Drupal Is No Longer Just a CMS Decision. It’s an AI Infrastructure Decision.
Read moreAgents need somewhere to live. And once content becomes data, the CMS that holds it becomes strategic.Drupal Is No Longer Just a CMS Decision. It’s an AI Infrastructure Decision.
drupalSaturday, April 18, 2026 - 12:35Erdfisch Expands nerdfisch DevBits into Public Drupal Code Archive
Drupal Is All In on AI. Now Comes the Hard Part
I co-founded 1xINTERNET on the conviction that Drupal was the right platform for ambitious web applications. AI changed that certainty. Here is what the Drupal AI Initiative is building, what organizations are getting first, and why the direction is clear.
Differentiating Marketplace Site Templates and Community Site Templates
Site templates are available through two distinct pathways, each serving different needs within the community.
The official Drupal.org Marketplace provides a curated collection of site templates that meet certain quality standards, and are built on top of Drupal CMS as a foundation.
Community templates offer an alternative pathway for innovation and experimentation without the constraints of the curation process, by publishing the template as a general project on Drupal.org.
Official Marketplace Site TemplatesThe Drupal.org Marketplace are built on top of Drupal CMS, and curated to provide new users with confidence that they're starting with a consistent, solid and professionally built foundation that follows established best practices.
Key characteristics
-
Templates undergo a review processes
-
Must follow Drupal CMS best practices for security, accessibility (WCAG 2.2 AA), performance, and code quality
-
In the beginning, focus is solely on growing Drupal CMS adoption; site templates accelerate adoption of Drupal CMS by providing context relevant demo content and Drupal Canvas-compatible theme
-
Clear documentation, maintenance commitments, and user support expectations
-
Currently open to Drupal Certified Partners (for organizations) and Ripplemakers (for individuals or very small companies). Apply to become a creator here.
Benefits
-
Consistency for users who need reliable, production-ready starting points
-
Quality assurance through professional review processes
-
Support and maintenance commitments for long-term sustainability
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003
Drupal 11.3 comes with support for completing entity suggestions whilst adding a link to CKEditor 5.
The suggestions aren't sufficiently sanitized and a malicious user could trigger a stored cross site scripting attack against another user.
Solution:Install the latest version:
Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002
Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application deserializes untrusted data due to another vulnerability.
This issue is not directly exploitable.
This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). There are no such known exploits in Drupal core.
Install the latest version:
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which which can lead to a cross-site scripting (XSS) vulnerability.
Solution:Install the latest version:
- If you use Drupal 10.5.x, update to Drupal 10.5.9.
- If you use Drupal 10.6.x, update to Drupal 10.6.7.
- If you use Drupal 11.2.x, update to Drupal 11.2.11.
- If you use Drupal 11.3.x, update to Drupal 11.3.7.
Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)
DrupalCon Chicago 2026: Where Innovation Meets the Open Web
Written by members of the DrupalCon Chicago Steering Committee.
Contributors: Stephen Mustgrave, Avi Schwab, Nikki Flores, and Rosie Gladden.
DrupalCon Chicago 2026 brought together leading experts in digital experience development, open source innovation, and enterprise technology.
The event provided a unique opportunity to connect with decision-makers, technical leaders, and innovators shaping the future of digital experiences. More than 1,300 tech leaders, CEOs, developers, marketing executives, agencies, and enterprise decision-makers gathered to help define the future of the Open Web.
Image: Group photo in Chicago (Photo by Curt Rochon, CC BY-NC 4.0)
Participants from 26 separate countries brought with them an estimated 15+ languages, reflecting the rich linguistic and cultural diversity of the Drupal ecosystem. The United States (82.4%), Canada (6%), India (2%), Germany (1.2%) and Costa Rica (1.1%) were topping the list in terms of attendee numbers, with Brazil (1%), Colombia (0.8%) and the United Kingdom (0.8%) close behind.
This global span not only highlights Drupal’s widespread adoption, but also underscores the strength of a community shaped by varied perspectives, experiences, and ideas from around the world. Next year we’d love to add more blue!
Continue the Momentum: The Tool to Convince Your Boss for MidCamp 2026!
If, like us, you’re still riding the wave from DrupalCon Chicago, MidCamp 2026 feels like it’s right around the corner! MidCamp is the perfect place to dive further into what’s next for Drupal, connect with your peers, and contribute to the momentum we’re all feeling. But first, you might need to convince your boss to invest in your growth.
No worries—we’ve got your back! We’ve created a Convince Your Boss Tool to help you articulate the incredible value you’ll bring back from MidCamp. From hands-on workshops to industry-leading insights, it’s all about empowering your team with what’s next in tech.
