Drupal feeds

ImageX: One Module, Many Layers of Defense: How to Protect Your Drupal Site with Security Kit

Drupal Planet -

When you manage a website, one of your biggest priorities is keeping it safe. The challenge is that the web is full of tricks that attackers use every day. Cross-site scripting (XSS), clickjacking, and cross-site request forgery (CSRF) are just some examples of the creepy terms you wish you’d never have to hear. This may result in lost data, malicious links, stolen login sessions, the unfortunate list could go on.

 

Talking Drupal: Talking Drupal #529 - MCP, Automators, and Agents

Drupal Planet -

Today we are talking about MCPs, AI Automators, and AI Agents with guest Marcus Johansson. We'll also cover AI Ecosystem Recipe as our module of the week.

For show notes visit: https://www.talkingDrupal.com/529

Topics
  • Understanding Model Context Protocol (MCP)
  • AI Automators in Drupal
  • Creating Complex Workflows with Automators
  • Simple and Effective Automator Use Cases
  • AI Image Alt Text and Contextual Understanding
  • AI Tagging and Content Management
  • Introduction to AI Agents in Drupal
  • Challenges and Future of AI Agents
  • Real-World Applications and Future of AI in Drupal
  • Proliferation of Orchestration Tools
Resources Guests

Marcus Johansson - workflows-of-ai.com marcus_johansson

Hosts

Nic Laflin - nLighteneddevelopment.com nicxvan John Picozzi - epam.com johnpicozzi Martin Anderson-Clutz - mandclu.com mandclu

MOTW Correspondent

Martin Anderson-Clutz - mandclu.com mandclu

  • Brief description:
    • Have you ever wanted to explore the AI capabilities of Drupal, but didn't know where to start? There's a Drupal recipe for that.
  • Module name/project name:
  • Brief history
    • How old: created in Oct 2024 by Marcus Johansson (marcus_johansson of FreelyGive.io
  • Versions available: 1.0.0-alpha2, which requires Drupal 10.3 or newer
  • Maintainership
    • Actively maintained
    • Number of open issues: 2 open issues, both of which are bugs
  • Module features and usage
    • When you require and apply this recipe to your Drupal site, you'll be able to start working with a variety of LLMs and specialized AI-based services
    • You'll be able to ingest unstructured content and map it to structured fields automatically. Or generate a detailed SEO analysis of your nodes. There are multiple translation tools, crawlers to help work across entire sites, and more.
    • This recipe is likely something you would apply to a sandbox site, to understand the various ways to achieve something specific with AI and Drupal, and then apply whatever is best for your use case to your actual site build.
    • But it's a useful resource for a Drupalist wanting to start exploring some of the growing list of options for working with AI, or someone familiar with AI tools who wants to start using them with Drupal.

Dripyard Premium Drupal Themes: What to look for when evaluating a Drupal theme

Drupal Planet -

Choosing a theme isn’t easy. There are a lot of choices including various free starter kits, non-standard page-builder themes, low cost commercial themes, and higher cost premium themes, such as what we sell.

Below we created a checklist you can use for any theme, regardless of vendor. We’ve included notes on how Dripyard addresses each topic so you can compare objectively.

FeaturesDoes the theme style the normal Drupal user interface items such as pagers, breadcrumbs, the node preview toolbar, etc?

Like most content management systems, Drupal will expose various patterns on the front-end including items like the node preview toolbar, exposed filters, as well as more standard components like pagers, breadcrumbs, etc.

Community Working Group posts: Who Will You Nominate? The 2026 Aaron Winborn Award Opens Today

Drupal Planet -

Every community has unsung heroes—people who show up, lend a hand, mentor newcomers, and make everyone around them better. In the Drupal community, we have a special way of recognizing these exceptional individuals: the Aaron Winborn Award

Nominations are now open for 2026. 

This isn't about code commits or issue credits as this award celebrates the human qualities that make our community truly special: service, integrity, kindness, and that rare willingness to go above and beyond.

Why This Award Matters

Aaron Winborn was more than a talented Drupal contributor - he was the embodiment of community spirit. Even with ALS, Aaron continued contributing, mentoring, and uplifting others until his passing in March 2015. Thanks to Hans Riemenschneider's suggestion and the Drupal Community Working Group's efforts, we've honored Aaron's legacy every year since, shining a spotlight on people who carry forward his spirit of generosity and commitment.

