webjoke.de

Project: Drupal coreProject machine name: drupalDate: 2026-October-14Security risk: Critical 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Remote code executionAffected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2CVE IDs: CVE-2026-108097Description: 

A remote code execution vulnerability exists within the Field UI module in Drupal core.

The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality.

The vulnerability can be mitigated by uninstalling the core Field UI module (field_ui), which will provide protection while sites are updated.

Drupal Steward protection:

This issue is being protected by Drupal Steward. Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered.

Solution: 

Install the latest version:

Drupal 11

• If you use Drupal 11.4.x, update to Drupal 11.4.10.
• If you use Drupal 11.3.x, update to Drupal 11.3.19.
• Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

• If you use Drupal 10.6.x, update to Drupal 10.6.19.
• Drupal 10.5.x and below are end-of-life and do not receive security coverage.

Drupal 8 and Drupal 9 have both reached end-of-life.

Release packaging may still be in progress for this security announcement. If you are unable to access a release, wait 30-45 minutes and then check again.

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team
• Octavio Galland (ogalland-tob)

Fixed By: 

• catch (catch) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• catch (catch) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Tim Hestenes Lehnen (hestenet)
• Lee Rowlands (larowlan) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

A council-developed publishing platform has completed an international standards review. Two initially unmet requirements reveal what the assessment demanded.

Drupal 11.4.9 addresses a shifting navigation sidebar, updates CKEditor 5, and makes editor toolbar configuration more flexible through recipes. Here’s what the release means for content teams, developers, and site owners.

We read all 462 case studies on drupal.org and coded every migration that says how long it took. Median: 7.5 months from kickoff to launch. Small relaunches took weeks; multi-site platforms took a year or more.

Released Translation Template Extractor 3, a tool for the modern Drupal age

If you ever translated Drupal software, you used the Translation Template Extractor (potx) at least indirectly, even if you never heard of it. It reads the source code of Drupal core and contributed projects, and collects the translatable strings. Every string translated on localize.drupal.org was extracted by potx. Developers and translators also use it to extract strings of their own modules and themes, on a web UI or with Drush.

Gábor Hojtsy Wed, 10/14/2026 - 10:17

Extending Editoria11y with Custom Content Checks in Drupal Joel Steidl Tue, 10/13/2026 - 14:53 Drupal

An editor copies a link from an email, adds it to a page, and publishes. The link text looks right. The destination opens. Nothing about the normal authoring workflow suggests a problem.

But the saved URL may not be the destination the editor intended to publish. Microsoft Safe Links can wrap an address in a long, encoded URL that sends visitors through a security-checking redirect service.

On of our client’s websites, a custom Editoria11y check helps editors recognize these links and replace them with the original destination. It adds site-specific guidance to a tool already used for accessibility feedback.

A Content Problem Worth Flagging

Microsoft Safe Links is a legitimate security feature, not evidence that a link is spam or malicious. The problem here was context: a URL copied from an email was becoming a public website link.

A simplified example looks like this:

<https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fexample.com%2Fmeeting>

The intended destination is https://example.com/meeting. Publishing the wrapper makes that destination harder to inspect and introduces dependence on another redirect service. The addresses can also be difficult to read and maintain.

Those are good reasons for an editorial warning. They are not proof that every Safe Link violates WCAG or cannot be used with a screen reader.

The useful question was narrower: could the website identify this recurring content pattern and give editors a practical next step?

Discovering an Existing Extension Point

Editoria11y brings accessibility feedback into the page context. Its custom-test capability lets developers add checks beyond the standard set without building a separate reporting interface.

Princeton's documentation includes an example for email-obfuscated URLs, providing a starting point for both detection and integration. The extension builds on that existing capability rather than introducing a separate checking system.

A Small Drupal Integration

The custom module, custom_editoria11y, handles the Drupal integration. Its metadata declares a dependency on Editoria11y. A library definition registers the custom JavaScript and depends on the contrib module's library.

