webjoke.de

Date: 2025-September-17Description: Supply-chain attack via maintainer account takeover

NPM packages have been targeted in maintainer account takeover attacks. Attackers have deployed an automatic credential scanning tool. The scanning tool tries to find secret keys that may have been published to public systems like build automation and continuous integration (CI) systems and sends such credentials back to the attacker. From there, the vulnerable NPM packages are downloaded, modified to insert a trojan-like script bundle, and then republished. These maliciously modified packages can then be used to exploit any application that has installed these packages.

Coverage and advice on remediation:

• The Hacker News - 40 NPM Packages Compromised
• Socket.dev - Supply Chain Attack
• Aikido - S1ngularity/nx attackers strike again
• Aikido - npm debug and chalk packages compromised
• Wiz.io - Shai-Halud npm supply chain attack

While this attack has targeted NPM packages, the same strategy could be used to exploit other packages as well.

Managing supply-chain security

Website owners should actively manage their dependencies, potentially leveraging a Software Bill of Materials (SBOM) or scanner services. Other relevant tools include CSP and SRI.

It is the policy of the Drupal Security Team that site owners are responsible for monitoring and maintaining the security of third-party libraries and any non-Drupal components of the stack. In rare cases, the Drupal Security Team will post an informational public service announcement (PSA) such as this one, but the remit of the Drupal Security Team remains limited to code hosted on Drupal.org’s systems. Previous PSAs on third-party code in the Drupal ecosystem include:

• External libraries and plugins - PSA-2011-002
• Various Third-Party Vulnerabilities - PSA-2019-09-04
• Third-Party Libraries and Supply Chains - PSA-2024-06-26

Impact to the Drupal project itself

Drupal's infrastructure maintainers, the Drupal Security Team, and Drupal core maintainers have received tips about this situation from several sources. Individuals in those groups have evaluated their exposure and we believe the Drupal project itself is not affected by this issue. If you have information about concerns that Drupal is affected please reach out to us.

This post is likely to be be updated as the situation evolves and more information is available.

Reported By: 

• nicxvan

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Tim Hestenes Lehnen (hestenet)
• Dave Long (longwave) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team
• cilefen of the Drupal Security Team

Sometimes you want to add a Composer package that is not available through drupal.org or Asset Packagist. This article shows you how to add a package directly from its version control repository.

Read more

We've updated our Maestro Template Builder in our Maestro 4.2 release!  

Our new Template Builder is now based on diagram-js, the same Javascript library that powers BPMN.iO.  With this update Template Builder now supports:

• Panning the canvas
• Zooming in and out
• Task palette bar where you can drag and drop tasks on to your canvas
• Alignment guides automatically appear allowing you to properly align tasks horizontally and vertically
• Task shapes to show start and end as round and IF as a diamond
• Modal editing window enlarged.

You can watch a quick video on how it looks and works here.

 

Using Sass >= 1.80 and wanting to shush those @import deprecation notices with minimal effort?

There was a nice clear notice , with a decent explainer.

But you want a quick 1-2-3, so keep reading

At Tag1, we believe in proving AI within our own work before recommending it to clients. This post is part of our AI Applied series, where team members share real stories of how they're using Artificial Intelligence and the insights and lessons they learn along the way.

Jeremy Wed, 09/17/2025 - 07:00

The following is a guest post from Drupal Accessibility Working Group maintainer Mike Gifford.

The digital world is becoming increasingly regulated, and for good reason. New legislation like the European Accessibility Act (EAA) is setting a clear standard for digital inclusion, ensuring that everyone, regardless of ability, has equal access to digital products and services. For the Drupal community, this isn’t a challenge, but an opportunity to showcase what we do best — building an open, accessible web for all.

In Europe, the push for digital accessibility has been a long-term effort, beginning with the Web Accessibility Directive (WAD) in 2016. The WAD set the stage by requiring public sector websites and mobile apps to be accessible. Building on this foundation, the EAA extends these requirements to a much broader range of private sector products and services, including e-commerce, banking, and e-books, and these requirements are in effect now.

The core of both directives is their alignment with the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA, a set of internationally recognized standards developed by the World Wide Web Consortium (W3C). To provide a clear legal framework, the EU relies on the harmonized technical standard EN 301 549, which incorporates WCAG but also extends its scope to include hardware and other ICT products. For any organization operating within the EU, understanding this legislative landscape is no longer just a "nice to have" – it's now a legal imperative.