The winner receives more than recognition (though the applause at DrupalCon North America's plenary session is pretty special). They also receive a beautifully crafted physical award as well as free registration to DrupalCon North America.

Most importantly, they receive the knowledge that their work - often done quietly, without fanfare - has been seen and valued.

Who Should You Nominate?

Think about the person who:

  • Welcomed you when you were new to the community and (probably) a bit overwhelmed
  • Consistently makes local meetups happen, month after month
  • Patiently answers simple questions in Slack channels
  • Advocates for accessibility, inclusion, or community health
  • Organizes, teaches, translates, or documents without seeking credit

Their impact might be local or global, technical or social, recent or sustained over years. If they've made the Drupal community better through their character and contributions, we want to hear about them.

The Timeline

Submit your nominations by Friday, January 9, 2026. A selection committee made up of Community Working Group members and past winners will review all nominations and choose this year's honoree.

Note: Current CWG Conflict Resolution Team members and previous winners are not eligible for the award.

Past winners

Join these distinguished community members who've received the Aaron Winborn Award:

Submit Your Nomination Today

Nominations close on Friday, January 9, 2026.

Your nomination could shine a light on someone who's been making a difference all along. Don't let this opportunity pass - recognize someone extraordinary.

Calling All Creators!

Are you a designer, artist, or craftsperson who'd love to help create a future Aaron Winborn Award? The physical awards themselves are works of art, and we're always looking for talented creators to collaborate with. Reach out to the Drupal Community Working Group - we'd love to hear from you.

Questions? Contact the Drupal Community Working Group.  

The Drop Times: Lighting the Ledger for PHP

Drupal Planet -

Composer 2.9 delivered new CLI security improvements this week, but the bigger story for the PHP ecosystem is the work now underway on Packagist.org. With support from the Sovereign Tech Agency, the PHP Foundation, and Private Packagist, the team is building a transparency log aimed at strengthening PHP’s supply chain. Given the scale of Packagist today, introducing systematic visibility into package activity has become a practical necessity.

The transparency log will surface security-relevant events through a web interface and an API. That includes changes to package ownership, source URLs, maintainers, version releases or removals, and updates to underlying git tags, along with account security actions such as two-factor authentication status changes and password resets. Making these events publicly accessible gives researchers, companies, and tool builders the data they need to monitor dependency changes, spot suspicious patterns, and investigate incidents more effectively.

Implementation has begun, with features rolling out incrementally. This work aligns with the OpenSSF guidance for secure package repositories and moves the PHP ecosystem closer to stronger, audit-ready supply chain practices. Looking ahead, the team is also preparing a new model for organizational package ownership, set to address long-standing issues with shared accounts and improve security for both companies and open-source projects.

EVENTORGANIZATION NEWSTRAININGDRUPAL COMMUNITYTUTORIALS

We acknowledge that there are more stories to share. However, due to selection constraints, we must pause further exploration for now. To get timely updates, follow us on LinkedIn, Twitter, Bluesky, and Facebook. You can also join us on Drupal Slack at #thedroptimes.

Thank you. 

Sincerely, 
Alka Elizabeth, 
Sub-editor, 
The DropTimes.

Dries Buytaert: The product we should not have killed

Drupal Planet -

Ten years ago, Acquia shut down Drupal Gardens, a decision that I still regret.

We had launched Drupal Gardens in 2009 as a SaaS platform that let anyone build Drupal websites without touching code. Long-time readers may remember my various blog posts about it.

It was pretty successful. Within a year, 20,000 sites were running on Drupal Gardens. By the time we shut it down, more than 100,000 sites used the platform.

Looking back, shutting down Drupal Gardens feels like one of the biggest business mistakes we made.

At the time, we were a young company with limited resources, and we faced a classic startup dilemma. Drupal Gardens was a true SaaS platform. Sites launched in minutes, and customers never had to think about updates or infrastructure. Enterprise customers loved that simplicity, but they also needed capabilities we hadn't built yet: custom integrations, fleet management, advanced governance, and more.

