This is the first post in a three-part series about the impact of the AWS Open Source Credits program on the Drupal community. Part one covers our testing infrastructure. Part two will cover the community programs we host beyond code. Part three will cover what the AI era is doing to open source infrastructure, and what we're building next.

Drupal is one of the open web's longest-running content management projects, in continuous development since 2001, and a recognized Digital Public Good. It runs a large share of the public web: government portals, universities, hospitals, cultural institutions, and international organizations, including the European Commission and agencies across the UN system. The Drupal Association is the small non-profit that keeps the project's home online. We build the tools that enable our community to build Drupal.

Since 2025, the AWS Open Source Credits program has supported the infrastructure behind that work. This series is our thank you, and impact report about what that support has made possible.

The scale

Drupal's collaboration happens on git.drupalcode.org, our self-hosted GitLab instance and one of the largest in open source. It hosts 42,382 contributed projects: 39,003 modules, 2,400 themes, and 979 distributions, alongside Drupal core itself.

The Drupal community opens more than 5,300 merge requests every month, about 65,000 a year, from 8,000 unique contributors annually. Drupal core alone has 15,256 issue forks.

Every one of those merge requests runs through continuous integration (CI) before it can ship. Our GitLab CI runners autoscale on AWS, accounting for roughly a third of our entire cloud footprint. In the last year they executed ~4.1 million jobs, consuming ~159.8 thousand compute hours. That's 438 hours of compute per day. (Data from Aug 26, 2025 – Aug 26, 2026).

Velocity is a contributor experience challenge

Here's what autoscaling CI means for a community like ours. A contributor in Singapore, Mumbai, or Rotterdam pushes a change and gets test results back in minutes. There is no fixed pool of test machines, no queue where contributors wait on each other, no rationing of who gets to test what.

If elastic capacity, funded by credits, means those contributors have never had to deal with longer queues, capped concurrency, or asking volunteers to test less..

We care about this because contributor velocity is essential to the success of Drupal. The Drupal Association engineering team is small, just 4 people. We don't build Drupal; thousands of people do that. Our job is to make sure the tools are available and fast when they need them.

Velocity and safety are the same system

It would be easy to frame fast CI as a developer-happiness story and stop there. But for a project with Drupal's footprint, that same infrastructure is a safety system.

In the last twelve months, the Drupal Security Team has coordinated 163 security advisories across core and contributed projects. Every fix behind those advisories was developed, tested, and released through the same AWS-powered pipeline as any other change. The sites that depend on those fixes find out through us too: about 667,000 Drupal sites check in with our update infrastructure every week to learn whether they need to act. That's a conservative floor, since it only counts sites that phone home.

We also operate Drupal Steward, a protective service that shields sites during the most dangerous window in security response: the hours between a public advisory and a site's own patching. AWS powers that too.

Drupal powers governments, public utilities, and health systems worldwide, making our testing pipeline critical public infrastructure. Every automated test directly protects the security and stability of the websites people rely on daily.

A smooth transition

For two decades, much of Drupal's infrastructure ran on donated hosting at the Oregon State University Open Source Lab, which has been a quiet hero to dozens of open source projects. As the lab restructures, we have been migrating essential services to AWS. Credit support meant that migration happened without cutting contributor capacity, and without asking a small non-profit engineering team to do more with less at the worst possible moment.

Our thanks to the OSU Open Source Lab for twenty years of partnership, and to AWS for making this next chapter possible.

What's next in this series

While compute numbers show our scale, the human impact matters just as much., In our next post: the community programs we host that have nothing to do with code, and why we think that infrastructure matters just as much.

The Drupal Association is a 501(c)(3) non-profit. If your organization depends on Drupal, or on the health of open source infrastructure generally, you can support our work.

This is the first post in a three-part series about the impact of the AWS Open Source Credits program on the Drupal community. Part one covers our testing infrastructure. Part two will cover the community programs we host beyond code. Part three will cover what the AI era is doing to open source infrastructure, and what we're building next.

Drupal is one of the open web's longest-running content management projects, in continuous development since 2001, and a recognized Digital Public Good. It runs a large share of the public web: government portals, universities, hospitals, cultural institutions, and international organizations, including the European Commission and agencies across the UN system. The Drupal Association is the small non-profit that keeps the project's home online. We build the tools that enable our community to build Drupal.

Since 2025, the AWS Open Source Credits program has supported the infrastructure behind that work. This series is our thank you, and impact report about what that support has made possible.

The scale

Drupal's collaboration happens on git.drupalcode.org, our self-hosted GitLab instance and one of the largest in open source. It hosts 42,382 contributed projects: 39,003 modules, 2,400 themes, and 979 distributions, alongside Drupal core itself.

The Drupal community opens more than 5,300 merge requests every month, about 65,000 a year, from 8,000 unique contributors annually. Drupal core alone has 15,256 issue forks.

Every one of those merge requests runs through continuous integration (CI) before it can ship. Our GitLab CI runners autoscale on AWS, accounting for roughly a third of our entire cloud footprint. In the last year they executed ~4.1 million jobs, consuming ~159.8 thousand compute hours. That's 438 hours of compute per day. (Data from Aug 26, 2025 – Aug 26, 2026).

Velocity is a contributor experience challenge

Here's what autoscaling CI means for a community like ours. A contributor in Singapore, Mumbai, or Rotterdam pushes a change and gets test results back in minutes. There is no fixed pool of test machines, no queue where contributors wait on each other, no rationing of who gets to test what.

If elastic capacity, funded by credits, means those contributors have never had to deal with longer queues, capped concurrency, or asking volunteers to test less..

We care about this because contributor velocity is essential to the success of Drupal. The Drupal Association engineering team is small, just 4 people. We don't build Drupal; thousands of people do that. Our job is to make sure the tools are available and fast when they need them.

Velocity and safety are the same system

It would be easy to frame fast CI as a developer-happiness story and stop there. But for a project with Drupal's footprint, that same infrastructure is a safety system.

In the last twelve months, the Drupal Security Team has coordinated 163 security advisories across core and contributed projects. Every fix behind those advisories was developed, tested, and released through the same AWS-powered pipeline as any other change. The sites that depend on those fixes find out through us too: about 667,000 Drupal sites check in with our update infrastructure every week to learn whether they need to act. That's a conservative floor, since it only counts sites that phone home.

We also operate Drupal Steward, a protective service that shields sites during the most dangerous window in security response: the hours between a public advisory and a site's own patching. AWS powers that too.

Drupal powers governments, public utilities, and health systems worldwide, making our testing pipeline critical public infrastructure. Every automated test directly protects the security and stability of the websites people rely on daily.

A smooth transition

For two decades, much of Drupal's infrastructure ran on donated hosting at the Oregon State University Open Source Lab, which has been a quiet hero to dozens of open source projects. As the lab restructures, we have been migrating essential services to AWS. Credit support meant that migration happened without cutting contributor capacity, and without asking a small non-profit engineering team to do more with less at the worst possible moment.

Our thanks to the OSU Open Source Lab for twenty years of partnership, and to AWS for making this next chapter possible.

What's next in this series

While compute numbers show our scale, the human impact matters just as much., In our next post: the community programs we host that have nothing to do with code, and why we think that infrastructure matters just as much.

The Drupal Association is a 501(c)(3) non-profit. If your organization depends on Drupal, or on the health of open source infrastructure generally, you can support our work.

There will be a security release for a widely used contributed module on September 23, 2026 between 17:00 and 21:00 UTC.

We are announcing this release in advance because the affected contributed module is used on a significant portion of Drupal sites, and the upcoming release will include a significant number of advisories. The advisory with the highest risk score for the release is currently rated as critical.

Drupal core is not affected.

Advisories may be published in batches (a few at a time)

The current rate of advisories may require changes to our practices going forward:

• The security team may publish advisories individually, at different times inside the window.
• We will try to publish batches grouped by module.
• We will announce in Slack when all planned releases for the day are complete.
• We will release mailing list emails about the security updates together at the end of the window, to reduce the risk of site owners updating multiple times while advisories are still being published.

These changes are intended to make the process easier for the team and to make communication from the team easier to follow.

No special release procedures

The planned update does not require special release procedures.

• Bram Driesen (bramdriesen) of the Drupal Security Team
• Damien McKenna (damienmckenna) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• Moshe Weitzman (moshe weitzman) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Reposted from Acquia with permission from Acquia. Authored by Martin Anderson-Clutz (mandclu)

Drupal Canvas AI shifts content platforms from reading to writing, using governed context layers to help enterprise AI agents automate safely.

What changes when an agent stops reading your content and starts writing it?

For the last two years, the conversation about AI and content has mostly been about reading. Retrieval, summarization, a chatbot that answers a question from your knowledge base. That problem is largely solved, and it is solved almost everywhere. Any serious platform can find a relevant paragraph and hand it back.

The shift that actually changes the job of a content platform is quieter. Agents have moved from "answer my question" to "do the work." They are no longer only reading your content. They are starting to write it, assembling pages and populating components and publishing the result. The category we have called content management for twenty years was built for the first job. It was never asked to do the second.

Where the Real Cost Lands

At this point a fair objection turns up: is this not exactly why we keep a human in the loop? It is. Any content platform worth running in an enterprise keeps a person between the agent and the published page. A system that lets an agent push unreviewed work straight to production is not showing you the risk of agentic content. It is showing you that it was never built for the enterprise to begin with.

So the risk worth talking about is not the rogue page. Review catches that. The risk is waste.

A read and a write still fail in opposite directions, and the cost is what separates them. When a retrieval system returns a weak answer, one person spends a moment sorting it out and moves on. When an agent produces a weak write, a layout that misses the brand or a component wired to the wrong relationship or a draft that ignored a business rule, someone has to notice it, correct it, and often send it back to be generated again. Every one of those steps costs the reviewer's time and burns the tokens that produced the work in the first place.