The PHP attachment hook checks for the view editoria11y checker permission before attaching that library. This keeps the extra script scoped to users authorized to use the checker rather than delivering it to public visitors.

JavaScript handles detection and feedback. Although we might informally call this a custom rule or plugin, it is not a Drupal PHP Plugin API class. It is an event-driven JavaScript test delivered through a Drupal module.

That division keeps the implementation small: Drupal controls availability, the custom script identifies the content pattern, and Editoria11y provides the warning interface.

How the Custom Test Runs

Editoria11y's custom-test lifecycle has four steps: register the expected callbacks, listen for ed11yRunCustomTests, add results, and dispatch ed11yResume when finished.

Our script increments options.customTests through the Drupal integration's options override. That tells the checker to wait for one additional completion event before drawing its tooltips.

The count represents completing test callbacks, not matching links. A callback that finds ten links still sends one completion event. A callback that finds none must finish too.

The rule searches for anchors using a[href*="safelinks.protection.outlook.com"]. This catches different Safe Links subdomains without maintaining a list of regional prefixes. It is substring matching, however, not comprehensive URL-host validation; the same text elsewhere in an address could also match.

The following excerpt shows the site's v3 integration. It assumes the options override and tooltip helper are already defined:

document.addEventListener('ed11yRunCustomTests', function () { Drupal.Ed11y.findElements( 'customSafeLinks', 'a[href*="safelinks.protection.outlook.com"]' );   Drupal.Ed11y.elements.customSafeLinks?.forEach(function (element) { Drupal.Ed11y.State.results.push({ element, test: 'customSafeLink', type: 'warning', content: customSafeLinkContent(element.getAttribute('href')), position: 'beforebegin', dismiss: false, }); });   document.dispatchEvent(new CustomEvent('ed11yResume')); });

Using findElements keeps the search within the configured content roots and respects selector-based exclusions. Results enter the existing checker workflow rather than a separate alert system.

The tooltip names the issue, displays the encoded address, and asks the editor to replace it with the original URL. When available, new URL(href).searchParams.get('url') extracts the destination as an additional hint. If parsing fails or the parameter is missing, that hint is omitted.

Displayed URL strings are sanitized with Drupal.Ed11y.sanitizeHTML. In this v3 implementation, tooltip content is a DOM element, with a .title child supplying its heading.

The rule does not rewrite content or block publication. The editor remains responsible for checking and replacing the link.

Maintaining the Rule Through an Upgrade

An upgrade from Editoria11y 2.2.6 to 3.0.2 required migrating the custom module to the v3 API.

The migration changed more than a version constraint. The custom code moved from older Ed11y references to Drupal.Ed11y, changed the sanitization helper, and pushed results into Drupal.Ed11y.State.results. Tooltip construction moved from the older message-registration approach and HTML strings to DOM-element content. Result properties also changed, including explicit warning severity and the dismissal setting.

The lesson is practical: extending a supported tool avoids owning an entire checker, but the extension still has an API contract. Major upgrades require reviewing that contract and testing the custom feedback, not just confirming that the base module loads.

Testing and Extending Thoughtfully

For ongoing maintenance, a focused regression checklist should cover matching and ordinary links, missing destination parameters, configured exclusions, permission boundaries, safe tooltip rendering, and completion events when no matches exist.

Additional checks could flag obsolete internal domains or temporary campaign URLs. Those are possibilities, not features delivered in this project. Each proposed rule should have a recognizable problem, a clear correction, and a manageable risk of false positives.

Multiple extensions also need to coordinate the shared options override rather than replace one another's callbacks. The expected completion count must stay aligned with the listeners actually running.

Princeton's custom-test documentation is a useful starting point. Check examples against the installed version, especially when maintaining an older integration.

Give Editors an Actionable Next Step

The value of this extension is specific feedback at the point where someone can act on it. Instead of asking editors to remember every problematic URL pattern, the website identifies one and explains what to change.

