Since 2016, the developer community has been conducting annual surveys on frameworks and programming languages. Many of you have probably participated in State of JS, State of HTML, or State of CSS. But what about those of us working with CMSs? There has been no equivalent survey for our community.

2026 has been a year of change for those of us who build and manage websites; I have a feeling that many of you are on the move, migrating websites from one CMS to another or building without it. AI is enabling rapid changes on all fronts. Broad market-share numbers tell us very little about your experiences building and managing websites with different tools; that is why I hope that we, as a community, can close this information gap with our own open-source State of CMS survey.

stateofcms.com

The anonymised results will be freely available on GitHub. I will also create and publish an interactive report, but I am especially excited to see what the community does with the data.

Here are my tips and tricks, highlighting those that can 2x productivity and lead you toward 10x productivity and beyond. I hope you'll scan or read this list, take something away, and keep up with our fast-moving times.

Below is a summary of the key tips that can help you reach 10x productivity

• Harnesses: Use a desktop harness with an integrated browser so you can see what the AI sees and thinks.
• Agent Skills: Capture any repeatable task or process in a skill, and have the agent refine it after each session.
• Plans: Default to plan mode so you can review what the agent will do before it changes code and eats tokens.
• CLI/Scripts: Have agents create and maintain custom CLI scripts, like a DDEV command that installs Drupal with the recipes you need.
• Worktrees: Combine Git worktrees with DDEV to run multiple agents on multiple tasks in the same project.
• Contribution: Use the Drupal.org CLI so an agent can create an issue, fork, and MR in minutes.
• Drush: Have agents write custom Drush commands that expose the data and operations they keep needing.
• Ask: Ask the AI to explain what it did and why, and use it as a learning tool before it does things for you.

What are your tricks and tips for using AI in Drupal development?

Drupal Association Interim CEO Tiffany Farriss on how AI is making vulnerabilities cheap to find, and what the Drupal community is doing to keep fixing them safely.

In this episode:
• Why AI-assisted analysis is “an everyone problem” for open source security
• What five months of Alpha-Omega funded SEIR work has meant for the Drupal Security Team and its volunteers
• How site owners, hosts, and organizations can help, starting with Drupal Steward coverage

Read the full transcript: https://www.drupal.org/association/blog/in-the-open-security-in-the-age-of-ai

In the Open with Tiffany Farriss is a weekly series from the Drupal Association, the non-profit that maintains Drupal.org, coordinates Drupal security, and supports the global Drupal community. New episodes every week. Subscribe to follow along.

Produced with thanks to Stephen Cross of Second Signal Media.

Hi everyone. While exploring the excellent new Canvas page builder, I realised the need for some components that provide layouts I can use in my landing pages. I build my themes from scratch, so using components from an existing theme didn't seem like a good fit.

Because I couldn't find any modules that provide the components I wanted, I made one 😄

The module includes the following components: Columns, Row, Grid, Container, Sized container, Expander, Tabs. Each one is explained on the module page. They utilise various props and slots of Canvas components, so they feel fully native to Drupal.

I've made them as nicely responsive as possible, so for example, a 4-column layout becomes 2 columns on smallish screens (e.g. iPads) and 1 column on small screens (phones).

I rarely use AI, and I really wanted these to be super simple and lightweight, so I coded them myself. They're almost entirely just twig (HTML) and CSS, and only 1 of the 7 layouts actually even ships any JavaScript (Tabs; and it's minimal).

It turns out that single-directory components (SDCs) like these can be used in more than just Canvas; they can be used directly in the theme without a page builder (e.g. by referencing them from the traditional twig templates), and the upcoming version 4 of the Gutenberg module will has first-class support for SDCs. For now they don't work with Layout Builder, but I'm not sure how much demand there is for it any more...

Oh and the each component is completely independent, so if you want to use just one, you can just copy it straight into your theme without even installing the module; that's the beauty of open source.

Let me know what you think, and if you have any requests 😊

This blog post details the circumstances of the recent SA, explains how to review recent orders for fraudulent activity (including SQL queries to aid in searching), and reviews operational best practices for all Drupal Commerce users. Big thanks to the Drupal Security Team and Marcus Johansson for their assistance.

Yesterday's batch (SA-CONTRIB-2026-254 to 292) included a Highly critical Commerce Core issue that's already being exploited, eight advisories for the AI module and three projects marked unsupported.