That cost lands on the exact person the agent was supposed to help. The promise of agentic content is leverage, so the specialist spends their time on judgment instead of assembly. A guessing agent quietly reverses the trade. Rather than assembling the page themselves, the reviewer now inspects a draft they did not write. They hunt for the places it went wrong and explain what to change. That is not leverage. It is rework wearing the costume of automation, and it scales the wrong way, because an agent that guesses does not guess once. It guesses across every draft, at machine volume.

This is why context is the whole game. A human in the loop is cheap when the work in front of them is already right, and expensive when it is not. Give the agent structured, governed context and the review step becomes a quick yes. Hand it flat fields and hope, and the review step becomes the job you were trying to automate, now done twice.

Every Generation Answered to a Different Consumer

It helps to look at what actually changed, because the content platform has served three different consumers over its life.

For most of that history, judgment stayed with the editor. The system stored content and rendered it, while a person decided what was true, what was on-brand, and what was ready to publish. Headless moved content to more places, but it did not move that responsibility. A human still stood between the content and the world.

Agentic content management changes that. The agent now does the assembly the editor used to do, which means the judgment the editor brought to the work has to come from somewhere. A platform that carries it, with the business rules and the content relationships and the standards for what good looks like, hands the reviewer a draft that already reflects those things. A platform that cannot leaves every one of those calls for the person to supply by hand, one draft at a time. The judgment does not disappear. It moves back onto the reviewer the agent was supposed to free.

The Distinction the Category Is Missing

Here is the line most tooling blurs, and the reason so many agentic demos fall apart the moment they meet a real enterprise. Content is not context.

Content is what you publish: the page, the article, the product description, the campaign.

Context is everything an agent draws on to produce that content safely. Your brand voice. Your content model. Your business rules, your reference material, and the relationships that connect all of it. Context is what turns a vague prompt into a result the organization would actually stand behind.

Most systems collapse the two. They hand an agent a set of flat fields and hope it infers the rest: the tone, the relationships, the governance that always lived in the editor's head. Guessing works beautifully in a demo and breaks in production, because the fields never carried the context to begin with. The agent was handed the output and asked to reconstruct the reasoning behind it.

Treating context as a governed layer of its own, with clear owners, review, version history, and scope, is what separates an agent that produces a plausible draft from one an enterprise can trust to publish. The prompt gets simpler. The result gets more accountable. The organization decides in advance what the agent is allowed to know and do.

What Structure Actually Buys You

Here the shape of the underlying system stops being an implementation detail and becomes the whole question.

An agent that writes needs things the read era never demanded. It needs to see the page as a structure it can reason about, with components, order, and resolved values, rather than a wall of markup it has to pattern-match. It needs to work inside the governance that already exists, the roles and permissions and workflows the organization spent years getting right, instead of routing around them. And it needs its output to land in a reviewable state, with a record of who initiated the work and what produced it, so a person can still say yes or no before anyone sees it. Structured context is what makes that review a quick confirmation rather than a second round of work.

None of that can be added after the fact. A platform that stores content as flat, disconnected fields cannot suddenly expose relationships it never modeled. A platform with shallow governance cannot suddenly supervise an agent it was never designed to hold. These are properties of the foundation. Either the structured content and the mature governance are already there, or you are trying to pour a footing under a building that already stands.

For years, careful content modeling and granular governance were treated as overhead, the slow and unglamorous work that held teams back. The agentic era inverts that. The same rigor is now what lets a team move quickly and safely at once, because it is exactly what an agent needs in order to act without guessing.

Where This Gets Real: Drupal Canvas

Plenty of tools can turn a prompt into a layout now. That trick is becoming table stakes, and it is the wrong thing to be dazzled by. The real question is whether the layout that comes back is on-brand, relevant, usable on the devices your audience actually reaches for, and built on terms you control. The answer depends on the foundation under the prompt, and that is what Drupal Canvas is designed around.

Four differences show up the moment you move past the demo.

The first is how layouts get built. Canvas assembles them from Twig-based single-directory components, React-based code components, and Drupal blocks, so you work with the component technologies your team already knows rather than adopting one proprietary format wholesale.

The second is where the context comes from. Because Canvas can ground its work in the Context Control Center, the agent is not inventing your brand from a prompt. It is working from the voice, content model, business rules, and relationships your organization has already curated and approved. That is the difference between a layout that is merely plausible and one that is on-brand and relevant.

The third is the model underneath. Through a provider-agnostic AI layer, Canvas is not wired to a single vendor's model. You use the one that suits the task in front of you, and you change your mind later as the field moves, without re-platforming to chase whatever shipped this quarter.

The fourth is where the output can go. Coupled or decoupled, you manage the content once and render it across the front ends and devices your audience uses, so a traditional site and a headless build stay open to you from the same system.

Any one of these helps on its own. Together they are the distance between generating a layout and producing one you can put into production: on-brand because it is grounded in your context, usable anywhere because the output is ambidextrous, and built with whatever model best fits the work.

The Engine Behind It: The Drupal AI Initiative

None of this is a single product feature or a one-vendor bet. It comes out of the Drupal AI Initiative, the funded and coordinated effort in the Drupal community to make the platform both a great place to build with AI and a safe place for agents to act. That initiative is the engine behind the capabilities that put Drupal in front on the things that matter here: structured content an agent can reason about, governance it has to respect, a provider-agnostic model layer, and the freedom to publish coupled or decoupled.

The work runs on two fronts. One brings common AI features directly into Drupal so they operate together instead of as disconnected add-ons. The other makes Drupal legible and callable to agents and tools working from outside, measured against an Agent Readiness scorecard that keeps the progress honest. Because it is happening in the open, on standards-based foundations, the improvements compound for everyone building on Drupal rather than accruing to one company.

The Context Control Center is a good marker of the pace. It turns the context an agent can draw on into a governed content entity, with ownership, workflow, revisions, translations, and scope, and its first stable release is expected in the days ahead. That moves the grounding layer from promising to production, which is the exact piece most platforms are still treating as a roadmap.

If you want to see where this is heading, DrupalCon Rotterdam has two AI Summits dedicated to it. I will be presenting at the AI Dev Summit, and my colleague Scott Falconer will present at the Enterprise AI Summit, one track for the people building with these tools and one for the people who have to answer for them in production.

Design It In, Do Not Patch It On

Faced with a fast-moving category, the tempting move is to wait for a winner and buy in later. The trouble is that the properties that matter here do not arrive as an upgrade. Structured content, relationship-aware data, a governed context layer, model choice, and the freedom to render coupled or decoupled are either in the foundation or they are not.

So the question for a content team is not which AI feature to switch on. It is harder and more useful than that. When an agent stops reading your content and starts writing it, does your platform still carry the judgment that used to live with your editors? Content answers to a person. Context is what lets software act in their place. The teams that see the difference, and that build on a foundation treating context, structure, and governance as first-class concerns, are the ones who will let agents do real work while keeping a hand on what ships.

Reposted from Acquia with permission from Acquia. Authored by Martin Anderson-Clutz (mandclu)

Drupal Canvas AI shifts content platforms from reading to writing, using governed context layers to help enterprise AI agents automate safely.

What changes when an agent stops reading your content and starts writing it?

For the last two years, the conversation about AI and content has mostly been about reading. Retrieval, summarization, a chatbot that answers a question from your knowledge base. That problem is largely solved, and it is solved almost everywhere. Any serious platform can find a relevant paragraph and hand it back.

The shift that actually changes the job of a content platform is quieter. Agents have moved from "answer my question" to "do the work." They are no longer only reading your content. They are starting to write it, assembling pages and populating components and publishing the result. The category we have called content management for twenty years was built for the first job. It was never asked to do the second.

Where the Real Cost Lands

At this point a fair objection turns up: is this not exactly why we keep a human in the loop? It is. Any content platform worth running in an enterprise keeps a person between the agent and the published page. A system that lets an agent push unreviewed work straight to production is not showing you the risk of agentic content. It is showing you that it was never built for the enterprise to begin with.

So the risk worth talking about is not the rogue page. Review catches that. The risk is waste.

A read and a write still fail in opposite directions, and the cost is what separates them. When a retrieval system returns a weak answer, one person spends a moment sorting it out and moves on. When an agent produces a weak write, a layout that misses the brand or a component wired to the wrong relationship or a draft that ignored a business rule, someone has to notice it, correct it, and often send it back to be generated again. Every one of those steps costs the reviewer's time and burns the tokens that produced the work in the first place.

That cost lands on the exact person the agent was supposed to help. The promise of agentic content is leverage, so the specialist spends their time on judgment instead of assembly. A guessing agent quietly reverses the trade. Rather than assembling the page themselves, the reviewer now inspects a draft they did not write. They hunt for the places it went wrong and explain what to change. That is not leverage. It is rework wearing the costume of automation, and it scales the wrong way, because an agent that guesses does not guess once. It guesses across every draft, at machine volume.

This is why context is the whole game. A human in the loop is cheap when the work in front of them is already right, and expensive when it is not. Give the agent structured, governed context and the review step becomes a quick yes. Hand it flat fields and hope, and the review step becomes the job you were trying to automate, now done twice.

Every Generation Answered to a Different Consumer

It helps to look at what actually changed, because the content platform has served three different consumers over its life.

For most of that history, judgment stayed with the editor. The system stored content and rendered it, while a person decided what was true, what was on-brand, and what was ready to publish. Headless moved content to more places, but it did not move that responsibility. A human still stood between the content and the world.