Drupal's Longstanding Commitment to Core Accessibility

Drupal has a deep, longstanding commitment to accessibility, viewing it as a core value. From the very beginning, the platform has been built to be accessible, with key features and functionality available out-of-the-box. The community's proactive approach ensures that new releases, like Drupal 10 and 11, adhere to the latest accessibility standards. This means that a standard Drupal install provides a powerful and inclusive foundation for any web project.

The foundation of web accessibility is built on four core principles, often abbreviated as POUR: Perceivable, Operable, Understandable, and Robust. Let's explore how Drupal's core features directly contribute to each of these principles.

1. Perceivable: Ensuring All Users Can Access Information

A website is perceivable when its content can be consumed by users regardless of their sensory abilities. Drupal helps meet this principle in several key ways:

• Semantic HTML5: Drupal's architecture is built on clean, semantic HTML5. It uses proper tags like <nav>, <header>, <main>, and <footer> to define the structure of the page, which is essential for screen readers to navigate and interpret content.
• Image Handling: Drupal's media system makes adding and managing descriptive alternative text (alt text) for images a fundamental and required part of the content creation process. By default, content authors are prompted to add this critical information, ensuring that users with visual impairments can understand the purpose and content of an image.
• Visual Contrast: The core front-end theme, Olivero, and the administrative theme, Claro, are meticulously designed to meet WCAG 2.1 AA color contrast requirements. This ensures that text is readable against its background, a crucial element for users with low vision or color blindness.

2. Operable: Enabling All Users to Interact

A website must be operable for users who can't use a mouse, relying instead on a keyboard or other assistive devices. Drupal's core is designed for full keyboard operability.

• Keyboard Navigation: All interactive elements, from dropdown menus to form fields, are fully accessible via keyboard. Clear, visible focus states make it easy for keyboard-only users to see exactly where they are on the page.
• Skip Navigation: Drupal’s core themes include a "skip to main content" link that is a required feature for WCAG. This link allows keyboard users to bypass repetitive navigation links at the top of a page and jump directly to the main content, saving time and effort.
• Developer helpers: JavaScript helpers are provided in Drupal core, allowing developers to easily add accessibility features to their sites like ARIA live regions or tabbing constraint to their modules and themes.

3. Understandable: Creating Clear and Predictable Interfaces

For a website to be understandable, both its content and its user interface must be clear and predictable.

• Logical Structure: Drupal’s use of semantic HTML also creates a logical heading structure (H1, H2, H3, etc.). This hierarchy is vital for screen reader users and helps all users quickly grasp the organization of the content.
• Inline Form Errors: The core Inline Form Errors module, while not enabled by default, is a powerful tool for this. It provides immediate, context-sensitive feedback on form errors right next to the field, rather than a generic message at the top of the page. This is far more helpful and less confusing for all users.
• Clear Labels: Drupal’s Form API ensures that form fields have correctly associated, descriptive labels, making them understandable for screen reader users.

4. Robust: Functioning Across Technologies

A robust website can be reliably interpreted by a wide range of user agents, including older browsers and assistive technologies. Drupal achieves this by adhering to web standards and providing full support for WAI-ARIA (Accessible Rich Internet Applications), a set of attributes that add semantic information to elements to make dynamic content and custom widgets more accessible. This allows for rich, interactive experiences that still work for users who rely on assistive technologies.

The Role of AI in a More Accessible Future

The Drupal community is actively exploring how artificial intelligence can help streamline and automate accessibility tasks. This isn't about outsourcing responsibility, but rather empowering content authors and site administrators with smarter tools that make it easier to create and maintain an accessible web.

One of the most promising areas is the use of AI to generate high-quality alt text. While human review remains essential for context, AI-powered modules can significantly reduce the manual effort required for this critical task, particularly for sites with large image libraries.

• AI Image Alt Text: Modules like this one leverage machine learning vision models to automatically generate descriptive alt text for images. They provide a human-in-the-loop workflow, allowing content creators to review and edit the suggested text before publishing. This not only improves efficiency but also helps maintain consistency across large libraries of images.
• Limitations and Human Responsibility: It's important to understand that AI is a tool, not a solution. AI might describe an image as "A person standing on a stage," but a human content author can provide the context: "Drupal founder Dries Buytaert giving a keynote at DrupalCon." The human provides the meaning, which is the ultimate goal of accessibility.

