Here are my tips and tricks, highlighting those that can 2x productivity and lead you toward 10x productivity and beyond. I hope you'll scan or read this list, take something away, and keep up with our fast-moving times.

Below is a summary of the key tips that can help you reach 10x productivity

• Harnesses: Use a desktop harness with an integrated browser so you can see what the AI sees and thinks.
• Agent Skills: Capture any repeatable task or process in a skill, and have the agent refine it after each session.
• Plans: Default to plan mode so you can review what the agent will do before it changes code and eats tokens.
• CLI/Scripts: Have agents create and maintain custom CLI scripts, like a DDEV command that installs Drupal with the recipes you need.
• Worktrees: Combine Git worktrees with DDEV to run multiple agents on multiple tasks in the same project.
• Contribution: Use the Drupal.org CLI so an agent can create an issue, fork, and MR in minutes.
• Drush: Have agents write custom Drush commands that expose the data and operations they keep needing.
• Ask: Ask the AI to explain what it did and why, and use it as a learning tool before it does things for you.

What are your tricks and tips for using AI in Drupal development?

Here are my tips and tricks, highlighting those that can 2x productivity and lead you toward 10x productivity and beyond. I hope you'll scan or read this list, take something away, and keep up with our fast-moving times.

Below is a summary of the key tips that can help you reach 10x productivity

• Harnesses: Use a desktop harness with an integrated browser so you can see what the AI sees and thinks.
• Agent Skills: Capture any repeatable task or process in a skill, and have the agent refine it after each session.
• Plans: Default to plan mode so you can review what the agent will do before it changes code and eats tokens.
• CLI/Scripts: Have agents create and maintain custom CLI scripts, like a DDEV command that installs Drupal with the recipes you need.
• Worktrees: Combine Git worktrees with DDEV to run multiple agents on multiple tasks in the same project.
• Contribution: Use the Drupal.org CLI so an agent can create an issue, fork, and MR in minutes.
• Drush: Have agents write custom Drush commands that expose the data and operations they keep needing.
• Ask: Ask the AI to explain what it did and why, and use it as a learning tool before it does things for you.

What are your tricks and tips for using AI in Drupal development?

Drupal Association Interim CEO Tiffany Farriss on how AI is making vulnerabilities cheap to find, and what the Drupal community is doing to keep fixing them safely.

In this episode:
• Why AI-assisted analysis is “an everyone problem” for open source security
• What five months of Alpha-Omega funded SEIR work has meant for the Drupal Security Team and its volunteers
• How site owners, hosts, and organizations can help, starting with Drupal Steward coverage

Read the full transcript: https://www.drupal.org/association/blog/in-the-open-security-in-the-age-of-ai

In the Open with Tiffany Farriss is a weekly series from the Drupal Association, the non-profit that maintains Drupal.org, coordinates Drupal security, and supports the global Drupal community. New episodes every week. Subscribe to follow along.

Produced with thanks to Stephen Cross of Second Signal Media.

Drupal Association Interim CEO Tiffany Farriss on how AI is making vulnerabilities cheap to find, and what the Drupal community is doing to keep fixing them safely.

In this episode:
• Why AI-assisted analysis is “an everyone problem” for open source security
• What five months of Alpha-Omega funded SEIR work has meant for the Drupal Security Team and its volunteers
• How site owners, hosts, and organizations can help, starting with Drupal Steward coverage

Read the full transcript: https://www.drupal.org/association/blog/in-the-open-security-in-the-age-of-ai

In the Open with Tiffany Farriss is a weekly series from the Drupal Association, the non-profit that maintains Drupal.org, coordinates Drupal security, and supports the global Drupal community. New episodes every week. Subscribe to follow along.

Produced with thanks to Stephen Cross of Second Signal Media.

Hi everyone. While exploring the excellent new Canvas page builder, I realised the need for some components that provide layouts I can use in my landing pages. I build my themes from scratch, so using components from an existing theme didn't seem like a good fit.

Because I couldn't find any modules that provide the components I wanted, I made one 😄

The module includes the following components: Columns, Row, Grid, Container, Sized container, Expander, Tabs. Each one is explained on the module page. They utilise various props and slots of Canvas components, so they feel fully native to Drupal.

I've made them as nicely responsive as possible, so for example, a 4-column layout becomes 2 columns on smallish screens (e.g. iPads) and 1 column on small screens (phones).