For a while, we tried to serve both markets. We kept Drupal Gardens running for simple sites while evolving parts of it into what became Acquia Cloud Site Factory for enterprise customers. But with our limited resources, maintaining both paths wasn't sustainable. We had to choose: continue making Drupal easier for simple use cases, or focus on enterprise customers.

We chose enterprise. Seeing stronger traction with larger organizations, we shut down the original Drupal Gardens and doubled down on Site Factory. By traditional business metrics, we made the right decision. Acquia Cloud Site Factory remains a core part of Acquia's business today and is used by hundreds of customers that run large site fleets with advanced governance requirements, deep custom integrations, and close collaboration with development teams.

But that decision also moved us away from the original Drupal Gardens promise: serving the marketer or site owner who didn't want or need a developer team. Acquia Cloud Site Factory requires technical expertise, whereas Drupal Gardens did not.

For the next ten years, I watched many organizations struggle with the very challenge Drupal Gardens could have solved. Large organizations often want one platform that can support both simple and complex sites. Without a modern Drupal-based SaaS, many turned to WordPress or other SaaS tools for their smaller sites, and kept Drupal only for their most complex properties.

The problem is that a multi-CMS environment comes with a real cost. Teams must learn different systems, juggle different authoring experiences, manage siloed content, and maintain multiple technology stacks. It can slow them down and make digital operations harder than they need to be. Yet many organizations continue to accept this complexity simply because there has not been a better option.

Over the years, I spoke with many customers who ran a mix of Drupal and non-Drupal sites. They echoed these frustrations in conversation after conversation. Those discussions reminded me of what we had left behind with Drupal Gardens: many organizations want to standardize on a single CMS like Drupal, but the market hadn't offered a solution that made that possible.

So, why start a new Drupal SaaS after all these years? Because the customer need never went away, and we finally have the resources. We are no longer the young company forced to choose.

Jeff Bezos famously advised investing in what was true ten years ago, is true today, and will be true ten years from now. His framework applies to two realities here.

First, organizations will always need websites of different sizes and complexity. A twenty-page campaign site launching tomorrow has little in common with a flagship digital experience under continuous development. Second, running multiple, different technology stacks is rarely efficient. These truths have held for decades, and they're not going away.

This is why we've been building Acquia Source for the past eighteen months. We haven't officially launched it yet, although you may have seen us begin to talk about it more openly. For now, we're testing Acquia Source with select customers through a limited availability program.

Acquia Source is more powerful and more customizable than Drupal Gardens ever was. Drupal has changed significantly in the past ten years, and so has what we can deliver.

As with Drupal Gardens, we are building Acquia Source with open principles in mind. It is easy to export your site, including code, configuration, and content.

Just as important, we are building key parts of Acquia Source in the open. A good example is Drupal Canvas. Drupal Canvas is open source, and we are developing it transparently with the community. Acquia Source will be an opinionated SaaS product, yet it will remain rooted in the open Drupal ecosystem and will contribute back to it.

Acquia Source does not replace Acquia Cloud or Acquia Cloud Site Factory. It complements them. Many organizations will use a combination of these products, and some will use all three. Acquia Source helps teams launch sites fast, without updates or maintenance. Acquia Cloud and Site Factory support deeply integrated applications and large, governed site fleets. The common foundation is Drupal, which allows IT and marketing teams to share skills and code across different environments.

For me, Acquia Source is more than a new product. It finally delivers on a vision we've had for fifteen years: one platform that can support everything from simple sites to the most complex ones.

I am excited about what this means for our customers, and I am equally excited about what it could mean for Drupal. It can strengthen Drupal's position in the market, bring more sites back to Drupal, and create even more opportunities for Acquia to contribute to Drupal.

Drupal Association blog: DrupalCon Lands in Japan: Historic Momentum as Drupal Eyes Its Next Chapter

Drupal Planet -

Nara, Japan – Drupal founder Dries Buytaert declared a "historic moment" for the platform at DrupalCon Asia today, pointing to four major initiatives running simultaneously that he says will transform Drupal: Drupal CMS 2.0 (launching early 2026), Drupal Canvas, site templates and marketplace, and the Drupal AI program.

"For 20 years people have been saying Drupal is too hard to build pages with. We are changing that," Dries said during a keynote Q&A with Pamela Barrone, CTO of Technocrat and Product Owner of Drupal CMS.