Community-Driven Best Practices and Contributed Tools

Beyond core and AI, the Drupal ecosystem offers a wealth of resources and contributed modules that further enhance accessibility. This collaborative environment is key to keeping Drupal at the forefront of digital inclusion.

Some Accessibility-Focused Modules

• Alt Text Validation: Scans and validates image alt text site-wide and on save, with customizable rules that can warn or prevent saving.
• Block ARIA Landmark Roles: Adds ARIA landmark role assignment to block configuration forms.
• Editoria11y Accessibility Checker: An automatic, inline checker that helps authors create accessible content by marking issues, offering fixes, and tracking progress.
• Node Link Report: Scans and reports on link status (broken, redirected, good) and accessibility errors (indiscernible text, missing alt/aria-labels).

Also see this list from Smart Bees or on this article on OpenSource.com 

The Power of a Community Initiative

The Drupal community's accessibility team works tirelessly to ensure core code is accessible. They have established a "needs accessibility review" process in the issue queue, inviting specialists to review patches and new features before they are committed to core. This rigorous process is a testament to the community's commitment to making accessibility a fundamental part of Drupal's DNA. They also hold regular Accessibility Office Hours to help new and experienced contributors alike.

The Role of the Site Builder and Content Author

Ultimately, technology is only part of the solution. A fully accessible website requires a commitment from the humans building and managing it.

• Start with an Accessible Foundation: Use Drupal's core and themes like Olivero to ensure your site is built on a solid, compliant base.
• Empower Content Authors: Train content creators on the importance of semantic headings, clear links, and providing meaningful alt text. Tools like Editoria11y can be invaluable in this process.
• Test, Test, Test: Don't rely solely on automated tools. Manual testing using a keyboard, and testing with a screen reader, are essential to catch issues that automation can miss. Better still, involve real users with disabilities in your testing process. We have documented our recommended process.

Wikipedia & Country References

Rather than duplicating efforts to look at the country details of the EAA, we’ve tried to consolidate some of the findings into the Wikipedia page on the legislation. This way, the legislation can continue to be updated by the community. Like accessibility, we expect that there will be updates needed about how the EAA is being implemented in each member state.

Conclusion: A Continuous Journey

The new wave of digital accessibility regulations, including the EAA and updated ADA rules, are not a burden. They are a catalyst for building a more inclusive and user-friendly web for everyone. Drupal, with its strong core features, a powerful ecosystem of modules, and a dedicated community, is perfectly positioned to help organizations meet these new standards and go beyond mere compliance. By combining solid technology with a human-centric approach, we can work towards a digital world where accessibility isn't an afterthought but an integral and effortless part of the creation process.

Note: For state and local governments in the USA, new regulations under the Americans with Disabilities Act (ADA) have established WCAG 2.1 Level AA as the technical standard for web and mobile app accessibility. Many of the steps discussed here will also benefit your sites. You can find more information on these specific requirements on ADA.gov.

Some recent articles about Drupal & legislation

Here’s a curated list of articles and resources that explicitly connect Drupal with the latest accessibility legislation/standards and the technical solutions to meet them:

Legislation & standards → what they mean to Drupal

• “Making sense of the European Accessibility Act, EN 301 549 and WCAG” (June 26, 2025) — Acquia
• “The European Accessibility Act: What is it and do I need to worry about it?” (May 14, 2025) — Zoocha
• “European Accessibility Act: What you need to know” (June 26, 2025) — Electric Citizen
• “The European Accessibility Act: What it means for your website in 2025” (24 June 2025) — Annertech

September brought a fresh wave of contrib modules, and a few immediately caught our attention. Some are practical tools that could save administrators hours of work, others bring design polish or inspiration, and a couple are just plain fun. As always, we love seeing how the Drupal ecosystem keeps evolving - here’s our take on the ones worth a look this month.

​

BADCamp has always been a community-first event where ideas, experimentation, and practical knowledge-sharing thrive. This year, it’s also where Drupal’s AI conversation gets very real.

From a focused, three-hour AI Summit to a range of practical sessions across the camp, AI is showing up in force at BADCamp 2025. Whether you're a site builder, developer, themer, or content strategist, there's something here for you.