Get ready to:
- Outline the ROI for your company
- Highlight the unique benefits of MidCamp
- Start the conversation with confidence
Let us help you make MidCamp 2026 your next big career move.
Measuring What Matters: Building More Sustainable DrupalConEur
As DrupalCon continues to evolve, so does our responsibility to understand and reduce the impact of the events we create.
Great digital experiences don’t exist in isolation. They are shaped not only by the technology we build and the communities we nurture, but also by the environmental footprint we leave behind.
At DrupalCon Vienna 2025, we took an important step forward by measuring the event’s carbon footprint in detail, with measurement conducted by TerraVerde Sustainability, and the results tell a meaningful story.
Image
Why measuring impact matters
Sustainability is not a one-time achievement. It is an ongoing process of learning, improving, and making better decisions over time.
The 2025 Event Carbon Measurement Report provides a comprehensive view of DrupalCon’s environmental impact, helping us move from assumptions to data-driven action.
The total carbon footprint of the event was 512.8 tCO₂e, down significantly from 1,574.57 tCO₂e in 2024.
This progress reflects not only better planning, but also more intentional decisions, particularly in location and venue selection, where more efficient energy use and improved waste management played a key role.
Image
Introducing Node Cleanup - Your solution to managing & deleting unpublished nodes in Drupal 10/11
Drupal CMS leadership changes
We're excited to announce updates to the Drupal CMS leadership team, with the addition of Bálint Kléri as our new Frontend Lead.
Bálint Kléri named Drupal CMS Frontend Lead
Bálint Kléri has been named Frontend Lead, a new leadership role created to oversee the frontend architecture for Drupal CMS, Mercury and Mercury-based themes. Bálint is a full-time contributor to Drupal Canvas, leading the development of Code Components for Acquia and a key contributor to Mercury, the Drupal CMS design system.
During development of Mercury, Bálint stepped in to guide the Tailwind CSS implementation and advocate for the use of best practices. We are grateful for his contributions already, and are excited to have him formally join the team. The addition of this frontend role is critical as we refine the Drupal CMS design system, providing users with a modern and adaptable foundation for Drupal sites and site templates.
Pamela Barone promoted to Product Lead
Pamela Barone is now Drupal CMS Product Lead, overseeing product direction, roadmap, prioritization, and delivery. Serving as Product Owner previously, this shift recognizes the product management responsibilities that Pamela has taken on during the evolution of Drupal CMS.
She will continue to work closely with me as I lead the Drupal CMS initiative. I’ll continue to set direction, align teams, and ensure we have the support and momentum to achieve our goals.
We appreciate the ongoing support from Technocrat support in giving Pamela the time to contribute to Drupal CMS.
Drupal CMS leadership changes
We're excited to announce updates to the Drupal CMS leadership team, with the addition of Bálint Kléri as our new Frontend Lead.
Bálint Kléri named Drupal CMS Frontend Lead
Bálint Kléri has been named Frontend Lead, a new leadership role created to oversee the frontend architecture for Drupal CMS, Mercury and Mercury-based themes. Bálint is a full-time contributor to Drupal Canvas, leading the development of Code Components for Acquia and a key contributor to Mercury, the Drupal CMS design system.
During development of Mercury, Bálint stepped in to guide the Tailwind CSS implementation and advocate for the use of best practices. We are grateful for his contributions already, and are excited to have him formally join the team. The addition of this frontend role is critical as we refine the Drupal CMS design system, providing users with a modern and adaptable foundation for Drupal sites and site templates.
Pamela Barone promoted to Product Lead
Pamela Barone is now Drupal CMS Product Lead, overseeing product direction, roadmap, prioritization, and delivery. Serving as Product Owner previously, this shift recognizes the product management responsibilities that Pamela has taken on during the evolution of Drupal CMS.
She will continue to work closely with me as I lead the Drupal CMS initiative. I’ll continue to set direction, align teams, and ensure we have the support and momentum to achieve our goals.
We appreciate the ongoing support from Technocrat support in giving Pamela the time to contribute to Drupal CMS.
April 2026 Drupal for Nonprofits Chat
Join us THURSDAY, April 16 at 1pm ET / 10am PT, for our regularly scheduled call to chat about all things Drupal and nonprofits. (Convert to your local time zone.)
We don't have anything specific on the agenda this month, so we'll have plenty of time to discuss anything that's on our minds at the intersection of Drupal and nonprofits. Got something specific you want to talk about? Feel free to share ahead of time in our collaborative Google document at https://nten.org/drupal/notes!
All nonprofit Drupal devs and users, regardless of experience level, are always welcome on this call.
This free call is sponsored by NTEN.org and open to everyone.