Agentic content management changes that. The agent now does the assembly the editor used to do, which means the judgment the editor brought to the work has to come from somewhere. A platform that carries it, with the business rules and the content relationships and the standards for what good looks like, hands the reviewer a draft that already reflects those things. A platform that cannot leaves every one of those calls for the person to supply by hand, one draft at a time. The judgment does not disappear. It moves back onto the reviewer the agent was supposed to free.

The Distinction the Category Is Missing

Here is the line most tooling blurs, and the reason so many agentic demos fall apart the moment they meet a real enterprise. Content is not context.

Content is what you publish: the page, the article, the product description, the campaign.

Context is everything an agent draws on to produce that content safely. Your brand voice. Your content model. Your business rules, your reference material, and the relationships that connect all of it. Context is what turns a vague prompt into a result the organization would actually stand behind.

Most systems collapse the two. They hand an agent a set of flat fields and hope it infers the rest: the tone, the relationships, the governance that always lived in the editor's head. Guessing works beautifully in a demo and breaks in production, because the fields never carried the context to begin with. The agent was handed the output and asked to reconstruct the reasoning behind it.

Treating context as a governed layer of its own, with clear owners, review, version history, and scope, is what separates an agent that produces a plausible draft from one an enterprise can trust to publish. The prompt gets simpler. The result gets more accountable. The organization decides in advance what the agent is allowed to know and do.

What Structure Actually Buys You

Here the shape of the underlying system stops being an implementation detail and becomes the whole question.

An agent that writes needs things the read era never demanded. It needs to see the page as a structure it can reason about, with components, order, and resolved values, rather than a wall of markup it has to pattern-match. It needs to work inside the governance that already exists, the roles and permissions and workflows the organization spent years getting right, instead of routing around them. And it needs its output to land in a reviewable state, with a record of who initiated the work and what produced it, so a person can still say yes or no before anyone sees it. Structured context is what makes that review a quick confirmation rather than a second round of work.

None of that can be added after the fact. A platform that stores content as flat, disconnected fields cannot suddenly expose relationships it never modeled. A platform with shallow governance cannot suddenly supervise an agent it was never designed to hold. These are properties of the foundation. Either the structured content and the mature governance are already there, or you are trying to pour a footing under a building that already stands.

For years, careful content modeling and granular governance were treated as overhead, the slow and unglamorous work that held teams back. The agentic era inverts that. The same rigor is now what lets a team move quickly and safely at once, because it is exactly what an agent needs in order to act without guessing.

Where This Gets Real: Drupal Canvas

Plenty of tools can turn a prompt into a layout now. That trick is becoming table stakes, and it is the wrong thing to be dazzled by. The real question is whether the layout that comes back is on-brand, relevant, usable on the devices your audience actually reaches for, and built on terms you control. The answer depends on the foundation under the prompt, and that is what Drupal Canvas is designed around.

Four differences show up the moment you move past the demo.

The first is how layouts get built. Canvas assembles them from Twig-based single-directory components, React-based code components, and Drupal blocks, so you work with the component technologies your team already knows rather than adopting one proprietary format wholesale.

The second is where the context comes from. Because Canvas can ground its work in the Context Control Center, the agent is not inventing your brand from a prompt. It is working from the voice, content model, business rules, and relationships your organization has already curated and approved. That is the difference between a layout that is merely plausible and one that is on-brand and relevant.

The third is the model underneath. Through a provider-agnostic AI layer, Canvas is not wired to a single vendor's model. You use the one that suits the task in front of you, and you change your mind later as the field moves, without re-platforming to chase whatever shipped this quarter.

The fourth is where the output can go. Coupled or decoupled, you manage the content once and render it across the front ends and devices your audience uses, so a traditional site and a headless build stay open to you from the same system.

Any one of these helps on its own. Together they are the distance between generating a layout and producing one you can put into production: on-brand because it is grounded in your context, usable anywhere because the output is ambidextrous, and built with whatever model best fits the work.

The Engine Behind It: The Drupal AI Initiative

None of this is a single product feature or a one-vendor bet. It comes out of the Drupal AI Initiative, the funded and coordinated effort in the Drupal community to make the platform both a great place to build with AI and a safe place for agents to act. That initiative is the engine behind the capabilities that put Drupal in front on the things that matter here: structured content an agent can reason about, governance it has to respect, a provider-agnostic model layer, and the freedom to publish coupled or decoupled.

The work runs on two fronts. One brings common AI features directly into Drupal so they operate together instead of as disconnected add-ons. The other makes Drupal legible and callable to agents and tools working from outside, measured against an Agent Readiness scorecard that keeps the progress honest. Because it is happening in the open, on standards-based foundations, the improvements compound for everyone building on Drupal rather than accruing to one company.

The Context Control Center is a good marker of the pace. It turns the context an agent can draw on into a governed content entity, with ownership, workflow, revisions, translations, and scope, and its first stable release is expected in the days ahead. That moves the grounding layer from promising to production, which is the exact piece most platforms are still treating as a roadmap.

If you want to see where this is heading, DrupalCon Rotterdam has two AI Summits dedicated to it. I will be presenting at the AI Dev Summit, and my colleague Scott Falconer will present at the Enterprise AI Summit, one track for the people building with these tools and one for the people who have to answer for them in production.

Design It In, Do Not Patch It On

Faced with a fast-moving category, the tempting move is to wait for a winner and buy in later. The trouble is that the properties that matter here do not arrive as an upgrade. Structured content, relationship-aware data, a governed context layer, model choice, and the freedom to render coupled or decoupled are either in the foundation or they are not.

So the question for a content team is not which AI feature to switch on. It is harder and more useful than that. When an agent stops reading your content and starts writing it, does your platform still carry the judgment that used to live with your editors? Content answers to a person. Context is what lets software act in their place. The teams that see the difference, and that build on a foundation treating context, structure, and governance as first-class concerns, are the ones who will let agents do real work while keeping a hand on what ships.

Its that time of the year where you stand the best chance to secure your spot for DrupalCon Orlando at the lowest price of the year.

Starting September 14, 2026, tickets are available at just $650. But that's not all. Every paid Early Bird registrant will receive Drupy, a limited-edition PHP elePHPant x DrupalCon plush, complete with a latin name: Elephpas hypertextus drupalensis primus, roughly translated to "the first Drupal PHP elephant." Drupy will be available for pickup at registration in Orlando while supplies last, so the earlier you register, the better!

DrupalCon Orlando 2027 takes place March 22–25, 2027 at the Hyatt Regency Grand Cypress Resort, a stunning 1,500-acre resort just minutes from Walt Disney World® and Universal Orlando Resort™. All conference activities happen right at the hotel, putting you at the center of everything from keynotes and sessions to hallway conversations and community gatherings.

The Early Bird rate is available until February 1, 2027 at 7:59 AM EST, after which prices go up. Registering early also means you'll have more time to plan your trip, book your stay at the official hotel block at the discounted rate starting at just $259/night with no resort fee, and make the most of everything DrupalCon Orlando has to offer.

Written by Duncan Worrell (dunx)

DrupalCon Rotterdam is almost here. Alongside two dedicated AI summits and the main conference keynote, the program is stacked with high-value AI content for developers, strategists, and leaders alike. Whether you're looking to push agentic workflows, scale digital governance, streamline content operations, or keep your AI integrations trustworthy, here is a complete breakdown of the top AI sessions to help you optimize your schedule.

Full schedule at https://events.drupal.org/rotterdam2026/schedule
Tickets at https://events.drupal.org/rotterdam2026/registration-information

All session times are local CEST.

Summits

In addition to the main DrupalCon event, there are two AI-specific summits being held catering for two very different audiences.

Enterprise Drupal AI Summit

An executive-focused event for CXOs, Heads of Digital, and enterprise leaders connecting with curated Drupal AI partners. Hosted on the historic former ocean liner, SS Rotterdam. 

Date & Time: All day Monday, 28 September
Event details here: https://summit.enterprisedrupal.eu/schedule.html

AI Dev Summit

Getting Drupal developers up to speed on AI coding tools, AI in PHP/Symfony/Drupal frameworks, Canvas, and Drupal CMS innovations.

Date & Time: All day Monday, 28 September
Event details here: https://events.drupal.org/rotterdam2026/ai-dev-summit

Keynote

For many, the DriesNote by Drupal founder Dries Buytaert is the week’s highlight. Expect a keynote packed with the latest AI roadmap updates, architectural reveals, and live technical demos.

Date & Time: Tuesday, September 29, 2026 - 10:30 to 11:45

DriesNote will live stream on YouTube if you can’t make the event in person.

Sessions

Every session is likely to mention “AI” but we expect these sessions to be focused on AI. 

Unblocking AI: Why Programmes Stall at Pilot Stage, and How to Move Past It

Research and strategies for moving AI initiatives past the pilot phase to deliver real-world impact.

Date & Time: Tuesday, 29 September 2026, 13:00 – 13:10
Speakers: Amanda Falshaw (AI Enablement Lead at Reading Room) & Megan Harvey (Reading Room)

Open Intranet: A Drupal-Based Digital Workplace

Features AI-assisted content creation as part of an open-source Drupal intranet workspace.

Date & Time: Tuesday, 29 September 2026, 13:15 – 13:25  
Speaker: Maciej Łukiański (CEO and Co-founder of Droptica)

Culture Mapping the Human Side of AI — A Workshop to Meet Your People Where They Are

Leadership and organizational change management required to guide teams through fast-moving AI adoption.

Date & Time: Tuesday, 29 September 2026, 13:30 – 14:15  
Speaker: Timi Csontos (Culture Consultant/Freelygive)

Reviewer-Friendly AI: A Practical Drupal Contribution Workshop

Practical AI-assisted workflows designed to turn ideas into high-quality, review-ready open-source contributions.