The AI Summit: Community and Possibility

Friday morning, October 25, BADCamp is hosting a special three-hour AI Summit. This unconference-style session will give the Drupal community a space to explore how we’re using AI in the real world and where we want to take it next.

It’s not a keynote. It’s not a showcase. It’s a collaborative working session where the participants set the agenda. The goal is to move the conversation forward by grounding it in actual experience. What’s working, what isn’t, and what’s needed.

Details here: AI Summit at BADCamp

Drupal AI Initiative in the Spotlight

The Drupal AI Strategic Initiative will also be well represented. I'll be leading a hands-on session that shows how anyone can integrate private AI tools into their Drupal site without writing code:

• Getting Hands-On with DrupalAI: Build Smarter Sites with Zero Code
  – J. Matthew Saunders, Initiative Marketing Specialist

Kristen Pol will provide a look at the bigger picture, including how the initiative is positioning Drupal for the future:

• Accelerating Innovation: The Drupal AI Initiative
  – Kristen Pol, Initiative Co-Lead
   

AI Topics Across the Camp

BADCamp isn’t just featuring AI. It’s threading it through the whole program. Here are some of the other sessions digging into what AI can do in and around Drupal:

• 3 Ways to Use AI in Drupal: Chatbots, Smart Search, and Code Generation – Salim Lakhani
• Building Smart Content Moderation in Drupal: AI-Powered Spam Detection and Community Tools – Prabhakar Singh
• AI + Headless Drupal – Jordan Koplowicz
• Creating an AI Chatbot in Drupal the Easy Way – Jordan Koplowicz
• Preparing Your Pipeline for the AI Revolution – James Sansbury
• Quick and Easy Migrations and Upgrades Using AI – Luke McCormick
• Preparing for the Future: AI, the Changing Consumption Landscape, and Combating AI Threats – Steve Carlson

AI is no longer on the sidelines. The Drupal community is actively shaping how open source, ethical, and privacy-respecting AI tools can work in real content workflows.

If you're curious about where Drupal and AI meet, BADCamp is the place to see it all in motion. This isn’t about someday. It’s about what you can do right now.

badcamp.org

File attachments:  badcamp-image.png

We’re excited to share that Dripyard was featured on Talking Drupal, Episode 520!

Andy and I joined the hosts to talk about why we launched Dripyard, what makes our themes different, and how Drupal’s modern tooling like Single Directory Components and Drupal CMS (Canvas + Recipes) have made this the perfect time to bring high-quality themes to the ecosystem.

Some highlights from the episode:

DrupalCamp Ruhr 2025 in Essen brought together nearly 100 Drupal enthusiasts for sessions, networking, and fun at the Unperfekthaus, celebrating community, knowledge sharing, and collaboration.

Drupal AI brings together human expertise and advanced machine intelligence to help teams create faster and explore new possibilities. Find out what’s new in the Drupal AI world.

The 2025 Ironstar Developer Survey confirms a critical trend in the Drupal ecosystem: younger developers are not entering the community at the rate needed to sustain long-term growth. Of the 753 respondents, only one was under the age of 21. Developers aged 21-29 declined from 59 last year to 44 this year, despite an increase in overall participation. Those with less than one year of experience numbered just 11 globally, with only a single respondent from Asia, a sharp drop in early-career representation.

André Angelantoni stated that "Drupal is struggling to reach younger developers," citing the same findings and pointing to a broader pattern: the aging of the contributor base. While Drupal continues to evolve in areas like AI integration (78% adoption this year, up from 50%), developer tooling (93% of DDEV users would recommend it), and platform usage (Platform.sh is the most recommended PaaS), the lack of incoming junior developers presents a structural challenge.

Despite the gap in new developer entry, Drupal continues to make meaningful progress in areas that matter: AI adoption is up significantly, modern tooling like DDEV is widely embraced, and community-driven improvements to the developer experience are ongoing. To build on this momentum, practical steps should focus on structured onboarding, beginner-friendly documentation, mentorship programs, and targeted outreach through learning platforms and regional events. These efforts can help ensure that Drupal remains accessible, relevant, and supported by a new generation of developers.