Custom tests can support content standards alongside accessibility checks. They do not replace human review or establish accessibility compliance. They make the existing editorial workflow more useful, one well-defined problem at a time.

Philip Stier

Drupal Meets Matrix 03 - Better Conversations with Advanced Comment Threads John Locke Tue, 10/13/2026 - 10:00

Commenting in Drupal hasn't noticeably changed in 15 years. That changes now.

Dev Corner

• Read more about Drupal Meets Matrix 03 - Better Conversations with Advanced Comment Threads
• Add new comment

In March 2012 a developer asked us for a PHP version per platform, a per-site override on top, and a way to tell Drush which PHP to use, and I turned the Provision half down myself, because the Ægir backend's command-line PHP was hard-wired into the Drush wrapper and had to be running before any task could change it. Fourteen years and a few small text files later, BOA-5.88.866 closes that gap: one line in cli-per-platform.info gives a platform its own command-line PHP, so a Drupal 7 codebase keeps its drush on PHP 7.4 while the Drupal 11 build beside it gets 8.5, in the same account, with no ticket to anyone, and a task which would run a site's code on a PHP its core cannot handle is refused before PHP even starts, with the line that fixes it printed in the message. It works because every command in your shell and every Ægir task for your account now passes through BOA's shell wrapper, which picks the version before any PHP is running at all.

Need better image galleries in Drupal? The Media Scroller module adds a large main image, synced thumbnail navigation, and simple configuration without custom templates.

I’m always blown away by the Driesnote slides

I’ve watched a lot of Driesnotes. A lot. Goodness me, I don’t even know how many.

Over the last few years, and I promise to find out exactly how many, Dries has had a lot of help with the design of them from an awesome designer at Acquia who I just have to shout about - ASH. 

(yes, absolutely go give the shout outs!!)

Rachel Tue, 10/13/2026 - 11:49 Tags

• Drupal

• Read more about I’m always blown away by the Driesnote slides
• Log in with GitHub or Google to post comments. Or, if you came across this post via Mastodon, just reply there!

Most Drupal site owners I talk to handle Drupal security updates the same way. These are the fixes the Drupal Security Team publishes for core and contributed modules. A developer sees the security advisory. A ticket goes into the next sprint. The patch goes live a few days later, sometimes two weeks later.

A Drupal update should come with confidence that your important workflows still work. Learn how to introduce Playwright, build useful browser tests, and make automation part of your release process.

Date: 2026-October-12Security risk: Critical 19 ∕ 25 AC:Complex/A:None/CI:All/II:All/E:Theoretical/TD:AllDescription: 

There will be a Drupal core security release for all supported branches on October 14, 2026 between 16:00 and 21:00 UTC. (To see this in your local timezone, refer to the Drupal Core Calendar.) Based on our analysis this vulnerability rates at 19/25 on our risk calculator.

The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days.

We recommend updating to the latest supported patch (bugfix) release for your site's version of Drupal before October 14, so that you can address any other upgrade issues before the security window.

This issue is being protected by Drupal Steward. Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered.

Affected versions

All currently supported versions of Drupal core are affected, including:

• Drupal 11.4.x
• Drupal 11.3.x
• Drupal 10.6.x

Drupal 12.0.0-beta1 is also affected. New beta releases will be provided following the security updates for the supported branches.

All versions of Drupal prior to 10.6.x, as well as all versions of Drupal 11 prior to 11.3.x, are end-of-life and no longer supported. Sites on those versions should update as soon as possible to avoid this and other publicly disclosed vulnerabilities.