Each initiative has the potential to transform Drupal individually, Dries argued. Together, "the compounding of these ideas will be transformational."


Dries Buytaert and Pamela Barrone on stage in Nara, Japan. 

Drupal Canvas: Solving the 20-Year Problem

Dries said he's heard consistently from organizations large and small: "We need an easier page builder."

Drupal Canvas, the much-hyped new page builder from Acquia and built with contributions from agencies and the broader community, does exactly that.

The State of New York, with 140 Drupal websites and over 300 content creators, is already evaluating how Drupal Canvas will enable them to build pages while maintaining accessibility standards and brand compliance.

The tool balances competing needs: locking down certain elements to maintain brand consistency and accessibility, while providing flexibility for experts who need creative control.

"It actually makes building pages fun," Barrone said during the session.

AI as Competitive Advantage

Dries made a pragmatic case for AI integration, acknowledging mixed feelings in the community while arguing Drupal can't afford to ignore it:

"We can't ignore how it's changing pretty much everything we do – it's changing how people use websites, how they build websites, and how we create content."

His argument centers on fit: Drupal's structured content, versioning capabilities, and workflow management – features that have made it more complex for beginners – are exactly what AI needs to be reliable and reversible.

"Drupal has been relatively hard to use – AI can help fix that. It can help us overcome our weaknesses and elevate our strengths," he said. "Our competitors don't have the same structural strengths, and that makes Drupal uniquely placed."

At DrupalCon Vienna, Dries demonstrated AI generating complete landing pages from single prompts – potentially reducing what might take 300 clicks to around 30.

The Drupal AI initiative now includes 25 partner organizations contributing staff time, with 1,300 people in the Slack channel.

Site Templates to Collapse the Learning Curve

Site templates build on Drupal's recipe system, bundling modules, configuration, Drupal Canvas themes, and demo content into ready-to-use websites.

"Even an expert can take days or weeks to build a Drupal site," Dries explained. "Site templates remove that learning curve."

A marketplace on Drupal.org will let users browse and install templates for specific use cases. An MVP is expected in 2026, with 10-15 partners committed to building initial templates.

The Marketing Gap

Drupal needs to market itself against proprietary platforms with enormous marketing budgets. How this is achieved is a challenge for the open source project.

Despite packed conference sessions, Dries identified a critical challenge: "Outside, the word hasn't got out there. How do we get the message out to the millions of web developers who have an outdated view of Drupal?"

He emphasized this responsibility extends to the whole community: "We need everyone to change the mindset of millions of people around the world."

January 2026 and Beyond

When asked about the decision to start the Drupal CMS project, he acknowledged initial uncertainty: "I was nervous making this announcement 18 months ago – it's not easy to create that momentum."

His three-to-five year vision focuses entirely on growth: "Everything I'm trying to help with is all about growth. Marketing, Canvas, AI – it's all about growing Drupal."

Success metrics include increased installs, more contributors, more people in leadership roles, and sustained innovation across strategic initiatives.

"More people are contributing to Drupal than ever, especially to strategic initiatives," he said. "If we can keep it up, great things will happen."


Caption: DrupalCon Asia in Nara, Japan. Flickr image by: Jakub Piasecki, CC BY-SA 4.0

DrupalCon Asia in Nara

The conference, the first DrupalCon in Japan, reflects Drupal's growing presence in Asia-Pacific. Tim Doyle, CEO of the Drupal Association, noted that the region accounts for 32% of Drupal.org traffic, one-third of project activity, and 24% of top contributors.

Mayor Gen Nakagawa welcomed attendees with a goal to make Nara "the most Drupal friendly city in the world." Half the attendees are from Japan.

DrupalCon Asia continues through November 20.

For the full DrupalCon Asia schedule and session details, visit the official DrupalCon website.

File attachments:  DSC_6106.jpg 54927246924_f65299f0b1_k.jpg

The Drop Times: Heading to DrupalCon Asia 2025? Don't Miss the Magic of Nara

Drupal Planet -

DrupalCon Asia 2025 lands in Nara this weekend, blending the spirit of open-source collaboration with Japan’s ancient capital. The organisers have set the tone for a unique community experience—starting with a citywide Treasure Hunt on November 16. From sacred deer at Nara Park to the Great Buddha at Todai-ji, attendees can explore a cultural landscape steeped in history. Whether through guided adventures or quiet temple visits, Nara promises an unforgettable DrupalCon experience.