INTERVIEW

• “Drupal’s Complexity Is Being Used to Make Things Simpler” — Jorge Tutor on Smart Scaling

DISCOVER DRUPAL

• Seed EM Launches Drup & Drop: Production-Ready Drupal CMS Platform for Faster Digital Implementation

• 23 Essential AI Modules for Content Creation and Authoring in Drupal

• Drupal AI Initiative Webinar Shares Survey Insights, Highlights Community Momentum

• Drupal AI Initiative Calls for Use Cases from Agencies, Developers, and End Users

• Maya Schaeffer to Join Drupal Association Board on November 1, 2025

• Ronald te Brake Releases Surge Tool to Improve AI Integration with Drupal Projects

• Alexander Varwijk Proposes Core Redesign to Bring Async and Modern PHP Support to Drupal

TUTORIALS

• New Way of Writing Hooks in Drupal 11 Explained

• Unmanaged Files in Drupal: When and Why to Use Them (Part 1)

EVENT

• DrupalCon Nara 2025 Splash Awards: Submission Deadline Extended

• Efforts Underway to Revive Drupal Meetups in Bengaluru

• Early Bird Tickets Available for DrupalCamp Italy 2025

ORGANIZATION NEWS

• miniOrange Deepens Drupal Involvement with Local Events, Freelance Support, and Global Sponsorship

• QED42 Highlights Ongoing Contributions to Drupal and Support for DrupalCamp Pune 2025

• Mike Herchel Launches Dripyard, a New Theme Company for Drupal

We acknowledge that there are more stories to share. However, due to selection constraints, we must pause further exploration for now. To get timely updates, follow us on LinkedIn, Twitter, Bluesky, and Facebook. You can also join us on Drupal Slack at #thedroptimes.

Thank you.

Sincerely, 
Kazima Abbas, 
Sub-editor, The DropTimes.

Search is no longer what it used to be. For many years the process was simple. People typed a question into Google, browsed the links that appeared, and clicked the result that looked most promising. Businesses, especially those running Drupal websites, built entire strategies around search engine optimization to capture those clicks and grow their audience.

In this episode, we are joined by special guests Mike Herchel and Andy Giles, founders of Dripyard. Dripyard is a premium Drupal theme designed to reduce the cost of ownership and enhance the developer experience for modern Drupal projects. Mike and Andy share insights into their motivation behind launching Dripyard, the detailed work that goes into creating accessible, high-quality themes, and how their themes will integrate with upcoming Drupal features like Canvas. We also discuss the module of the week, Content First, and a crucial public service announcement about a supply chain attack impacting NPM tools.

For show notes visit: https://www.talkingDrupal.com/520

Topics

• Meet the Guests: Mike Herchel and Andy Giles
• Module of the Week: Content First
• Public Service Announcement: NPM Supply Chain Attack
• Event Spotlight: Bad Camp 2025
• Introducing Dripyard: A New Drupal Theme Company
• The Concept and Vision Behind Dripyard
• The Importance of Accessibility in Themes
• Building Themes for the General Public
• Supporting Drupal CMS and Canvas
• Supporting Custom and Contrib Modules
• Styling Challenges with Webform Module
• Consulting Services for Theme Integration
• Sub-Theming and Customization Options
• Support and Assistance for Non-Developers
• Recipes for Efficient Theme Setup
• Modern CSS and JavaScript Practices
• Target Audience and Market Focus
• Licensing and Open Source Considerations
• Final Thoughts and Contact Information

Module of the Week

with Martin Anderson-Clutz - mandclu.com mandclu

Content First - The Content First module provides a simple tool for viewing the plain text content of any node without design, media, or layout distractions. It helps content teams, editors, and designers focus on what matters most: the content itself.

Whether you're drafting, reviewing, or rethinking your site’s messaging, this module supports a true “content-first” approach by giving you a clean, layout-free version of your page.

Resources

Dripyard Supply Side Attack - Also this link grep -r --binary-files=text _0x112fa81 to diagnose if you’ve been impacted Should I Use a Carousel?

Guests

Mike Herchel mherchel Andy Giles andyg5000 dripyard.com

Hosts

John Picozzi - epam.com johnpicozzi Martin Anderson-Clutz - mandclu.com mandclu James Sansbury - tugboatqa.com q0rban

From Job Rejection to Enterprise Kubernetes Platform in 6 Days Image Imagen Article body

TL;DR: After a job rejection for lacking hands-on experience with specific tools, I decided to test my learning approach with Kubernetes. Built an enterprise-grade platform in 17 hours over 6 days using my "black box" learning method. Results included production infrastructure with monitoring, real applications, security patterns, and a community module contribution. The key: focus on solving immediate problems while implementing professional patterns from day one.

