Planet Drupal

There’s an incredible amount of things happening in the world of Drupal and AI. It’s very exciting, but almost impossible to keep up with. I’d been planning for a while to seriously dive into agentic coding. I feel a little late to the party, but at the same time, I get the impression that many organizations haven’t got the faintest idea that this revolution is happening.

Until now, I’d mainly been experimenting with frontier models like ChatGPT and Claude through their AI chat interfaces. But I’ve finally found the time to take the plunge into agentic coding myself.

Get to know Drupal CMS, Canvas and Mercury for rapid prototyping Description At my day job, we recently had a client who wanted to bring us a project but had to persuade a large group of stakeholders. I was able to create a functioning version of the site they described in less than 2 hours. admin Fri, 16 Oct 2026 - 17:43

At my day job, we recently had a client who wanted to bring us a project but had to persuade a large group of stakeholders. I was able to create a functioning version of the site they described in less than 2 hours.

BigCommerce is a SaaS platform that has earned its reputation with B2B sellers. Its B2B Edition handles selling with quotes, its catalog supports far more product options than most SaaS platforms, and its open APIs make it friendlier to integrations than many of its competitors. If your business fits neatly inside its walls, it's a legitimate choice. Many distributors and manufacturers have found success on the platform.

The trouble starts when your requirements don't match the platform's assumptions. Its best B2B features sit behind the top-tier plan. Gross Merchandise Value (GMV) caps force automatic upgrades as you grow. A new fee introduced in June 2026 charges a percentage on orders processed through non-embedded gateways, including offline payments like purchase orders. And when your order workflows, product types, or integrations go beyond what the platform anticipated, you're forced to work around BigCommerce rather than with it.

Drupal Commerce is an open-source alternative built on Drupal. You own the code and the data, there are no license or transaction fees, and every part of the platform, from checkout to order workflows to the product data model, can be shaped to fit how your company already works.

Read more

Today we are talking about the UN, Open Source, and Drupal with guests Tim Lehnen & Henry Poole. We'll also cover Live Update as our module of the week.

For show notes visit: https://www.talkingDrupal.com/574

Read more

A tool that tracks every pull request, pipeline and local site can quickly become another source of noise. DevDeck's developer decided the answer lies in how loudly it speaks, not what it hides.

Join us THURSDAY, October 15 at 1pm ET / 10am PT, for our regularly scheduled call to chat about all things Drupal and nonprofits. (Convert to your local time zone.)

We don't have anything specific on the agenda this month, so we'll have plenty of time to discuss anything that's on our minds at the intersection of Drupal and nonprofits. Got something specific you want to talk about? Feel free to share ahead of time in our collaborative Google document at https://nten.org/drupal/notes!

All nonprofit Drupal devs and users, regardless of experience level, are always welcome on this call.

This free call is sponsored by NTEN.org and open to everyone.

Information on joining the meeting can be found in our collaborative Google document.

My website has a custom photo album module that I've maintained for about twenty years. It helps me manage more than ten thousand photos. In my DrupalCon Rotterdam keynote, I talked about making that module work with AI assistants. You can watch that part of the keynote. I didn't have time on stage to go into the details, so I'm doing that in this post.

To let assistants find and edit my photos, I used the contributed Tool module, which provides Tool API, to expose my module's operations as tools. These include finding photos and updating a photo's caption or alt text.

Most of these tools are public methods on Drupal services I already had, like the one that searches my photos. A few PHP attributes are usually enough for Tool API to expose an existing method, so AI assistants can call it over MCP, the Model Context Protocol.

To describe a tool to other software, Tool API needs to know what data it accepts and returns: what each value is called, what type it is and what it means.

My album module doesn't store photos as Drupal entities (I know, I know), so Drupal has no field definitions for them. Instead, it keeps them in its own database table and loads each photo into an instance of Image, a plain PHP class. I added PHP attributes to the getters for the properties I wanted to expose, like this one for the alt text:

Read more

Headers and hero sections often change between mobile and desktop layouts. Faster first paint depends on which styles a site sends first.

Drupal 11.4.10 addresses three core security vulnerabilities, including a critical remote code execution flaw. Site owners should prioritize the appropriate core update and check whether separate Gin or Entity List updates also apply.