Date & Time: Tuesday, 29 September 2026, 13:30 – 14:15  
Speaker: Scott Falconer (Senior Principal Software Engineer at Acquia)

Why Your AI Agent Hallucinates: Engineering Lessons From a Production Workflow Builder in Drupal

Engineering reliable, trustworthy AI agent integrations in Drupal using modules like AI, ECA, and agentic tools.

Date & Time: Tuesday, 29 September 2026, 13:30 – 14:15  
Speaker: Shibin Devadas Kakanat (Backend Pro Lead at Factorial)

Context Control Center: Bringing AI Context Natively to Drupal CMS

Structuring, scoping, and natively managing AI context within Drupal CMS for downstream agents and tools.

Date & Time: Tuesday, 29 September 2026, 14:25 – 15:10  
Speakers: Emma Horrell (User Experience Manager University of Edinburgh and UX Research Lead for Drupal CMS) & James Abrahams (Technical Director at Freelygive)

Encoding Expertise: How UX Research Powers Human-First AI

Applying UX research methods to train and ground AI content tools to output domain-specific quality.

Date & Time: Tuesday, 29 September 2026, 14:25 – 15:10  
Speaker: Aidan Foster (Senior UX Strategist at Kanopi Studios)

From Shadow AI to Sovereign AI Infrastructure

Addressing data security, compliance, provider selection, and cost control as AI adoption scales.

Date & Time: Tuesday, 29 September 2026, 14:25 – 15:10  
Speaker: Michael Schmid (Head of Technology and Co-Founder of amazee.io)

AI-assisted site migration to Drupal Canvas: a real-world case study

Testing AI coding agents on live projects to automate complex site migrations into Drupal Canvas, examining real metrics, wins, and limitations.

Date & Time: Wednesday, 30 September 2026, 10:45 – 11:30  
Speakers: Wolfgang Ziegler (Architect, Founder of drunomics) & Jeremy Chinquist (Project Manager at drunomics)

AI-Augmented Accessibility: From Automated Alt-Text to Governance Gates

Automating inclusive governance and identifying accessibility errors early by bridging code, humans, and AI workflows.

Date & Time: Wednesday, 30 September 2026, 10:45 – 11:30  
Speaker: Mike Gifford (Senior Accessibility Strategist at CivicActions)

Nobody Asked for a CMS: From Content Management to Answer Delivery in the Age of AI

Adapting content architecture for direct answer delivery to AI systems while increasing Drupal’s strategic value.

Date & Time: Wednesday, 30 September 2026, 10:45 – 11:30  
Speakers: Tomi Mikola & Ulla Koho (both digital strategists and content architects at Wunder)

Clean Code in the Age of AI: Writing for Humans When Machines Write the Code

Maintaining human readability, software architecture, and clean code standards when using AI generators.

Date & Time: Wednesday, 30 September 2026, 11:40 – 12:25  
Speaker: Len Swaneveld (Senior Drupal Developer at iO)

One Brand Voice from 35 Sources: How We Rebuilt VisitEurope.com and How Drupal AI Unifies Its Tone

Unifying 35 national voices into a cohesive travel brand using generative AI integrated into Drupal.

Date & Time: Wednesday, 30 September 2026, 11:40 – 12:25  
Speakers: Krisztián Kása & Zsófia Alföldi (both Project Managers at Brainsum)

AI Best Practises

Leveraging Drupal’s structured architecture to build optimized environments for AI Agents running inside and outside CMS boundaries.

Date & Time: Wednesday, 30 September 2026, 12:30 – 12:40  
Speaker: James Abrahams (Technical Director at Freelygive)

The New Front Door: How AI Agents Are Driving Drupal's Growth

How autonomous AI agents act as primary decision-makers selecting, building, and verifying Drupal systems.

Date & Time: Wednesday, 30 September 2026, 12:45 – 13:30  
Speaker: Scott Falconer (Senior Principal Software Engineer at Acquia)

Drupal AI Product Update: From Foundation to Agentic Workflows

Official product update from the Drupal AI Initiative leadership on building production-ready Agentic CMS capabilities.

Date & Time: Wednesday, 30 September 2026, 13:40 – 14:25  
Speakers: Niels Aers (CTO/AI Tech Lead at Dropsolid) & Dr. Christoph Breidert (CEO and Founder of 1xINTERNET)

From Brief to Review-Ready in 60 Minutes: A Governed AI Campaign Workflow in Drupal 11

Generating governed, high-quality draft campaign pages straight from PDF briefs in minutes without code tickets.

Date & Time: Wednesday, 30 September 2026, 13:40 – 14:00  
Speaker: Kieran Cott (Executive Creative Technology Director at Delete Agency)

How can we improve Drupal's visibility in ChatGPT, Gemini, and Claude?

Open discussion on improving how LLMs describe, evaluate, and recommend Drupal to users.

Date & Time: Wednesday, 30 September 2026, 13:40 – 14:25  
Speaker: Larissa Tropp (Digital Marketing & Growth Specialist at 1xINTERNET)

Dismantling and Reassembling a Drupal Migration with AI

Leveraging AI tools to simplify, re-architect, and map legacy un-typed data into clean destination bundles during migrations.

Date & Time: Wednesday, 30 September 2026, 14:45 – 15:30  
Speaker: Roberto Peruzzo (Principal Architect and Founder of Sparklingboys)

AI Mid-Life Crisis: failure stories from the silent majority

Honest post-mortems on AI project failures and pragmatic ways to navigate rapid technological shifts.

Date & Time: Wednesday, 30 September 2026, 14:45 – 15:30  
Speakers: Dieter Blomme (Drupal Architect at Dropsolid) & Valery Lourie (Lead Software Engineer at EPAM Systems)

Scolta: Drop-in AI Search Without a Search Server

Running lightweight, client-side search powered by Pagefind with an AI layer for query expansion and summaries.

Date & Time: Wednesday, 30 September 2026, 14:45 – 15:30  
Speaker: Jeremy Andrews (CEO and Founder of Tag1 Consulting)

SDCs, Canvas, and the Agent That Builds With Them

Training AI agents to generate Single Directory Components, insert them into pages, and verify browser rendering.

Date & Time: Wednesday, 30 September 2026, 14:45 – 15:30  
Speaker: Matt Glaman (Principal Software Engineer at Acquia)

AI Assists, Humans Decide: Agentic Workflows in Drupal - A Drupal AI Hackathon Story

Agentic translation and governance workflows developed for the European Commission across 24 languages.

Date & Time: Wednesday, 30 September 2026, 16:00 – 16:45  
Speakers: David Galeano & Adam Nagy (both work in the DIGIT department at the European Commission)

AI-Powered Site Building in Drupal: From Blank Site to Styled Pages in a Conversation

Enabling non-technical users to build, style, and structure complete Drupal sites via conversational prompts.

Date & Time: Wednesday, 30 September 2026, 16:00 – 16:45  
Speakers: Francesco Pesenti & Francesco Quagliati (both are Developer Advocates and Solution Engineers at Platform.sh)

From Drupal Content to AI Answers: Learnings from EPSY

Designing constrained AI search engines over standard chatbots to deliver structured content answers.

Date & Time: Wednesday, 30 September 2026, 16:00 – 16:45  
Speaker: Antonella Picarella (Head of Digital Communications & Content Strategy at BFF Banking Group)

From SEO to GEO: What Changes, What Doesn’t

Strategic shifts from Search Engine Optimization to Generative Engine Optimization as AI engines handle discovery.

Date & Time: Wednesday, 30 September 2026, 16:00 – 16:45  
Speaker: Wouter De Bruycker (Digital Marketing Strategist at Dropsolid)

From local voices to global impact: Powering World Cancer Day with Drupal and AI

Translating and moderating hundreds of high-volume personal stories across 60+ languages using AI tools.

Date & Time: Wednesday, 30 September 2026, 17:00 – 17:45  
Speakers: Charles Andrew Revkin & Diego Fernando Costa (both part of the digital communications team at the Union for International Cancer Control (UICC), which runs World Cancer Day)

How Marketers Win in an AI‑First Search World (AEO & GEO Playbook)

Practical tactics for Answer Engine Optimization (AEO) and maintaining content discoverability in AI platforms.

Date & Time: Wednesday, 30 September 2026, 17:00 – 17:45  
Speakers: Reena Tripathi (Digital Marketing Manager at OpenSense Labs) & Anubhav Gupta (CEO/Technical Architect at OpenSense Labs)

Whether you’re coming to DrupalCon Rotterdam to build with AI, figure out how to govern it, or understand where it is taking Drupal next, there is a lot to choose from. From the two Monday summits through the DriesNote and a packed slate of sessions, AI is clearly woven throughout this year’s programme. Check the full schedule, plan around the sessions that matter most to you, and we’ll see you in Rotterdam.

Written by Duncan Worrell (dunx)

DrupalCon Rotterdam is almost here. Alongside two dedicated AI summits and the main conference keynote, the program is stacked with high-value AI content for developers, strategists, and leaders alike. Whether you're looking to push agentic workflows, scale digital governance, streamline content operations, or keep your AI integrations trustworthy, here is a complete breakdown of the top AI sessions to help you optimize your schedule.

Full schedule at https://events.drupal.org/rotterdam2026/schedule
Tickets at https://events.drupal.org/rotterdam2026/registration-information

All session times are local CEST.

Summits

In addition to the main DrupalCon event, there are two AI-specific summits being held catering for two very different audiences.

Enterprise Drupal AI Summit

An executive-focused event for CXOs, Heads of Digital, and enterprise leaders connecting with curated Drupal AI partners. Hosted on the historic former ocean liner, SS Rotterdam. 