 

 

 

 

About a month ago, I was turned down for a role at Confluent. The reason? No hands-on experience with their tools. Fair enough. But it got me thinking about something I've been doing for decades: can I still learn complex technology stacks quickly using my "black box" approach?

 

I decided to find out. I picked Kubernetes - something I'd never practiced before - and gave myself a simple challenge: demonstrate that systematic learning beats months of theoretical study.

 

Six days and 17 hours of focused learning later, I had an enterprise-grade Kubernetes platform running real applications with monitoring. The module contribution came after that, taking additional time to properly research and build. Here's how the black box methodology made it possible.

What Is Black Box Learning?

Instead of trying to master everything at once, I focus only on what solves my immediate problem. I know other parts exist, but I don't let them distract me until I need to "open that box."

 

Think about learning Drupal development. I started with CSS for the longest time because it solved everything I needed. When a more complex problem presented itself, I knew my next step was to open templates. When I needed something more, I knew preprocess functions existed, but I chose not to get distracted by them until needed.

 

Same thing happened at Acquia. I never looked hard at Site Factory until my customer bought it. Then I attended the 2-day seminar and became an internally recognized subject matter expert.

 

The key is strategic focus: know what exists, but only dive deep into what solves your immediate problem. Everything else stays closed until needed.

The 6-Day Learning Journey

Rather than diving into theoretical concepts, I approached each day with a specific problem to solve. The progression shows how systematic learning works in practice.

 

Day 1 (3.5 hours): Foundation and Tool Selection Started by mapping Kubernetes concepts to familiar web hosting architecture. Research with Claude as a partner, followed by basic implementation: kubectl, Kind, simple cluster. Key decision: chose HAProxy for Ingress because friends work there and I knew I could get help. Installed better tools (Helm, Freelens) based on research. Real learning meant real infrastructure, so I reinstalled an old laptop with Ubuntu.

 

Day 2 (3.5 hours): Professional Patterns from Day One Each solved problem revealed what to learn next. Built proper team separation using Kustomize with base configurations plus development/production overlays. No toy examples. Professional deployment patterns with Infrastructure as Code from the start. This is where 30 years of infrastructure experience accelerated learning. I knew the organizational problems even if I didn't know these specific tools.

 

Day 3 (3 hours 40 minutes): Production Infrastructure External access via MetalLB for bare metal LoadBalancer services. Took a detour looking at HAProxy replacement, but discovered commercial licensing requirements. Practical decision-making: chose appropriate tools for the situation. Implemented NFS shared storage for persistent content across multiple pods. Result: production-ready infrastructure with external access.

 

Days 4-6 (9+ hours): Real Applications and Enterprise Monitoring Deployed Drupal 11 with multi-container architecture, external database integration, and proper networking. Here's where black box discipline showed its value: I started planning Kafka integration for user events, then realized I was opening too many boxes at once. Stepped back to build monitoring foundation first (RBAC, Prometheus, Grafana). Enterprise patterns: authentication, security, observability with persistent storage.

 

Key Learning Principles That Emerged:

 

• Professional implementation from day one. No learning with toys, everything built for production use.

•  

• Sequential problem solving. Each solution enabled the next logical challenge.

•  

• Strategic stepping back. Recognize proper sequencing instead of jumping to exciting features.

•  

• Experience acceleration. Map new concepts to existing knowledge (30 years Linux experience).

•  

• Research partnerships. Accelerate implementation without getting stuck in documentation rabbit holes.

The Unexpected Community Contribution

After completing the enterprise platform, I was ready to implement that Kafka integration I'd planned. But when I researched how to send events from Drupal to Kafka, I discovered a problem: there was no integration between ECA (Event-Condition-Action) and Kafka message streaming.

 

I could have worked around it with custom solutions, but that seemed like missing the point. If I needed this, other people probably did too. This is where the black box approach revealed something unexpected: sometimes learning leads to contributing.

 

Using systematic development methodology with Claude, I built the ECA Kafka Integration module. The module bridges ECA with Apache Kafka, enabling automated message publishing based on Drupal events. It essentially turns Drupal into a smart Kafka producer for any site activity.