Try the Drupal AI demo! The Drupal AI demo was unveiled at DrupalCon Rotterdam. It showcases how you can use AI in your Drupal site right now. Darren Oh Wed, 10/14/2026 - 14:59

Tags

• Drupal
• Drupal Forge

• Read more about Try the Drupal AI demo!
• Log in or register to post comments

Project: Drupal coreProject machine name: drupalDate: 2026-October-14Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross-site scriptingAffected versions: >= 10.3.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2CVE IDs: CVE-2026-108514Description: 

The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission.

Solution: 

Install the latest version:

Drupal 11

• If you use Drupal 11.4.x, update to Drupal 11.4.10.
• If you use Drupal 11.3.x, update to Drupal 11.3.19.
• Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

Read more

Project: Drupal coreProject machine name: drupalDate: 2026-October-14Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:UncommonVulnerability: Cross-site scriptingAffected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2CVE IDs: CVE-2026-108515Description: 

The Drupal core Link module provides a field type that can be used for internal and external URLs.

The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities.

Solution: 

Install the latest version:

Drupal 11

• If you use Drupal 11.4.x, update to Drupal 11.4.10.
• If you use Drupal 11.3.x, update to Drupal 11.3.19.
• Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

Read more

Project: Drupal coreProject machine name: drupalDate: 2026-October-14Security risk: Critical 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Remote code executionAffected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2CVE IDs: CVE-2026-108097Description: 

A remote code execution vulnerability exists within the Field UI module in Drupal core.

The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality.

The vulnerability can be mitigated by uninstalling the core Field UI module (field_ui), which will provide protection while sites are updated.

Drupal Steward protection:

This issue is being protected by Drupal Steward. Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered.

Solution: 

Install the latest version:

Drupal 11

Read more

A council-developed publishing platform has completed an international standards review. Two initially unmet requirements reveal what the assessment demanded.

Drupal 11.4.9 addresses a shifting navigation sidebar, updates CKEditor 5, and makes editor toolbar configuration more flexible through recipes. Here’s what the release means for content teams, developers, and site owners.

We read all 462 case studies on drupal.org and coded every migration that says how long it took. Median: 7.5 months from kickoff to launch. Small relaunches took weeks; multi-site platforms took a year or more.

Released Translation Template Extractor 3, a tool for the modern Drupal age

If you ever translated Drupal software, you used the Translation Template Extractor (potx) at least indirectly, even if you never heard of it. It reads the source code of Drupal core and contributed projects, and collects the translatable strings. Every string translated on localize.drupal.org was extracted by potx. Developers and translators also use it to extract strings of their own modules and themes, on a web UI or with Drush.

Gábor Hojtsy Wed, 10/14/2026 - 10:17

Extending Editoria11y with Custom Content Checks in Drupal Joel Steidl Tue, 10/13/2026 - 14:53 Drupal

An editor copies a link from an email, adds it to a page, and publishes. The link text looks right. The destination opens. Nothing about the normal authoring workflow suggests a problem.

But the saved URL may not be the destination the editor intended to publish. Microsoft Safe Links can wrap an address in a long, encoded URL that sends visitors through a security-checking redirect service.

On of our client’s websites, a custom Editoria11y check helps editors recognize these links and replace them with the original destination. It adds site-specific guidance to a tool already used for accessibility feedback.

A Content Problem Worth Flagging

Microsoft Safe Links is a legitimate security feature, not evidence that a link is spam or malicious. The problem here was context: a URL copied from an email was becoming a public website link.

A simplified example looks like this:

<https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fexample.com%2Fmeeting>

The intended destination is https://example.com/meeting. Publishing the wrapper makes that destination harder to inspect and introduces dependence on another redirect service. The addresses can also be difficult to read and maintain.

Those are good reasons for an editorial warning. They are not proof that every Safe Link violates WCAG or cannot be used with a screen reader.

The useful question was narrower: could the website identify this recurring content pattern and give editors a practical next step?

Read more

Drupal Meets Matrix 03 - Better Conversations with Advanced Comment Threads John Locke Tue, 10/13/2026 - 10:00

Commenting in Drupal hasn't noticeably changed in 15 years. That changes now.

Dev Corner

• Read more about Drupal Meets Matrix 03 - Better Conversations with Advanced Comment Threads
• Add new comment