Date & Time: All day Monday, 28 September
Event details here: https://summit.enterprisedrupal.eu/schedule.html

AI Dev Summit

Getting Drupal developers up to speed on AI coding tools, AI in PHP/Symfony/Drupal frameworks, Canvas, and Drupal CMS innovations.

Date & Time: All day Monday, 28 September
Event details here: https://events.drupal.org/rotterdam2026/ai-dev-summit

Keynote

For many, the DriesNote by Drupal founder Dries Buytaert is the week’s highlight. Expect a keynote packed with the latest AI roadmap updates, architectural reveals, and live technical demos.

Date & Time: Tuesday, September 29, 2026 - 10:30 to 11:45

DriesNote will live stream on YouTube if you can’t make the event in person.

Sessions

Every session is likely to mention “AI” but we expect these sessions to be focused on AI. 

Unblocking AI: Why Programmes Stall at Pilot Stage, and How to Move Past It

Research and strategies for moving AI initiatives past the pilot phase to deliver real-world impact.

Date & Time: Tuesday, 29 September 2026, 13:00 – 13:10
Speakers: Amanda Falshaw (AI Enablement Lead at Reading Room) & Megan Harvey (Reading Room)

Open Intranet: A Drupal-Based Digital Workplace

Features AI-assisted content creation as part of an open-source Drupal intranet workspace.

Date & Time: Tuesday, 29 September 2026, 13:15 – 13:25  
Speaker: Maciej Łukiański (CEO and Co-founder of Droptica)

Culture Mapping the Human Side of AI — A Workshop to Meet Your People Where They Are

Leadership and organizational change management required to guide teams through fast-moving AI adoption.

Date & Time: Tuesday, 29 September 2026, 13:30 – 14:15  
Speaker: Timi Csontos (Culture Consultant/Freelygive)

Reviewer-Friendly AI: A Practical Drupal Contribution Workshop

Practical AI-assisted workflows designed to turn ideas into high-quality, review-ready open-source contributions.

Date & Time: Tuesday, 29 September 2026, 13:30 – 14:15  
Speaker: Scott Falconer (Senior Principal Software Engineer at Acquia)

Why Your AI Agent Hallucinates: Engineering Lessons From a Production Workflow Builder in Drupal

Engineering reliable, trustworthy AI agent integrations in Drupal using modules like AI, ECA, and agentic tools.

Date & Time: Tuesday, 29 September 2026, 13:30 – 14:15  
Speaker: Shibin Devadas Kakanat (Backend Pro Lead at Factorial)

Context Control Center: Bringing AI Context Natively to Drupal CMS

Structuring, scoping, and natively managing AI context within Drupal CMS for downstream agents and tools.

Date & Time: Tuesday, 29 September 2026, 14:25 – 15:10  
Speakers: Emma Horrell (User Experience Manager University of Edinburgh and UX Research Lead for Drupal CMS) & James Abrahams (Technical Director at Freelygive)

Encoding Expertise: How UX Research Powers Human-First AI

Applying UX research methods to train and ground AI content tools to output domain-specific quality.

Date & Time: Tuesday, 29 September 2026, 14:25 – 15:10  
Speaker: Aidan Foster (Senior UX Strategist at Kanopi Studios)

From Shadow AI to Sovereign AI Infrastructure

Addressing data security, compliance, provider selection, and cost control as AI adoption scales.

Date & Time: Tuesday, 29 September 2026, 14:25 – 15:10  
Speaker: Michael Schmid (Head of Technology and Co-Founder of amazee.io)

AI-assisted site migration to Drupal Canvas: a real-world case study

Testing AI coding agents on live projects to automate complex site migrations into Drupal Canvas, examining real metrics, wins, and limitations.

Date & Time: Wednesday, 30 September 2026, 10:45 – 11:30  
Speakers: Wolfgang Ziegler (Architect, Founder of drunomics) & Jeremy Chinquist (Project Manager at drunomics)

AI-Augmented Accessibility: From Automated Alt-Text to Governance Gates

Automating inclusive governance and identifying accessibility errors early by bridging code, humans, and AI workflows.

Date & Time: Wednesday, 30 September 2026, 10:45 – 11:30  
Speaker: Mike Gifford (Senior Accessibility Strategist at CivicActions)

Nobody Asked for a CMS: From Content Management to Answer Delivery in the Age of AI

Adapting content architecture for direct answer delivery to AI systems while increasing Drupal’s strategic value.

Date & Time: Wednesday, 30 September 2026, 10:45 – 11:30  
Speakers: Tomi Mikola & Ulla Koho (both digital strategists and content architects at Wunder)

Clean Code in the Age of AI: Writing for Humans When Machines Write the Code

Maintaining human readability, software architecture, and clean code standards when using AI generators.

Date & Time: Wednesday, 30 September 2026, 11:40 – 12:25  
Speaker: Len Swaneveld (Senior Drupal Developer at iO)

One Brand Voice from 35 Sources: How We Rebuilt VisitEurope.com and How Drupal AI Unifies Its Tone

Unifying 35 national voices into a cohesive travel brand using generative AI integrated into Drupal.

Date & Time: Wednesday, 30 September 2026, 11:40 – 12:25  
Speakers: Krisztián Kása & Zsófia Alföldi (both Project Managers at Brainsum)

AI Best Practises

Leveraging Drupal’s structured architecture to build optimized environments for AI Agents running inside and outside CMS boundaries.

Date & Time: Wednesday, 30 September 2026, 12:30 – 12:40  
Speaker: James Abrahams (Technical Director at Freelygive)

The New Front Door: How AI Agents Are Driving Drupal's Growth

How autonomous AI agents act as primary decision-makers selecting, building, and verifying Drupal systems.

Date & Time: Wednesday, 30 September 2026, 12:45 – 13:30  
Speaker: Scott Falconer (Senior Principal Software Engineer at Acquia)

Drupal AI Product Update: From Foundation to Agentic Workflows

Official product update from the Drupal AI Initiative leadership on building production-ready Agentic CMS capabilities.

Date & Time: Wednesday, 30 September 2026, 13:40 – 14:25  
Speakers: Niels Aers (CTO/AI Tech Lead at Dropsolid) & Dr. Christoph Breidert (CEO and Founder of 1xINTERNET)

From Brief to Review-Ready in 60 Minutes: A Governed AI Campaign Workflow in Drupal 11

Generating governed, high-quality draft campaign pages straight from PDF briefs in minutes without code tickets.

Date & Time: Wednesday, 30 September 2026, 13:40 – 14:00  
Speaker: Kieran Cott (Executive Creative Technology Director at Delete Agency)

How can we improve Drupal's visibility in ChatGPT, Gemini, and Claude?

Open discussion on improving how LLMs describe, evaluate, and recommend Drupal to users.

Date & Time: Wednesday, 30 September 2026, 13:40 – 14:25  
Speaker: Larissa Tropp (Digital Marketing & Growth Specialist at 1xINTERNET)

Dismantling and Reassembling a Drupal Migration with AI

Leveraging AI tools to simplify, re-architect, and map legacy un-typed data into clean destination bundles during migrations.

Date & Time: Wednesday, 30 September 2026, 14:45 – 15:30  
Speaker: Roberto Peruzzo (Principal Architect and Founder of Sparklingboys)

AI Mid-Life Crisis: failure stories from the silent majority

Honest post-mortems on AI project failures and pragmatic ways to navigate rapid technological shifts.

Date & Time: Wednesday, 30 September 2026, 14:45 – 15:30  
Speakers: Dieter Blomme (Drupal Architect at Dropsolid) & Valery Lourie (Lead Software Engineer at EPAM Systems)

Scolta: Drop-in AI Search Without a Search Server

Running lightweight, client-side search powered by Pagefind with an AI layer for query expansion and summaries.

Date & Time: Wednesday, 30 September 2026, 14:45 – 15:30  
Speaker: Jeremy Andrews (CEO and Founder of Tag1 Consulting)

SDCs, Canvas, and the Agent That Builds With Them

Training AI agents to generate Single Directory Components, insert them into pages, and verify browser rendering.

Date & Time: Wednesday, 30 September 2026, 14:45 – 15:30  
Speaker: Matt Glaman (Principal Software Engineer at Acquia)

AI Assists, Humans Decide: Agentic Workflows in Drupal - A Drupal AI Hackathon Story

Agentic translation and governance workflows developed for the European Commission across 24 languages.

Date & Time: Wednesday, 30 September 2026, 16:00 – 16:45  
Speakers: David Galeano & Adam Nagy (both work in the DIGIT department at the European Commission)

AI-Powered Site Building in Drupal: From Blank Site to Styled Pages in a Conversation

Enabling non-technical users to build, style, and structure complete Drupal sites via conversational prompts.

Date & Time: Wednesday, 30 September 2026, 16:00 – 16:45  
Speakers: Francesco Pesenti & Francesco Quagliati (both are Developer Advocates and Solution Engineers at Platform.sh)

From Drupal Content to AI Answers: Learnings from EPSY

Designing constrained AI search engines over standard chatbots to deliver structured content answers.

Date & Time: Wednesday, 30 September 2026, 16:00 – 16:45  
Speaker: Antonella Picarella (Head of Digital Communications & Content Strategy at BFF Banking Group)

From SEO to GEO: What Changes, What Doesn’t

Strategic shifts from Search Engine Optimization to Generative Engine Optimization as AI engines handle discovery.

Date & Time: Wednesday, 30 September 2026, 16:00 – 16:45  
Speaker: Wouter De Bruycker (Digital Marketing Strategist at Dropsolid)

From local voices to global impact: Powering World Cancer Day with Drupal and AI

Translating and moderating hundreds of high-volume personal stories across 60+ languages using AI tools.