Drupal AI Initiative: Drupal AI Summit, Paris | Creating AI systems that belong to everyone

Drupal Planet -

On 9 December 2025, leaders from across the globe will meet in Paris for the Drupal AI Summit, hosted within the Future of Software Technologies (FOST) conference, the world’s largest federated technology event.

The summit brings together engineers, architects, product leaders, and marketers who are putting AI to use in real systems. It explores what happens when AI meets the open-source values that built Drupal: transparency, community, and long-term thinking.

Within FOST, the Drupal AI track will host twelve focused sessions led by leaders in Drupal AI. These sessions will share lessons from real projects and outline the steps toward making Drupal the most AI-enabled open-source CMS. 

Attendees who are part of the Drupal community can access complimentary VIP tickets, each valued at €299, which include entry to 25+ co-located tech conferences at the same venue. The discussions will focus on architecture, governance, and collaboration, showing how to create AI tools that teams can trust and maintain responsibly.

View complete agenda and secure your ticket today!

Why this summit matters

AI is now part of how organizations work, publish, and communicate. The question is no longer whether to use it but how to use it well.

Through its open-source foundation, Drupal is helping teams improve publishing, accessibility, and content quality with AI. These are not experiments; they are production workflows that make everyday work faster and clearer.

Most AI systems are created quietly in the background, out of view in black boxes. Open source makes this work more transparent. It brings the process out for everyone to see and understand, so teams can see how the system behaves, adjust it with intent, and guide it with clarity.

Progress on Drupal AI has accelerated in the past year, with the Drupal community shaping it as a framework for practical features across content generation, moderation, governance, and automation. Each feature is designed with human oversight in the loop to keep controlled and responsible AI at the core.

The Paris summit brings these efforts into a wider conversation. It is a place for people who want to see AI and open systems work together, as partners in how modern software is built and maintained.

Building together

AI will continue to influence how digital experiences are created and maintained. The question is how we build it and who gets to decide.

The Drupal AI Summit is for those who believe progress should stay open and shared. It is a day for collaboration, curiosity, and honest discussion about what responsible and open AI can look like when built together.

Join us in Paris on 9 December 2025 at CNIT Forest, La Défense. Learn how Drupal and its community are shaping the next phase of AI, one that keeps people at the center of every creation.

View complete agenda and secure your ticket today!

Talking Drupal: TD Cafe #011 - Adam Boros & Martin Anderson-Clutz

Drupal Planet -

In this episode, Martin sits down with Adam Boros, a passionate developer who shares his journey in the Drupal community. Adam discusses the importance of automation for small teams and recounts his experiences with Drupal's evolution from version 6 to the recent resurgence of enjoyment with Drupal 10. He introduces his innovative personal calendar builder created for DrupalCon Vienna, explaining its simplicity and the enthusiastic community feedback it received.

For show notes visit: https://www.talkingDrupal.com/cafe011

Topics
  • The Fun of Drupal Over the Years
  • Reconnecting at DrupalCon Vienna
  • The Personal Calendar Builder Project
  • Technical Details and Challenges
  • Community Engagement and Feedback
  • Feature Requests and Future Plans
  • Reflections on DrupalCon Vienna
  • Evolution of Drupal and Its Community
  • AI and the Future of Drupal
  • Upcoming Events and Final Thoughts
Adam Boros

Adam was originally studying Architecture but never graduated. He started web development as a self-learner after working a few years in print design and DTP back in 2002. Using Flash5 and ActionScript at first, Adam discovered Drupal around 4.6 while looking for a CMS to replace PHPNuke for a local NGO. It was true love at first sight and after a few years of hobby projects and active involvement with the Drupal community in Budapest he ended up being a full-time drupalist at a university where Adam has worked since then for the past 15+ years as "Drupal Systems Architect".

Martin Anderson-Clutz

Martin is a highly respected figure in the Drupal community, known for his extensive contributions as a developer, speaker, and advocate for open-source innovation. Based in London, Ontario, Canada, Martin began his career as a graphic designer before transitioning into web development. His journey with Drupal started in late 2005 when he was seeking a robust multilingual CMS solution, leading him to embrace Drupal's capabilities.

