified and resolved efficiently.
The module uses a plugin architecture, meaning each step in the pipeline can be swapped out. Councils can use different extractors, AI models, or output to different Drupal content types, making the solution adaptable to a wide range of content and operational requirements.
The team delivered this project with an agile, user-centred approach, continuously refining requirements to ensure the tool meets real user needs rather than simply ticking a technical specification.
"This project is a great example of AI working alongside and empowering content creators, and Drupal as a platform supports this really well." - Farez Rahman, Drupal Developer
"I'm excited about the impact this product will have, not just for our users, but also in transforming how we design, build, and create content internally. We're shaping a future where services start with HTML-first thinking." - Evelyn Francourt, User Experience Lead
Local government teams across the country face the same challenge. This solution, built on open source Drupal and the LocalGov Drupal ecosystem, is designed to be shared, not kept in one place.
If your organisation publishes PDFs, manages large volumes of content, or is exploring where AI can deliver practical value without unnecessary complexity, this webinar is for you. Tuesday 16th June | 16:00 BST | Online.
This is the fourth post in our GitLab issue migration series. The earlier posts focused on what is changing and how maintainers should set up their projects. This one is for the rest of us — the people who file bugs, review code, push fixes, and triage queues without wearing a maintainer hat. If your favorite contrib project has just moved its issues to git.drupalcode.org, here's what you need to know.
When a project's issues are migrated, they move from www.drupal.org/project/{name}/issues to git.drupalcode.org/project/{name}/-/work_items. Old URLs redirect to the new ones, and issue numbers (NIDs) are preserved as GitLab IIDs — so an #3409678: Opt-in GitLab issues you find in a commit message will still resolve to the same issue.
In GitLab, "issues" are technically a subtype of "work items," but the term issue still applies, and you'll see it throughout the UI. If you've worked on any GitHub or GitLab project before, the experience will feel familiar.
A lot has not changed:
It's worth naming a few real wins for contributors:
A few permission details are worth knowing up front, because they're tighter than what you may be used to on the old issue queue:
That last point is real friction for contributors who triage and label issues, and we're addressing it directly. #3559846: Allow changing GitLab issues labels for all contributors is building a label-management UI that will live on drupal.org, alongside the existing contribution credit and issue fork management screens. Once it ships, any contributor will be able to manage labels on any issue without needing a project role on GitLab. This is also an upstream issue, but it doesn't seem to be worked on.
Until then, if metadata needs updating, leave a comment noting what should change. Maintainers and other contributors with the role can apply it.
Good news for anyone with muscle memory for Drupal's NW / NR / RTBC dance: the conventions weren't dropped in the migration. They were preserved as scoped labels on GitLab issues — state::rtbc, the equivalent state labels for needs-work and needs-review, priority labels, and so on. Each project's setup may vary, but the familiar conventions carried over, and contributors can keep using them.
| Convention | Now |
|---|---|
| Needs work | state::needsWork label (alternative: MR set to Draft) |
| Needs review | state::needsReview label (alternative: MR set to Ready) |
| RTBC | state::rtbc label (alternative: MR approval) |
| Needs reroll | Push a rebase to the issue fork branch |
Two notes:
Navigate to the project, click Work items in the left sidebar, then New item. The form is just a title and description; labels and metadata are added afterwards by users with the appropriate role. If a project has set up issue templates (markdown files in the repo), you'll see them in a dropdown.
The first comment on every new issue is posted by DrupalBot. It's the bridge to the things that still live on drupal.org:
The fork management screen on drupal.org works the same way for GitLab issues as it has for Drupal.org issues. From there, you can create a shared issue fork, request access if one already exists, push a branch, and open an MR. Branching and merging happen in GitLab's native UI, where they're already optimized.
During the transition, contributors will be working with both Drupal.org issues and GitLab issues, sometimes in the same comment. The syntax differs by direction:
[ #123456 ] (unchanged)#123456 (no brackets)For "related issues" entries on Drupal.org, always use the full URL when pointing at a GitLab issue.
A few oddities are worth flagging if you're working through historical issues:
#123456 still maps to the same issue. The original author's name is preserved in the first line of the issue description.Found a bug in the migration itself or in the integration between Drupal.org and GitLab? Please file it in the Drupal.org customizations issue queue.
Have a question, or want to share feedback on the new workflow? Join the #gitlab-issues-feedback channel on the Drupal community Slack.
We're actively iterating on this transition based on what we hear from contributors and maintainers in opted-in projects. The more feedback we get now — while we're still in the opt-in phase — the better the experience will be when the rest of contrib gets batch-migrated.
For more detail on any of the GitLab features mentioned in this post, the official GitLab documentation is the canonical source.
Issues and work items
Labels and permissions
Merge requests
Markdown
Related blog posts in this series:
Related issues
* We used Claude AI to refine our first draft and help link related materials like the GitLab documentation.