Date & Time: Wednesday, 30 September 2026, 17:00 – 17:45  
Speakers: Charles Andrew Revkin & Diego Fernando Costa (both part of the digital communications team at the Union for International Cancer Control (UICC), which runs World Cancer Day)

How Marketers Win in an AI‑First Search World (AEO & GEO Playbook)

Practical tactics for Answer Engine Optimization (AEO) and maintaining content discoverability in AI platforms.

Date & Time: Wednesday, 30 September 2026, 17:00 – 17:45  
Speakers: Reena Tripathi (Digital Marketing Manager at OpenSense Labs) & Anubhav Gupta (CEO/Technical Architect at OpenSense Labs)

Whether you’re coming to DrupalCon Rotterdam to build with AI, figure out how to govern it, or understand where it is taking Drupal next, there is a lot to choose from. From the two Monday summits through the DriesNote and a packed slate of sessions, AI is clearly woven throughout this year’s programme. Check the full schedule, plan around the sessions that matter most to you, and we’ll see you in Rotterdam.

The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal.

Vulnerabilities are possible if Drupal is configured to use CKEditor for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit this Cross-Site Scripting (XSS) vulnerability to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.

For more information, see CKEditor's security advisory:

• High-severity Cross-site scripting (XSS) in the engine package

Install the latest version:

Drupal 11

• If you use Drupal 11.4.x, update to Drupal 11.4.7.
• If you use Drupal 11.3.x, update to Drupal 11.3.17.
• Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

• If you use Drupal 10.6.x, update to Drupal 10.6.17.
• Drupal 10.5.x and below are end-of-life and do not receive security coverage.

Note that Drupal 8 and Drupal 9 have both reached end-of-life.

Instructions for contributed modules

Site owners should also review their site following the protocol for managing external libraries and plugins, as contributed projects may use additional CKEditor plugins not packaged in Drupal core.

CKEditor has also released another CVE in today's release that does not affect Drupal, but may affect custom plugins or other usecases:

• Low-severity Cross-site scripting (XSS) in the engine package

• Piotrek Koszuliński (Reinmar)

• catch (catch) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Mohit Aghera (mohit_aghera), provisional member of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

• Bram Driesen (bramdriesen) of the Drupal Security Team
• catch (catch) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Join us THURSDAY, September 17 at 1pm ET / 10am PT, for our regularly scheduled call to chat about all things Drupal and nonprofits. (Convert to your local time zone.)

We don't have anything specific on the agenda this month, so we'll have plenty of time to discuss anything that's on our minds at the intersection of Drupal and nonprofits. Got something specific you want to talk about? Feel free to share ahead of time in our collaborative Google document at https://nten.org/drupal/notes!

All nonprofit Drupal devs and users, regardless of experience level, are always welcome on this call.

This free call is sponsored by NTEN.org and open to everyone.

Information on joining the meeting can be found in our collaborative Google document.

Author: Will Huggins

Imagine asking an AI assistant:

"Show me waterproof jackets under £150, in size M, available for delivery tomorrow".

Today, the assistant might search the web, read several retail websites and summarise what it finds. But what if, instead of reading pages, the agent could ask retailers directly which products matched those requirements?

With that information, you could fast-track your shopping journey and ask:

"Add [my chosen product] to my basket"

The important change here isn't the chatbot; it’s what sits behind it. A traditional website can tell an AI agent what products it has and provide the details. Tomorrow’s website will give the agent a controlled way to buy it.

That is the shift from publishing pages to publishing capabilities. It fundamentally changes what we expect a CMS to do.

Ever since the early days of the internet, content management systems have had a fairly straightforward job: someone creates a piece of content, the CMS publishes it as a page, a person finds that page, and then reads it and decides what to do next.

Over time, CMS capabilities developed around improved findability of content and the experience humans have when they land on a page. AI agents are now changing that equation, introducing a different type of interaction that moves beyond pages altogether, in search of capabilities that solve a problem rather than pages to read.

A page tells you what an organisation can do. A capability lets you do it

Take that same retailer from the jacket example. Its website contains thousands of pages describing products, categories, delivery and returns information, promotions, and offers. That information is useful to both human and AI visitors. But the retailer doesn't only have information, it offers services too: searching products according to particular requirements, comparing specifications, checking availability, calculating delivery, adding products to a basket, and buying them.

The focus is on wrapping those capabilities in an interface that optimises the customer’s experience and drives greater conversion. Those ‘wrappers’ are navigation menus, search boxes, filters, buttons and checkout flows that guide someone towards that conversion target.

Think of an AI agent less like another customer and more like a personal shopper acting on their behalf. Or, perhaps, interacting directly with the shop's warehouse rather than the shop staff.

The visiting customer may care about the photography, the brand story, the layout, and the overall shopping experience. And whilst these elements remain vital in building trust with a potential customer, the personal shopper has a different job. They need to understand what the customer wants, quickly identify suitable products, check availability, compare options and, if instructed, complete the purchase.

They don't need to navigate the website the same way the customer does. In fact, forcing them through the same menus, filters and checkout steps may simply create unnecessary friction. The AI agent needs reliable, structured ways and clearly defined methods to discover what the retailer offers and what actions it can perform.

AI agents need to know not just what the retailer sells, but how to search, compare, check and buy on the customer's behalf, potentially across numerous websites at once. The retailer that makes the personal shopper's job frictionless is the one more likely to win the sale.

The webpage isn't disappearing

None of this means websites are about to become obsolete. People will continue to visit websites, and great digital experiences will still require accessible interfaces, thoughtful design, persuasive content, and strong brand experiences. A retailer still needs customers to trust its products!

But the webpage will increasingly become one interface to an organisation's digital information and services, rather than the only interface.

Drupal has been moving in this direction for a long time. The same structured content managed in Drupal can already be used across websites, applications, search experiences, feeds and APIs. Drupal is now leading the way in how AI agents can interact with websites to complete transactions.

A new definition of publishing

For a marketing team, publishing has traditionally meant putting something in front of an audience: a campaign, a landing page, or a new product

With the rise of the agentic web, publishing is developing another dimension, one that needs AI systems to understand what you offer, who it's for, whether and where it's available, what it costs, and what actions can be taken, and by whom.

That makes structured content much more than a CMS implementation requirement. It must become part of your brand architecture. The idea of ‘capabilities’ takes that idea one step further.

You don't need to start exposing every organisational process to AI agents right away. Start by asking different questions about your digital estate. Think beyond "do we have a page explaining this product or service?" and ask "what is the underlying action or outcome we want customers to complete, and could an authorised agent safely perform it?"

This is where Drupal AI gets really interesting!

Drupal already knows more than what appears on the page

Drupal has always been good at structured content. A product doesn't have to be defined simply through a large page of text called "product page."

For the personal shopper to do its job well, it needs more than a page to read. Drupal can understand that a product has a:

• Title
• Description
• Categories and tags
• Specification/attributes
• Variants of colour and size
• Different availabilities of those variants
• Price and promotion information
• Rules regarding delivery and returns

Those pieces of information can be connected to other things Drupal understands, such as related products or customer reviews.

The customer sees the finished page, but underneath that page is a structured content model that provides an AI agent with context, meaning and additional information not directly available to a human reader on the "product page."

Go back to the waterproof jacket. If an agent asks for products under £150, structured data gives it a much more dependable answer than inferring prices from paragraphs of product copy. Ask for size M, and Drupal knows which fields represent product type, features and size. Ask which jackets are available for next-day delivery, and Drupal can use live availability and delivery information rather than relying on an AI model to guess from a page's wording.

The same structured content that makes a product page useful to a human is what lets a personal shopper act on it. The Drupal AI roadmap builds on that relationship between Drupal's content model, context, governance, and trustworthy AI experiences.

But structured information is only half of the story. Drupal is now developing ways to describe actions just as clearly.

A quick guide to the alphabet soup

AI has already given us enough acronyms to fill a data center, but three are particularly relevant to the future of content management systems: API, MCP, and ARD.

API: letting systems talk to each other

An API, or Application Programming Interface, is a controlled way for one system to request information or perform an action.

In the context of agentic AI acting on a Drupal website, think of it like a service counter. Instead of navigating through the shop yourself, you make a specific request:

"Show me all products under £50 that are currently in stock."

The API defines what can be requested and how the answer comes back.

APIs aren't new. They already connect websites to apps, CRMs, commerce systems, search platforms, and countless other services.

MCP: helping AI use available tools

MCP, or Model Context Protocol, is an open standard that lets AI models safely connect to external tools, data and services.

Put simply, while an API can expose a capability, MCP gives an AI agent a consistent way to use it.

Drupal's MCP Server project builds on Tool API, making Drupal tools available to compatible AI systems. It also supports authentication, allowing individual tools to require appropriate authorisation rather than simply opening everything to an external agent.

ARD: helping an agent discover where capabilities exist

There is another problem: an AI agent can only use a capability if it knows it exists.

Agentic Resource Discovery, or ARD, is an emerging idea exploring how agents might discover services that can fulfil a particular need.

Instead of already knowing which website to visit, an agent could potentially ask a broader question:

"Who can help me find a product matching these requirements?"

Discovery and execution are different problems. One helps an agent find the right door, whereas the other helps it interact with what is behind the door.

The standards are still evolving, and nobody needs to redesign their digital strategy around a particular acronym today. The important thing is the direction of travel.

From structured content to structured capabilities

One important building block in Drupal's emerging agentic AI architecture is Tool API. It gives Drupal a consistent, reusable way to describe not only the information it holds but also the things it can do, with clearly defined inputs and outputs that Drupal AI Agents, MCP, and other automation systems can all use.

A tool might effectively say I can search products and describe what information it needs (e.g., product type, size, colour, price range and delivery requirements) and what it will return (e.g., a list of matching products).

Another might say I can check stock availability for a particular product and size, or I can add a selected product to the customer’s basket.