Martin holds the distinction of being the world's first Triple Drupal Grand Master, certified across Drupal 7, 8, and 9 as a Developer, Front-End Specialist, and Back-End Specialist. (TheDropTimes) He also possesses certifications in various Acquia products and is UX certified by the Nielsen Norman Group.

Currently serving as a Senior Solutions Engineer at Acquia, Martin has been instrumental in advancing Drupal's ecosystem. He has developed and maintains several contributed modules, including Smart Date and Search Overrides, and has been actively involved in the Drupal Recipes initiative, particularly focusing on event management solutions. His current work on the Event Platform aims to streamline the creation and management of event-based websites within Drupal.

Beyond development, Martin is a prominent speaker and educator, having presented at numerous Drupal events such as DrupalCon Barcelona and EvolveDrupal. He is also a co-host of the "Talking Drupal" podcast, where he leads the "Module of the Week" segment, sharing insights on various Drupal modules. Martin's dedication to the Drupal community is evident through his continuous efforts to mentor, innovate, and promote best practices within the open-source landscape.

Resources

Calendar Builder https://aboros.github.io/drupalcon-vienna-2025-calendar-builder/ Calendar Builder repo https://github.com/aboros/drupalcon-vienna-2025-calendar-builder

Guests

Adam Boros - aboros

Martin Anderson-Clutz - mandclu.com mandclu

DrupalCon News & Updates: DrupalCon Vienna 2025: A Celebration of Open Source and Community Impact

Drupal Planet -

When the Drupal community gathers, something extraordinary happens. 

From 14 to 17 October 2025, nearly a thousand people came together at the Austria Center Vienna, Austria to celebrate open source, exchange ideas, and contribute to the future of Drupal.

DrupalCon Vienna 2025 was not only a conference, it was a living example of collaboration, diversity, and innovation in action.

Image   A Community in Numbers

This year’s event welcomed 935 registered participants, with an impressive 96.04% check-in rate.

Interest in DrupalCon Vienna built steadily through the year, with the highest number of registrations coming in June (307) and September (236),

A Truly Global Audience

DrupalCon Vienna brought together a remarkable mix of voices and perspectives.
Participants represented over 40 countries, with 85% coming from across Europe8% from the United States, and 7% from other regions.

The top ten countries represented were:

  • United Kingdom (112)
  • Germany (107)
  • United States (75)
  • Belgium (74)
  • Austria (71)
  • France (67)
  • Spain (34)
  • Netherlands (31)
  • Sweden (26)
  • Italy (24)

From Costa Rica to Kenya, from Armenia to New Zealand, attendees crossed borders, time zones, and languages to connect through one shared passion - Drupal.

Image   New Faces and Familiar Friends

One of the most inspiring aspects of the Drupal community is its balance between newcomers and long-time contributors.

In Vienna, 28% of participants attended their first DrupalCon, while 38% had taken part in four or more DrupalCons. This mix of fresh enthusiasm and deep experience keeps the community dynamic and forward-looking.

For the first time, this year’s DrupalCon introduced Drupal in a Day, organized by Hilmar Kári Hallbjörnsson. The training session welcomed 113 learners, aged 18 to 52, highlighting the wide range of people discovering Drupal for the first time.

Attendee Background

An impressive 38% of attendees were delegated by their company to attend DrupalCon Vienna.

Attendees were mainly represented by:

  • Technical users: 37%
  • Technical decision-makers: 27%
  • Owners or business decision-makers: 21%

In terms of expertise:

  • 36% described themselves as Drupal experts
  • 28% reported strong Drupal expertise

The majority of participants (53%) came from digital agencies, design, or development shops.

They represented a variety of industries, with the strongest presence from:

  • Services: 31%
  • Government: 16%
  • Education: 11%
Powered by People

Behind the scenes, the heart of DrupalCon beats thanks to its volunteers.

A huge thank-you goes to the committees, track teams, and on-site volunteers who made the event possible.

This year, 56 on-site volunteers contributed their time and expertise, supporting session reviews, contribution mentoring, information desks, and photography. Their dedication ensured that every attendee could learn, contribute, and feel part of something bigger.

Made Possible by Our Sponsors

None of this would have been possible without the generous support of our sponsors.