Information on joining the meeting can be found in our collaborative Google document.
Talking Drupal #548 - How to build your own CRM
In episode 548 we welcome back JD Leonard to discuss what CRMs are, what problems they solve, and which organizations benefit from them. JD explains why Drupal CRM defines CRM as "Contact Relationship Management," outlines core expectations like contact and relationship tracking and integrations, and describes Drupal CRM's Drupal-native architecture using dedicated, fieldable entity types for contacts, relationships, and contact methods. The panel compares Drupal CRM to older Drupal CRM efforts and user-based approaches, covers security considerations for PII and plans for field encryption, and highlights ecosystem projects such as CRM Email, CRM Membership (including Drupal Commerce integration), and event registration needs.
For show notes visit: https://www.talkingDrupal.com/548
Edges of Judgment
The conversation around AI is drifting into a familiar trap. We’re treating it as a question of alignment when it’s really a question of judgment. A recent reflection by Matthew Tift, written after DrupalCon, captures this tension well. Debates harden into sides, positions get defended, and nuance disappears. But the more useful observation is this: most of the people doing meaningful work with AI aren’t anchored to a fixed stance. They’re working through it, using principles they already trust.
That’s the part many organisations are skipping. Instead of grounding decisions in existing values, they’re reacting to the pace of change. This creates a false urgency to define a position quickly, often at the expense of clarity. In practice, that leads to inconsistent decisions. One team leans into AI for speed, another resists it for control, and neither is wrong. What’s missing is a shared framework that makes those decisions coherent over time.
At TDT, we see this as less of a technology shift and more of a decision-making test. AI doesn’t require new values as much as it exposes whether existing ones are actually being used. If your principles only show up in documentation but not in how choices are made under pressure, they’re not doing much work. The organisations that navigate this well won’t be the ones that pick a side early, but the ones that stay consistent in how they decide as the landscape keeps changing.
Is your website optimised for AIO / GEO?
Is your website ready for AI search? Learn how AIO and GEO help your content get cited in AI-generated answers, not just ranked in search results. Discover the S1x SIGNALS framework and request a free assessment.
Drupal (AI) Playground: Adding more structures to my playground
Building new modules using AI
I am setting up a playground to experiment with AI. My last post discussed developing and contributing a new Entity/Field Labels module to Drupal using AI. I look forward to seeing what I can create next. Before moving forward, I want to pause and explore how AI can assist me in managing and maintaining my existing contributed modules.
Maintaining my contributed modules using AI
Over the past decade, I’ve created and managed numerous contributed modules. I'm not sure how many there are, and it's been challenging to keep them all up to date. In the long run, I believe an AI agent with the right skills could help me manage my overwhelming list of modules. First, I need to clone my modules into my local development environment.
Cloning my contributed modules via Composer
It's unrealistic for me to manually clone each module's repository. Fortunately, Composer supports Git repositories. However, setting up and testing each module's Git repository using Composer can still be very time-consuming. Since AI excels at repetitive, predictable tasks, this is a perfect opportunity for me to let my AI assistant step in and make my life easier.
Using Agent skills to make things easier
Since cloning a Drupal repository for local development is quite straightforward, this presents a great opportunity to develop a custom agent skill. As with many AI-related tasks, it's best to seek help from the AI. Therefore, I prompted Claude to assist me in planning my drupalorg-project-clone skill.
Here is the front matter description of my new drupalorg-project-clone skill, which was generated by Claude Code and Codex.
Drupal 11: Creating A Tabbed Interface With HTMX
This is part three of a series of articles looking at HTMX in Drupal. Last time I looked at using HTMX to run a "load more" feature on a Drupal page. Before moving onto looking at forms I thought a final example of using HTMX and controllers to achieve an action.
One of the key examples that helped me understand HTMX was when it was used to create a tabbed interface, without reloading the page. This was quite simple to recreate in Drupal and can be done in a single controller.
In this article we will be creating a tabbed interface in Drupal, where HTMX is used to power loading the data in a tab like interface without reloading the page.
All of the code contained in this article can be found in the Drupal HTMX examples project on GitHub, but here we will go through what the code does and what actions it performs to generate content.
The first task is to create the route for our controller.
The RouteThe route we create here just points to an action in a controller.
drupal_htmx_examples_tabbed:
path: '/drupal-htmx-examples/tabbed'
defaults:
_title: 'HTMX Tabbed'
_controller: '\Drupal\drupal_htmx_examples\Controller\TabbedController::action'
requirements:
_permission: 'access content'When the user (assuming they have the access content permission) visits the path /drupal-htmx-examples/tabbed then they will trigger the action() method in the controller.
Let's build the controller that this route points to.
Pages