I rarely use AI, and I really wanted these to be super simple and lightweight, so I coded them myself. They're almost entirely just twig (HTML) and CSS, and only 1 of the 7 layouts actually even ships any JavaScript (Tabs; and it's minimal).

It turns out that single-directory components (SDCs) like these can be used in more than just Canvas; they can be used directly in the theme without a page builder (e.g. by referencing them from the traditional twig templates), and the upcoming version 4 of the Gutenberg module will has first-class support for SDCs. For now they don't work with Layout Builder, but I'm not sure how much demand there is for it any more...

Oh and the each component is completely independent, so if you want to use just one, you can just copy it straight into your theme without even installing the module; that's the beauty of open source.

Let me know what you think, and if you have any requests 😊

Hi everyone. While exploring the excellent new Canvas page builder, I realised the need for some components that provide layouts I can use in my landing pages. I build my themes from scratch, so using components from an existing theme didn't seem like a good fit.

Because I couldn't find any modules that provide the components I wanted, I made one 😄

The module includes the following components: Columns, Row, Grid, Container, Sized container, Expander, Tabs. Each one is explained on the module page. They utilise various props and slots of Canvas components, so they feel fully native to Drupal.

I've made them as nicely responsive as possible, so for example, a 4-column layout becomes 2 columns on smallish screens (e.g. iPads) and 1 column on small screens (phones).

I rarely use AI, and I really wanted these to be super simple and lightweight, so I coded them myself. They're almost entirely just twig (HTML) and CSS, and only 1 of the 7 layouts actually even ships any JavaScript (Tabs; and it's minimal).

It turns out that single-directory components (SDCs) like these can be used in more than just Canvas; they can be used directly in the theme without a page builder (e.g. by referencing them from the traditional twig templates), and the upcoming version 4 of the Gutenberg module will has first-class support for SDCs. For now they don't work with Layout Builder, but I'm not sure how much demand there is for it any more...

Oh and the each component is completely independent, so if you want to use just one, you can just copy it straight into your theme without even installing the module; that's the beauty of open source.

Let me know what you think, and if you have any requests 😊

This blog post details the circumstances of the recent SA, explains how to review recent orders for fraudulent activity (including SQL queries to aid in searching), and reviews operational best practices for all Drupal Commerce users. Big thanks to the Drupal Security Team and Marcus Johansson for their assistance.

This blog post details the circumstances of the recent SA, explains how to review recent orders for fraudulent activity (including SQL queries to aid in searching), and reviews operational best practices for all Drupal Commerce users. Big thanks to the Drupal Security Team and Marcus Johansson for their assistance.

Yesterday's batch (SA-CONTRIB-2026-254 to 292) included a Highly critical Commerce Core issue that's already being exploited, eight advisories for the AI module and three projects marked unsupported.

Contrib advisories have more than doubled this year, and with AI speeding up both discovery and exploitation, the window between an advisory and a working exploit is basically gone.

https://preview.redd.it/lsqgggvu6dyh1.png?width=1500&format=png&auto=webp&s=aba7d9d7012c92ddf49f74d9bdae277b4d1c75c1

https://preview.redd.it/0hu0t8mv6dyh1.png?width=1500&format=png&auto=webp&s=6cd765f74cf72a35b25459439a15d2c46daedb21

I wrote up the numbers and how I'm changing my maintenance routine because of it: https://menetray.com/en/blog/every-wednesday-drupalgeddon-and-were-getting-used-it

Curious how others are handling this. Are you applying critical patches the same day?

Yesterday's batch (SA-CONTRIB-2026-254 to 292) included a Highly critical Commerce Core issue that's already being exploited, eight advisories for the AI module and three projects marked unsupported.

Contrib advisories have more than doubled this year, and with AI speeding up both discovery and exploitation, the window between an advisory and a working exploit is basically gone.

https://preview.redd.it/lsqgggvu6dyh1.png?width=1500&format=png&auto=webp&s=aba7d9d7012c92ddf49f74d9bdae277b4d1c75c1

https://preview.redd.it/0hu0t8mv6dyh1.png?width=1500&format=png&auto=webp&s=6cd765f74cf72a35b25459439a15d2c46daedb21

I wrote up the numbers and how I'm changing my maintenance routine because of it: https://menetray.com/en/blog/every-wednesday-drupalgeddon-and-were-getting-used-it

Curious how others are handling this. Are you applying critical patches the same day?