I’m not sure how this slipped under the radar but check this out.

The Drupal Association has been given a grant, and we know from the credits on symfony vulnerabilities that Mythos has scanned them.

This is huge and reassures us that once again, Drupal is, and will remain, the most secure open-source CMS out there.

https://thephp.foundation/blog/2026/05/18/announcing-ecosystem-security-team/

Edit - reworded para 2 based on rereading the context.

I picked up a new client today. A charity based in the UK.

The “webmaster” (her words) was a 79 year old lady who started Drupal when she was 70.

It was a delight to talk to her and hear her talk about composer, git, and the things we take for granted.

It’s honestly one of the most wholesome things I’ve encountered in my 20+ years of running a Drupal agency.

She wanted a D10 to D11 upgrade and explained about the composer hell she went through. I agreed to help her and estimated a couple of hours to assist. It’s a super simple site, and that’s honestly how long it will take.

Anyway, I wanted to share the story and I hope I’m still doing Drupal at the age of 79 with as much passion as my new client has for her project.

Is there an alternative to the "Webform" module for Drupal 11 that already has a stable release and is covered by the security advisory policy? These are both requirements that i can't deviate from.

Tiny patch, huge impact:

if (is_array($condition['value'])) {
$condition['value'] = array_values($condition['value']);
}

Drupal fixed PostgreSQL placeholder generation by reindexing array keys before query translation.

Without it, attacker-controlled keys could influence SQL placeholder construction.

Affects PostgreSQL-backed Drupal sites.
Anonymous exploitation possible.

Advisory:
[https://www.drupal.org/sa-core-2026-004\](https://www.drupal.org/sa-core-2026-004)

[https://cveplayground.com/blog/cve-2026-9082-drupal-core-sql-injection?utm\\\_source=reddit\](https://cveplayground.com/blog/cve-2026-9082-drupal-core-sql-injection?utm\_source=reddit)

Context: https://www.reddit.com/r/drupal/comments/1t884c3/hello_drupal_community_looking_for_help_with/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

Firstly thank you for such detailed suggestions and I am learning Drupal at a good pace, enjoying most of the time and process. I am learning mostly frontend right now and absorbing everything, learning some backend too but not heavily, would go on it later

I would really appreciate some help from your side as you all have been in the Drupal market since so long, I have a drupal interview in coming week, the person said its frontend heavy role, you will be working mostly on the frontend with HTML CSS JS.

While I understand how Drupal architecture works and how to make things and how does this css works here,
I am confused what can I be asked in the interviews, mainly what is asked in Drupal? would they ask me from html css? I come from a full stack web dev background so really no idea how it works in low code interviews, its a part time role. Just 1 round of interview to show my understanding and skills

Any help is good, I will really appreciate, thank you so much !!!

So, like Icarus, I flew too close to the sun, and fucked up. I was trying to upgrade a small site from Drupal 9.3 because something under the hood was stopping image files from uploading. Unfortunately, I didn't read the instructions on upgrading correctly. While going from 9.3 to 9.5 went fine, at the next step, it went all the way to 11.3, which has rendered the site unreachable, except for the update.php page.

The problems I'm facing are:

1. It wants the CKEditor module installed, but that's only compatible with Drupal 10
2. I've used Composer to add the MySQL57 module, and added the needed line to my settings.php, but I can't get in to the administrative interface to install the module there.
3. Something somewhere is reporting that the installed Drupal version is below 9.4
4. Attempts to access other site pages produce "Uncaught PHP Exception TypeError: "Drupal\Core\Utility\ThemeRegistry::getPreprocessInvokes(): Return value must be of type array, null returned"" at /core/lib/Drupal/Core/Utility/ThemeRegistry.php line 180

So, my question is:

• Is it possible to rollback to, say, Drupal 10, at this point, or should I just rebuild the site from scratch? (I have access to an ancient backup of the site.)

I should add that there's something weird going on with the installation of Drush I'm working with as it seems to only be interacting with one of the multiple sites we have with this hosting provider, and it's not the problem site.

I've been using Drush on Drupal 7 for a long time, but having started on Drupal 11 I've gotten more used to the Composer approach and see on Drupal.org that many Drupal 7 modules can be installed through composer.

Are there any gotchas installing Drupal 7 and installing/upgrading modules with composer?

Is Composer usage on Drupal 7 mature and comparable or even better than Drush?

Hello fellas,

we often encounter the case of content types with fields grouped in field groups that need to be rendered in a specific fashion (e.g. table, definition list), sometimes each group with its own markup.

The motivation is accessibility.

Our goal is to have a template suggestion for fields that look like:

[entity-type]__[view-mode]__[field-name]__[field-group-name]

so that a field can be formatted differently according to its host group.

At the moment no one in the team has been able to solve the conundrum.

Any suggestion (pun intended) is highly appreciated.

Six situations this week working with AI agents on Drupal. Some saved me hours. Others tried to ship solutions that looked right but weren't.

One bug had been stuck at an agency for hours and got resolved in 30 minutes. Another fix, if I had accepted it as-is, would have left me with custom patches on contrib modules.

The AI conversation usually focuses on the speed and skips what you have to catch in review. Wrote it down with the six cases. If you work with Drupal or with code in general, curious what you think.

https://menetray.com/en/blog/six-real-world-ai-cases-drupal-week

I made a small starter kit for using Drupal without putting Drupal in production.

The idea is simple.

Run Drupal locally with DDEV. Use it as the CMS. Astro fetches the content at build time through JSON:API and Linkset. Then you deploy the static output.

No hosted Drupal.
No production database.
No PHP runtime on the public site.

Repo:
https://github.com/rovo79/Drupal_Astro_Kit

First run:
~~~
git clone https://github.com/rovo79/Drupal_Astro_Kit.git

cd Drupal_Astro_Kit

./setup.sh
~~~

This is not meant to replace every Drupal site. It is for the cases where the public site does not need to be dynamic, but the content editing model still benefits from Drupal.

It is early, but the basic path is there: clone, setup, edit content locally, build static files, deploy dist/.

If you try it and the first run breaks, I’d want to know where.