Contrib advisories have more than doubled this year, and with AI speeding up both discovery and exploitation, the window between an advisory and a working exploit is basically gone.

https://preview.redd.it/lsqgggvu6dyh1.png?width=1500&format=png&auto=webp&s=aba7d9d7012c92ddf49f74d9bdae277b4d1c75c1

https://preview.redd.it/0hu0t8mv6dyh1.png?width=1500&format=png&auto=webp&s=6cd765f74cf72a35b25459439a15d2c46daedb21

I wrote up the numbers and how I'm changing my maintenance routine because of it: https://menetray.com/en/blog/every-wednesday-drupalgeddon-and-were-getting-used-it

Curious how others are handling this. Are you applying critical patches the same day?

I had a long conversation with Dries Buytaert. The parts I think Drupal folks will find most useful:

• He separates "building pages" from "managing content". A five-page site, sure, vibe-code it. Ten editors and thousands of pages across a hundred sites is a different problem, and that one is growing.
• Search engines sent visitors back to the sites that made the content. AI answers don't. He calls it breaking the social contract of the web.
• Tool API and MCP: exposing Drupal's capabilities to agents while keeping permissions and workflows. He thinks agents will generate throwaway UIs for tasks that take 100 clicks today.
• Makers and takers in the AI era, and the $3M/year the Drupal Association spends just on servers.
• A story he hadn't told publicly: the document he had Acquia's early investors sign to protect Drupal.

Full video (71 min, chapters in the youtube video description): https://youtu.be/NiN5ufDJXuo

Drupal Association Interim CEO Tiffany Farriss on why Drupal’s commons is under pressure, how the Drupal Certified Partner program is evolving, and what it takes to keep free software running for the next 25 years.

In this episode:
• What the ecosystem and business surveys revealed
• Why the Drupal Certified Partner program is becoming the Drupal Certified program
• The $40 in donated services every Drupal site receives each year, and who shoulders that cost
• Making contribution visible, expected, and recognised

In the Open with Tiffany Farriss is a weekly series from the Drupal Association, the non-profit that maintains Drupal.org, coordinates Drupal security, and supports the global Drupal community. New episodes every week. Subscribe to follow along.

Produced with thanks to Stephen Cross of Second Signal Media.

Contribution using LLMs, the policy, and etiquette around it is a topic that has come up in some recent posts here as well as in other places such as in the Drupal community Slack and the issue queue. So it’s quite serendipitous that a session touching on this is coming up soon, on Wednesday, November 4, 2026 at 2:00pm Eastern Standard Time.

Figured it’s worth sharing here for those who might be interested.

Whether it’s your employer, your clients, or your favorite open source project, we all have AI policies to navigate now. Drupal has one too, and it was written with a lot of care for both contributors and the people who review their work.

In this session, Stephen Mustgrave joins us to introduce the policy on the use of AI when contributing to Drupal. Stephen has led the Needs Review Queue Initiative for several years, checking in on Drupal core issues as they reach “needs review.” That gives him a front-row view of what helps an issue move forward and what slows it down.

We’ll start with the why. Committers are responsible for the codebase, and they need to understand every change they commit. Every contribution to an issue should help clarify the problem and the proposed solution. AI-generated summaries can add cognitive load for reviewers and, even when the contributor understands the change perfectly well, they don’t show it. The result is that the work of understanding shifts onto someone else.

Then we’ll get practical:

What the policy asks of contributors
- The updated issue summary templates, including the new section for AI output
- Why reviewers ask for summaries written in your own words, and what makes a good one
- How to ask AI to explain a solution so you understand it well enough to describe it yourself

We’re coming at this from a place of enthusiasm. AI tools have made it possible for more people to contribute to Drupal, and that energy is a good thing. Let’s talk about how to channel it into contributions that move issues forward and keep everyone in the chain, from contributor to reviewer to committer, on the same page.

Bring your questions and your own policies too. If you maintain contributed projects, we’d love to hear how you’re handling AI-assisted contributions.

With Drupal 12 on the horizon and Drupal 10 reaching end of life in December, I'm facing two challenges. First, I need to upgrade my current site from Drupal 10 to Drupal 11. Second, I need to update my contributed modules to support Drupal 12, while still supporting Drupal 10.

To address these challenges, I’m experimenting with an AI agent skill and a corresponding DDEV command, drupal-core-switcher, that toggles my application between the previous, current, and next versions of Drupal core and compatible contributed modules.

Are you facing similar challenges? Is having a drupal-core-switcher skill and command helpful? If you are procrastinating on upgrading to Drupal 11, would you use AI to help you do it?