Drupal's security team calls itself "an all-volunteer group." Thirty people for thousands of projects. Their own PSA now admits fixes will ship slower, giving attackers "more time armed with LLMs," while the community debated banning AI contributions.

Meanwhile security firm reportedly built working exploit from a published patch in 51 minutes.

I'm not saying Drupal is insecure. I'm saying nobody is on the hook for enterprise security.

Read more : https://tanay.co.in/blog/your-drupal-security-is-running-on-volunteer-hours

Drupal's security team calls itself "an all-volunteer group." Thirty people for thousands of projects. Their own PSA now admits fixes will ship slower, giving attackers "more time armed with LLMs," while the community debated banning AI contributions.

Meanwhile security firm reportedly built working exploit from a published patch in 51 minutes.

I'm not saying Drupal is insecure. I'm saying nobody is on the hook for enterprise security.

Read more : https://tanay.co.in/blog/your-drupal-security-is-running-on-volunteer-hours

I took a closer look at Drupal’s market share, the Drupal 7 to Drupal 8 transition, the developer ecosystem, and how its CMS and AI capabilities compare with WordPress and other platforms.

The numbers raise some important questions about the cost of breaking changes, developer experience, ecosystem maturity, and whether new initiatives are addressing the challenges users actually face.

This isn't just about Drupal vs. WordPress. It's about what happens when a platform's evolution starts moving away from the needs of its community.

I’ve put together a detailed, data-backed analysis here 👇

https://tanay.co.in/blog/drupal-is-not-light-years-ahead

Curious to hear from developers, agencies, and businesses that have worked with Drupal: Does its reputation still reflect the reality of using it today?

Github - https://github.com/saitanay/unDrupal

𝗨𝗻𝗗𝗿𝘂𝗽𝗮𝗹 is a set of AI agent skills that teach coding assistants how to audit, extract, and plan migrations from Drupal 7-11 to any other system.

Open source. MIT licensed.

𝗗𝗿𝘂𝗽𝗮𝗹 has a Migrate API to move content in. It has no equivalent for moving content out. You're on your own.

There are 18+ ways to just create a static page in Drupal. So AI harnesses struggle to figure out how to take out your content. Additionally, the agents have to deal with

→ Hundreds of database tables
→ Serialized PHP structures
→ Nested Paragraphs three or four levels deep
→ Layout Builder data stored as PHP objects
→ Rich-text fields full of Drupal-only tokens
→ Revisions, media, taxonomy, redirects, SEO metadata

𝗨𝗻𝗗𝗿𝘂𝗽𝗮𝗹 enables your Claude Code, Cursor, Pi Agent Windsurf, GitHub Copilot etc to handle all of it.

If you're planning a Drupal migration, decoupling project, or replatform, try it.
🔗 https://github.com/saitanay/unDrupal