 

At this point, I considered the exercise complete. The platform was enterprise-ready, and I'd contributed something valuable to the community.

What This Demonstrates for Companies

Time Efficiency: 17 hours total resulted in enterprise platform with monitoring plus community contribution. Companies need people who can build systematically without over-engineering.

 

Rapid Adaptation: The ability to acquire hands-on experience quickly might matter more than existing experience with specific tools. Each solved problem revealed exactly what to learn next, with no wasted time on concepts not yet needed.

 

Professional Standards: Infrastructure as Code, security patterns, team separation from day one. No learning with toy examples - everything built for production use from the start.

 

Problem-Solving Methodology: Systematic building where each solution enabled the next challenge. Black box discipline meant recognizing when to step back and build proper foundations before jumping to exciting features.

 

Community Engagement: Moving from consumer to contributor. Learning led to identifying and filling a genuine gap in the Drupal ecosystem.

The Business Reality

This isn't just about personal learning. It's about what companies actually need: the ability to adapt quickly to new tools without months of study, the capacity to build professional solutions while learning the technology, and the judgment to know when to step back and build proper foundations.

 

The Confluent rejection that started this journey highlighted something important: hands-on experience matters, but the ability to acquire that experience rapidly might matter more.

 

Six days later, I had enterprise Kubernetes experience and had contributed something valuable to the community I care about. The black box approach didn't just help me learn Kubernetes - it led me to make Kubernetes work better with the tools I already knew.

 

Each solved problem reveals exactly what you need to learn next, not what you think you need to learn. No wasted time on concepts you don't need yet. No getting overwhelmed by the scope of what you don't know.

 

Companies need people who build systematically without over-engineering. This systematic approach works for any technology stack.

 

The work isn't finished. There are more black boxes to open, more problems to solve, and more ways to contribute to the communities and technologies that matter.

 

What's your approach to learning complex tech? Do you plan everything upfront, or do you solve problems as you go?

 

 

 

 

The complete Kubernetes learning platform code is available on GitHub, and the ECA Kafka Integration module can be found on Drupal.org.

 

Author Carlos Ospina Abstract After a job rejection for lacking hands-on experience with specific tools, I demonstrated that systematic "black box" learning methodology can produce enterprise-grade results. Built complete Kubernetes platform with monitoring, security, and real applications in 17 hours over 6 days, leading to community contribution. Tags Drupal Drupal Planet Career Development Professional Growth Best practices Devops Development Contribution kubernetes rapid-learning Rating Select ratingGive From Job Rejection to Enterprise Kubernetes Platform in 6 Days 1/5Give From Job Rejection to Enterprise Kubernetes Platform in 6 Days 2/5Give From Job Rejection to Enterprise Kubernetes Platform in 6 Days 3/5Give From Job Rejection to Enterprise Kubernetes Platform in 6 Days 4/5Give From Job Rejection to Enterprise Kubernetes Platform in 6 Days 5/5Cancel rating No votes yet Leave this field blank Add new comment

The Early Bird registration is now open for the largest Drupal event in North America, DrupalCon Chicago 2026, happening March 23–26, 2026 in Chicago, Illinois. Don’t miss your chance to connect, learn, and celebrate with the global Drupal community.

For a limited time, secure your DrupalCon Chicago registration for just $575—the lowest price available!

Learn more and register now to get your ticket at the lowest price!

Don’t miss your chance to connect, learn, and celebrate with the global Drupal community.

When you buy a conference ticket, you’ll get access to:

• DrupalCon opening reception
• All general conference sessions
• All contribution sessions
• Keynote speakers, access to the Expo Hall, and raffle contest
• Trivia Night
• Lunch and coffee breaks
• Networking and mentorship

View the program at a glance now.

Stay at DrupalCon Chicago 2026 Headquarters

Make the most of your DrupalCon experience by staying at the Hilton Chicago, the official DrupalCon hotel.

DrupalCon is more than just sessions. The real magic happens in hallway track conversations, late-night discussions, and spontaneous coffee meetups. Book the conference hotel to stay close to it all.

Book your room at Hilton Chicago!!

DrupalCon Chicago 2026 Call For Speakers Deadline Approaching Soon

The Drupal Association is dedicated to creating an event that is welcoming and inclusive to everyone. The Call for Speakers for DrupalCon Chicago 2026 submission deadline is almost here!