AI agents can reuse tools and expose them to other AI systems through technologies such as MCP. Tool API is currently available as a beta project, so this is active, evolving work rather than a finished endpoint for the vision.

The big idea is that Drupal can increasingly describe not just what it knows, but what it can do.

That is a fundamentally new Drupal capability being built on top of Drupal's existing publishing capabilities.

Drupal's Inside AI and Outside AI meet here

This is also where the Drupal AI Initiative's distinction between Inside AI and Outside AI becomes useful.

Inside AI focuses on AI working within Drupal to help you create, manage, and optimise your website. Outside AI focuses on external agents acting on Drupal.

Outside AI enables an external agent to connect to Drupal, inspect it, change it, verify it, migrate into it, or launch it. That makes the publishing-capabilities idea more than a thought experiment.

Drupal's Outside AI work is actively exploring the infrastructure needed to make Drupal a reliable and governable action surface for external AI agents: who the agent is and where it came from, reliable execution in the background, guardrails, limits on what each tool can touch, visibility into what happened, and predictable contracts between agents and Drupal.

In other words, the question isn't simply "can an AI agent make Drupal do something?" but "can we let an AI agent do something useful while Drupal still controls what is permitted, records what happened and protects everything the agent should not be able to touch?"

Publishing a capability doesn't mean handing over the keys

Imagine an AI agent interacting with a retailer. An anonymous agent might be allowed to search the product catalogue, add a selected product to that shopper’s basket, or check the status of their order.

None of those agents should suddenly gain permission to view another customer’s orders, change product prices or publish a new promotion.

Drupal has spent decades developing data access and functional controls, based on roles, permissions and workflows for human users. Those same principles become increasingly valuable when the user is an AI agent, and it’s one of the reasons Drupal AI's work on guardrails matters.

Guardrails were introduced into Drupal AI and expanded in the 1.4 release so safety and policy checks can be applied more broadly to incoming and outgoing AI interactions, including support for streaming responses. The Context Control Center (CCC) is another piece of this work, helping Drupal AI draw on the right content, rules and standards to deliver more accurate results.

In simple terms, Drupal can put rules between AI and the organisation.

As agents become more capable, that may be just as important as the capability itself.

So…what is actually new?

APIs aren't new. Drupal permissions aren't new and structured content certainly isn't new.

What’s new is how those established strengths are being assembled for an agentic web.

• Tool API gives Drupal a more consistent way to describe reusable actions. 
• MCP Server provides an emerging route for external AI systems to access approved Drupal tools.
• Outside AI is explicitly working on the identity, permissions, reliability, tool controls and governance needed for external agents to act on Drupal safely.
• Drupal AI Guardrails provide mechanisms for applying policy and safety controls around AI interactions.
• Context Control Center (CCC) gives Drupal AI the right context to deliver more accurate results.

A CMS that knows things, does things and governs both

For digital leaders, perhaps the simplest way to understand the direction is in four layers.

1. Drupal knows things: it manages structured content, relationships and context.
2. Drupal can do things: APIs and tools expose defined actions.
3. Drupal decides what is allowed: permissions, authentication, workflow and AI guardrails establish boundaries.
4. Drupal can work with agents: Outside AI, Tool API and MCP are developing the mechanisms through which approved AI systems can interact with those capabilities.

This is a very different picture of a CMS from the system many people still imagine when they hear the term. It is not simply the place where somebody logs in to edit the homepage. It becomes a critical control layer between an organisation's information, services and the growing number of digital interfaces through which people interact with them.

From publishing information to enabling outcomes

The first generation of content management systems helped organisations put information on the web. The next generation helped them structure it, personalise it, distribute it across channels and connect it to increasingly sophisticated digital experiences.

AI agents now offer a shortcut to the ultimate outcomes, which may mean they use the website on the customer's behalf. That doesn't make the CMS less important… it makes the CMS much more important because you now need a way to tell the AI agents what your organisation knows, what it can do, who is allowed to do it, and what happens when they do.

Yesterday's CMS published pages. Tomorrow's CMS publishes capabilities.

Drupal is designed to govern both.

Author: Martin Anderson-Clutz. Originally posted on The Acquia Blog.

Two GovCon keynotes came at disruption from opposite ends. Read them together and you get a map of the moment Drupal is in.

Earlier this month, I spent some time at Drupal GovCon, and a striking element was how well the two keynotes fit together. They were pitched under the same banner — "Building Through Disruption" — but they came at it from opposite ends. Mike Madison talked about how disruption can be something you do, on purpose, to make your team better. Kerry Greer reminded us that disruption is also something that happens to people, and that holding a team together through it is real work that rarely shows up on a ticket. Put those two talks side by side and you get something close to a complete picture: the courage to lead change, and the care to make sure nobody gets left behind while you do it.

I want to walk through both, because I think the Drupal community needs both right now.

Mike Madison: disruption is a verb

Mike (a former Acquian, now Senior Director of Global Web at Zscaler) has spent much of his career being paid, in his words, to "professionally disrupt organizations." His whole framing was a permission slip. When we talk about disruption in business we tend to reach for the giants: Netflix, Airbnb, Uber. And that framing is paralyzing, because none of us is going to reinvent a multibillion-dollar industry over lunch. So Mike flipped it. Think small. Disruption, boiled down, is just "replacing an old way of doing something," and every person in the room already has the standing to do that on their own team.

Every person in this room has the ability to go and disrupt your team or your organization in a meaningful way — and you can do that without pissing everybody on your team off, if you do it right.

His recipe was almost aggressively simple. Four steps: have an idea, figure out how you will change it, convince somebody it is a good idea, and then (the hard part) actually go do the thing. He was honest that the last step is where most of us fail. Ideas are cheap; we all have the brilliant one at breakfast that is gone by bedtime. Doing the work is what separates change from complaint.

A few of his points stuck with me. One was where to find your ideas: "channel your inner hate." The stuff that drives you nuts at work, the things that keep you up at night: that is the gold mine, because you already care enough to push. Another was a caution from science-fiction writer Isaac Asimov: it is easy to predict the car, but hard to predict the traffic jam. Even a great change has unintended consequences, and that is fine, as long as you are watching for the traffic jams.

The part most relevant to us as a technology community was his argument against standing still. He put up the most popular programming languages from 2005, when he started, with PHP sitting proudly near the top — and then watched it slide down the list decade by decade, ceding ground the whole time. His point was not that PHP is doomed; it was that the teams with the most experience are too often the ones least willing to change, and that "what goes too long unchanged destroys itself," as Ursula K. Le Guin put it. The antidote is deliberate: budget time for continuous improvement, kaizen, the way you would budget for meetings or security work. Do not wait for permission to get better.

And crucially, he was clear that driving change is a social act, not a heroic one. The story he told to prove it was about being an intern at a national lab, convinced they were using the wrong tool for the job, and knowing that the intern standing alone in front of a room of senior engineers was going to lose. So he spent a year finding allies — people with the tenure and technical credibility he did not have yet — and when the real decision came, it was not him making the pitch. It was a room full of respected voices backing the idea. That lab runs on Drupal today. His takeaway: right idea, wrong timing or wrong messenger, and nothing happens. Change is something you build with other people or not at all.

Kerry Greer: the invisible work

Kerry has been in the Drupal community for around two decades — a lineage that runs back to the early federal adopters — and she is now an account director at Forum One. Where Mike talked about disruption you choose, Kerry talked about the disruption that arrived uninvited. Over the past couple of years, the ground shifted for a lot of people who build for government: a new administration, workforce reductions, changing contracts and priorities, and AI landing on top of all of it at once. For many of her colleagues and friends, that was not theoretical. People lost jobs. Teams reshaped overnight.

Her question was different from Mike's. Not "how do I change things?" but "how do I keep creating when everything around me keeps changing?" And her answer was that the thing that carries a team through disruption is not another tool, methodology, or roadmap. It is what she called the invisible work, or the human architecture — the layer that never gets a Jira ticket.

When disruption hits, you don't have time to build the relationship. You only have time to trust what's already built.

She named five load-bearing principles, and they resonated because she illustrated them with two real projects from the past year, one that went well and one that very much did not. The difference between them, she argued, was not talent. Both teams were made of capable people doing their best in an uncertain moment. The difference was the human architecture that had — or had not — been built before the pressure hit.

Build trust before you need it, because when disruption lands you do not have time to build the relationship; you only get to spend the trust you already have. Create clarity when you cannot create certainty — when a meeting stops making sense, be the person who says so out loud, whether or not that is your job. Do not let the org chart define the team; on her successful project, the person bringing the most clarity was the most junior UX designer on it. Share what you know instead of gatekeeping, because a community that hoards knowledge does not survive disruption. And remember what you are here for: purpose is the thing that does not move when people, roadmaps, and org charts do.

She grounded all of it in who the work is actually for — the single parent trying to renew a license at the DMV with sick kids in the back seat, the family that needs to know there is a bear in their Yellowstone campground. Government does not get to stop building. When someone asked her about AI displacing the human connection, her answer was steady: AI is another tool, like Google or Word or Excel before it, and it will change some jobs — but humans have to stay in the loop, "especially in government," because the public still needs accurate information from something they can trust.

Why this is the conversation the Drupal community needs

Together these two talks are more useful than either alone. Mike hands us the agency to lead change; Kerry reminds us that leading change without tending to people is how projects quietly fall apart. And this is exactly the moment the Drupal community is in. Every team I talk to is being asked to meet familiar challenges — and some new ones — with fewer resources and, in some cases, unfamiliar tools. That is Kerry's disruption and Mike's opportunity at the same time.