  • Diamond: 3
  • Platinum: 4
  • Gold: 8
  • Silver: 6
  • Module: 10
  • Media: 5

Their continued investment in Drupal helps us deliver high-quality, inclusive, and impactful events that keep the open-source spirit alive.

Looking Ahead

DrupalCon Vienna 2025 reminded us that open source is more than code. It is community, creativity, and collaboration in action.

Thank you to everyone who joined and contributed to making DrupalCon Vienna 2025 a success.

Security advisories: Drupal core - Moderately critical - Defacement - SA-CORE-2025-007

Drupal Planet -

Project: Drupal coreDate: 2025-November-12Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:AllVulnerability: DefacementAffected versions: >= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8CVE IDs: CVE-2025-13082Description: 

By generating and tricking a user into visiting a malicious URL, an attacker can perform site defacement.

The defacement is not stored and is only present when the URL has been crafted for that purpose. Only the defacement is present, so no other site content (such as branding) is rendered.

Solution: 

Install the latest version:

Drupal 11.0.x, Drupal 10.3.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)

Reported By: Fixed By: Coordinated By: 

Security advisories: Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006

Drupal Planet -

Project: Drupal coreDate: 2025-November-12Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: Gadget chainAffected versions: >= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8CVE IDs: CVE-2025-13081Description: 

Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.

It is not directly exploitable.

This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). There are no such known exploits in Drupal core.

Solution: 

Install the latest version:

Drupal 11.0.x, Drupal 10.3.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)

Reported By: Fixed By: Coordinated By: 

Security advisories: Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005

Drupal Planet -

Project: Drupal coreDate: 2025-November-12Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Denial of ServiceAffected versions: >= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8CVE IDs: CVE-2025-13080Description: 

Drupal Core has a rarely used feature, provided by an underlying library, which allows certain attributes of incoming HTTP requests to be overridden.

This functionality can be abused in a way that may cause Drupal to cache response data that it should not. This can lead to legitimate requests receiving inappropriate cached responses (cache poisoning).

This could be exploited in various ways:

  • Broken rendering of some pages
  • Unstyled or malformatted pages
  • Adverse impacts on client-side functionality

Changes are being made in the underlying library which will mitigate this problem, but in the meantime Drupal core has been hardened to protect against this vulnerability.

Solution: 

Install the latest version:

Drupal 11.0.x, Drupal 10.3.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)

Reported By: Fixed By: Coordinated By: 

Security advisories: Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008

Drupal Planet -

Project: Drupal coreDate: 2025-November-12Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Information disclosureAffected versions: >= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8CVE IDs: CVE-2025-13083Description: 

The core system module handles downloads of private and temporary files. Contrib modules can define additional kinds of files (schemes) that may also be handled by the system module.

In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access. For example, files may be cached by Varnish or a CDN.

This vulnerability is mitigated by the following:

  1. Drupal must be configured to handle non-public files using a custom or contributed module providing an additional file scheme.
  2. An attacker must know to request a file that has previously been
    requested by a more-privileged user, and that file must still be cached.
Solution: 

Install the latest version:

Drupal 11.0.x, Drupal 10.3.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)

Reported By: Fixed By: Coordinated By: 

Centarro: How to Plan Your Enterprise eCommerce Project

Drupal Planet -

Planning an enterprise eCommerce implementation is notoriously difficult. There’s no single best way to approach it. Every organization has a different mix of legacy systems, required features, customers, and staff, not to mention the internal politics that can shift requirements like the moon shifts the tides.

But there are some commonalities. Almost every enterprise site we undertake begins with a massive feature list and gap analysis, and organizations often try to understand the scale and complexity of their implementation by classifying features. 

They put them in buckets like:

  • Out of the box
  • Requires configuration
  • Requires custom code
  • Completely custom development

Each one is a different level of effort, and theoretically, these buckets will help with estimation and planning.

The problem? Terms used to describe features are often fuzzy and unclear.

Take “invoicing” as an example. Invoicing can mean 18 different things to 13 different people. It's not a single feature—it's a category of features. There might be an “invoicing” module in the platform you are evaluating, but does that actually satisfy the requirement? It depends on what "invoicing" actually means to your organization. 

Read more

Pages

Subscribe to www.hazelbecker.com aggregator - Drupal feeds