Submitters may edit their submissions until 26 September 2025, 11:59 pm Central Time.

Submit your session soon!

Drupal 11.1 introduces a modern way to write hooks using PHP attributes, moving beyond the traditional procedural approach. This shift brings autoloading, dependency injection, better testability, and cleaner code organization—making hooks faster, smarter, and easier to maintain. Teade Geertsma of Emble explains how the new system works with practical code examples, covers ordering and backward compatibility, and highlights what remains procedural. A must-read for developers preparing their modules for Drupal’s object-oriented future.

We’re thrilled to introduce Glenn Hilton, one of the newest members elected to the Drupal Association Board, with her term beginning 1 November 2025.

Glenn is the Founder and CEO of ImageX, a Drupal agency that he established in 2001. Over more than two decades of leadership, Glenn has combined creativity with community to guide both his company and his career. His passion for open source and collaboration has made him an active participant in the Drupal community for more than ten years.

Beyond his role as CEO, Glenn is deeply committed to building strong teams and helping people reach their full potential. He believes that lasting success comes from relationships and from creating environments where individuals and communities can thrive.

We are thrilled to have Glenn bring this perspective to the Board. Here are his thoughts as he begins this new chapter:

What are you most excited about when it comes to joining the Drupal Association Board?
I'm excited to help shape the business strategy that ensures the long-term sustainability of the Drupal ecosystem. It is a unique opportunity to bridge the gap between agencies, contributors, and end clients while keeping Drupal both innovative and commercially viable.

What do you hope to accomplish during your time on the board?
I want to strengthen feedback loops with agencies and enterprise users so that we have stronger data to help us better understand and support the needs of those investing in Drupal. I also hope to help expand Drupal’s reach by improving how we communicate its value and create new paths for commercial growth.

What specific skill or perspective do you contribute to the board?
As CEO of a long-standing Drupal agency, I bring a business-first perspective rooted in delivery, growth strategy, and client expectations. With more than 20 years in leadership, I focus on scalable teams, efficient operations, and long-term partnerships.

How has Drupal impacted your life or career?
Drupal changed the trajectory of my agency and gave me a career grounded in purpose, global collaboration, and community. It is more than a platform, it is a values-driven ecosystem where even competitors work together with integrity and a shared mission.

Tell us something that the Drupal community might not know about you.
Outside of work, I am a real estate and architecture enthusiast and probably spend too much time analyzing floor plans. I have four amazing kids, one grandchild, a wonderful wife, and a deep passion for my faith in Jesus Christ.

Share a favorite quote or piece of advice that has inspired you.
“Leadership is not about being in charge. It is about taking care of those in your charge.” — Simon Sinek

We look forward to the contributions Glenn will make during her time on the Drupal Association Board. Thank you, Glenn, for sharing your time and expertise with the Drupal community. You can connect with Glenn on LinkedIn.

About the Drupal Association Board of Directors

The Drupal Association Board of Directors comprises 13 members with nine nominated for staggered three-year terms, two elected by Drupal Association members, and one seat is reserved for the Drupal Project Founder, Dries Buytaert. One seat  is reserved for the immediate past chair as a non-voting member. All Board terms start on 1 November of each year.

The Board meets twice in person for weekend retreat and about 5 times virtually each year.   The Board provides strategic guidance to the Drupal Association and oversight of the Association’s management, policy development, management, budget, and fundraising efforts.

How to use HTMX with forms in Drupal 11.3

After a shorter than expected time in the core issue queue the HTMX integration in now usable in Drupal Core, Let's see how we can use it! 

HTMX has a respectable pool of examples to choose from, today we'll focus on forms. How can we make an equivalent of the cascading select HTMX example in Drupal? 

theodore September 13, 2025

CodeLift migrated Cram-A-Lot’s e-commerce site from Drupal 7 with Ubercart to Drupal 10 with Drupal Commerce. The migration included over 100 configurable products, quote request workflows, and related content.

The approach involved replicating the production environment locally, using AI-assisted refactoring to update custom modules, and preserving the existing content architecture and field structures. Automated visual regression testing helped verify consistency across more than 40 screens.

The result is a Drupal 10 Commerce site that mirrors the original design and functionality while running on a modern platform, ensuring continuity for product data, quotes, and order workflows.