Here is the optimistic part, and I do not think it is wishful. On the technical level, Drupal is unusually ready for this moment. Many of the decisions this community made years ago — treating structured content, configuration, permissions, and workflow as first-class, exportable things rather than logic buried in code — turn out to be exactly what makes a system legible to AI agents. We have been doing the unglamorous governance work for a decade, and it is about to pay off.

We are also finding new ways to embrace change as a project, not just as individuals — which is really Mike's "do the thing" and Kerry's structured collaboration operating at community scale. The Drupal AI Initiative is the clearest example. Rather than letting work this important languish or fall victim to bikeshedding, it is structured as a funded initiative with dedicated contributors, and it keeps adapting its own shape to match what the market actually needs. That recently meant splitting into two complementary tracks. Inside AI is building what partners literally ranked as their priorities — AI search first, then content review, translation, and chat-driven editing — all working together on one real, multilingual site rather than a scatter of demos. Outside AI is tackling agent experience: making Drupal "legible, callable, safe, and verifiable" for the agents that will increasingly build on our behalf, so that our decades-old advantage in governance-as-data is something agents can actually reach and trust. Both are aiming to prove the path — not just claim it — at DrupalCon Rotterdam, including at the AI Dev Summit and Enterprise AI Summit.

Notice how neatly that maps to what Mike and Kerry each described. The initiative is a room full of people choosing to disrupt an old way of doing things and then doing the hard, unglamorous work of shipping it. And it is doing so through exactly the human architecture Kerry championed: shared knowledge instead of gatekeeping, clarity of purpose, and a structure that lets contributors lead regardless of where they sit on any org chart.

So here is where their insights brought me, and it is the note I want to end on. Disruption is not something happening to the Drupal community. It is something we are equipped to lead — technically, because of choices we made years ago, and culturally, because we know how to build with each other. Mike is right that we are all more capable of driving meaningful change than we think we are. Kerry is right that the most important thing we build is not software; it is the trust and the people that make the software possible. Hold both, and this is a moment to be excited about. We get to help write what comes next, and we get to make sure that as it changes, nobody gets left behind.

The Drupal Business Survey investigates the trends in the digital market, in particular from service providers involved with the open source Drupal CMS and enterprise platform. Digital agencies from all over the world participate in the yearly survey and the business insights on market share and growth opportunities gained are shared with those who’ve submitted responses. 

Begun many years ago by Drupal Business Network with Janne Kalliola, Michel Van Velde, and Imre Gmelig Meijling, the survey is now administered by the Drupal Association to promote global reach and protect the confidentiality of the information. Moving forward, the Drupal Association will handle the analysis and reporting of the anonymised data from the survey. We're grateful to Janne, Michel, and Imre for their many years of work in shaping and running the survey.

Drupal’s open source ecosystem is supported by a strong community of tens of thousands professionals worldwide, working together on the popular digital experience platform. Because Drupal is open source, anyone can work with Drupal or make changes to it. An important part of this community are the agencies that provide Drupal services to end users and drive Drupal’s market. The Drupal Business Survey seeks the input from these agencies so that meaningful data for business owners and decision makers can be built into their business strategies. 

The Drupal Business Survey has been a valuable guide for digital service providers, even to those working with other technologies than Drupal.

Take the survey here!

About the Business Survey

The Drupal Business Survey supports Drupal businesses worldwide and is organised by the Drupal Association. The survey was founded by Imre Gmelig Meijling (React Online), Janne Kalliola (Exove) and Michel van Velde (Craftmore), and we're grateful for their years of work in building it into what it is today.

Drupal is the open source Digital Experience Platform used by many organisations worldwide including Nestlé, Lufthansa and World Wildlife Fund (WWF).

Participate and share your insights

Drupal experts are invited to share their Drupal business insights through the Business Survey anonymously and come to DrupalCon Europe to review the results together.

You can take the Drupal Business Survey 2026 anonymously here. The survey closes on 7 September.

This post is adapted from the DA Insider, the Drupal Association's monthly newsletter. Subscribe here to get it in your inbox each month.

Straight from Ryan's desk

To the Drupal community,

As northern hemisphere summer winds down, DrupalCon Rotterdam is rapidly approaching — and if you haven't booked yet, today is your last chance at Regular pricing. Late Rate kicks in at midnight CEST, so this is my friendly nudge to save yourself €270 and register now.

Rotterdam isn't the only Con on the horizon. DrupalCon Orlando Early Bird registration opens 14 September, and paid Early Bird tickets come with a limited-edition DrupalCon elePHPant — once they're gone, they're gone.

Elsewhere in this edition: the 2026 Drupal Business Survey is open until 7 September (your answers shape where we focus next), the engineering teamhas completed the migration of Drupal's security issue tracking to GitLab, and we're delighted to welcome Janna Malikova to the Drupal Association Board.

As always, thanks for being part of it. See you in Rotterdam!

Ryan Witcombe, Director, Product Marketing

The 2026 Drupal Business Survey Is Open

Your input shapes an anonymized report that helps the whole community. You'll see how your pipelines, win rates, and revenues compare to global peer data, share what's actually working, and directly influence where the Drupal Association focuses next.

Take the survey by 7 September 2026 at 23:59 UTC. Responses are strictly confidential and fully anonymized. Everyone who completes the survey receives the full report by email.

DrupalCon Rotterdam is almost here

Join Drupal experts and community members to discover what’s next for Drupal and the open web, exchange ideas, and build connections across the ecosystem in Rotterdam from 28 September to 1 October.

The regular rate is now closed, but registration for DrupalCon Rotterdam 2026 is still open. Register here.

All You Need To Know About DrupalCon Orlando

Early Bird Registration Opens September 14

The Early Bird registration for DrupalCon Orlando 2027 opens Monday, 14 September 2026 at 8:00 am EST, with tickets available for $650. And Early Bird comes with a special perk. Paid Early Bird DrupalCon tickets include a limited-edition DrupalCon PHP elePHPant named Drupy (Elephpas hypertextus drupalensis primus in Latin), available exclusively during the Early Bird registration period. 

Free tickets do not include an elePHPant, but you'll have the option to purchase one during registration while supplies are available. 

Summits & Training

Kick off DrupalCon Orlando on Monday, 22 March 2027 with a full day of deeper learning and industry-specific discussions, all available as add-ons to your registration.

Summits (Add-on $350)

Choose from six summits tailored to your interests: AI · Government · Higher Education · Nonprofit · Healthcare · Community.

Two summits with special pricing: the Community Summit is free for all DrupalCon registrants, and the Nonprofit Summit is free for Nonprofit ticket holders.

Full-Day Training (Add-on $550)

One focused training on offer: AI Inside Drupal: From Smart Editorial Workflows to Canvas Agents That Build Pages, presented by DrupalEasy.

Community Party + The First-Ever DrupalCon Talent Show

Save the Tuesday night, 23 March 2027, for the DrupalCon Community Party, featuring something brand new for Orlando: the first-ever DrupalCon Talent Show! 

It's FREE, and opting in helps us plan for everyone who wants to join us Tuesday night.

More details are coming soon.

Call for Speakers Is Still Open

There's still time to help shape the DrupalCon Orlando 2027 program! We're accepting speaker submissions through 20 October 2026. 

Submit your DrupalCon Orlando session.

Where In The World Is Bytes?

Bytes the Gator is making his way around the Drupal community and you can join the fun for a chance to win a free registration to DrupalCon Orlando 2027. Can't attend a Drupal event or find Bytes? Another alligator works too, preferably not a live one! 

Meet Bytes and learn how to enter the mascot contest.

The Engineering Team Has Been Busy

This month the team completed the migration of Drupal's security issue tracking to git.drupalcode.org, making the volunteer Security Team faster and easier to grow.

The broader issue migration now covers 90,000+ issues across 7,200+ projects. Release packages were re-signed for 3,200+ projects through Rugged, our new package signing pipeline.

localize.drupal.org and jobs.drupal.org have moved to modern cloud infrastructure, and the Drupal 11 upgrade of the new Drupal.org platform is underway.

Next up: porting community events to new.drupal.org so we can retire groups.drupal.org.

The Drupal Association At-Large Board Election Winner Is Announced

We are excited to announce the winner of 2026 Community At-Large Board Elections. We would like to congratulate and welcome our newest board member, Janna Malikova, for winning the community-elected seat.

We are grateful to Alejandro Moreno for their service and dedication to Drupal and the community, and to all the candidates who applied this year. Read the full announcement here.

This roundup is adapted from the DA Insider, the Drupal Association's monthly newsletter. Want it in your inbox? Subscribe to email communications and browse previous editions.

The Drupal Association is excited to announce the winner of 2026 Community At-Large Board Elections.

We extend a sincere thank you to Alejandro Moreno for his service and dedication, not only to Drupal, but to the Drupal community. Your time spent on the board made such a difference to the future of the Drupal project, and we thank you all for participating with grace, thoughtfulness, and insightful contributions.

We would like to congratulate and welcome our newest board member, Janna Malikova, for winning the community-elected seat during our 2026 At-Large Board Elections.

We cannot wait to see all the amazing things Janna will accomplish while on the Drupal Association Board.

Detailed Voting Results

There were 8 candidates in this year’s At-Large board member election. 307 voters cast their ballots out of a pool of 1274 eligible voters. Eligible voters are active Drupal Association members, known as Ripple Makers, whose membership must have been active at least 24 hours before voting opened.

Under Approval Voting, each eligible voter can give a vote to one or more candidates. 

The final total of votes were as follows:

On behalf of all the staff and board of the Drupal Association, a heartfelt Drupal Thanks to all of you who stood for the elections this year. It truly is a big commitment to contribution, the Drupal Association, and the community, and we are so grateful for all of your voices. Thank you for your willingness to serve, and we hope you’ll consider participating again in 2027!