Disclosure policy

Neither the Security Team nor any other party is able to release any more information about this vulnerability until the announcement is made. Security release announcements will appear on the Drupal.org security advisory page, which has RSS feeds. The announcement will also be made public on:

• The #security-team channel of the Drupal community Slack
• Bluesky
• Mastodon
• X (formerly Twitter)
• LinkedIn
• By email for those who have subscribed to our email list. (To subscribe to the email list: log in on Drupal.org, go to your user profile page and subscribe to the security newsletter on the Edit » My newsletters tab.)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• catch (catch) of the Drupal Security Team
• Damien McKenna (damienmckenna) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Michael Hess (mlhess) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

The eight-step Drupal 7 database cleanup we run before every migration: caches and logs, revisions, deleted fields, files, spam accounts, content you will not bring, and the module data you leave behind, in the order that costs least and saves most.

Questions about the pace of advanced artificial intelligence are no longer confined to the research teams building it. Former OpenAI safety leader David Robinson described his decision to leave the company in a 3 October essay for The Atlantic, challenging the assumption that developers can release increasingly capable systems and address risks as they emerge. Former Anthropic researcher Jacob Coxon had raised concerns about competition between AI laboratories in a September interview with WIRED. Their warnings point to a conflict between the speed of development and the time required to evaluate its consequences. Neither departure demonstrates that the industry has actually slowed down.

That tension has reached public hearings and internal disputes. At a 5 October hearing, New York City Council members questioned representatives of major AI companies and heard testimony from former researchers at Anthropic, OpenAI and Google DeepMind. Three other former OpenAI safety researchers, Jasmine Wang, Tomek Korbak and Mikita Balesni, subsequently disputed the company's stated grounds for their dismissal. They warned that uncertainty over acceptable contact with external evaluators could discourage scrutiny. OpenAI rejected the suggestion that they had been dismissed for raising safety concerns and said its policies on sensitive information had been breached. The underlying dispute remains unresolved.

Public oversight offers a possible route beyond those competing accounts, but proposals must be distinguished from protections already in force. New York City lawmakers have discussed third-party validation, reporting and protections for people who flag risks. These measures would need to be enacted and implemented before their practical effect could be assessed. Independent evaluation also raises a harder question than whether a company publishes safety reports: who receives the findings, who can challenge the evidence and who has the authority to require a change before deployment? A review process may identify dangers without having the power to alter a release decision.

These questions extend beyond arguments about catastrophic AI scenarios. Organisations that develop or operate software routinely face uncertainty, conflicting incentives and decisions that affect people outside their own teams. Open-source communities confront some of those problems through public issue histories, reviews and shared maintenance, although those processes are not substitutes for the legal and institutional oversight proposed for advanced AI. What matters is whether concerns can move from warnings to decisions, with clear accountability when evidence is contested. The question is not only whether someone is willing to say that development should slow, but whether anyone outside the organisation can make that warning count.

Follow The DropTimes on LinkedIn, X, Bluesky, and Facebook, or join #thedroptimes on Drupal Slack.

Kazima Abbas wrote and curated this issue of Editor’s Pick.

Author: Will Huggins

The narrative around enterprise AI is changing. Digital leaders — from CMOs looking for campaign velocity to CISOs managing vendor risk — are no longer just asking for new AI features. They are asking for AI infrastructure they can actually trust. They want to know how to maintain brand sovereignty, ensure content provenance, and scale AI operations without creating unmanageable compliance risks.

This shift in the market perfectly aligns with the mission of the Drupal AI Initiative: to establish Drupal as the premier open-source AI platform for digital experiences.

This October, the conversation takes a national stage at Digital Leaders' AI Week 2026, the UK's largest online festival of AI learning. And the Drupal community is front and center.

While Drupal AI is fundamentally a technology initiative, its real-world impact comes from the thought leadership of the people building it. At AI Week, members of the Drupal ecosystem will share strategies that go far beyond the CMS, showing how open-source principles are solving the hardest challenges in enterprise AI adoption.

Here is a look at two key sessions you won't want to miss.

The Technology Is Ready. Is Your Organisation? Why AIMS Will Define the AI Leaders

When: October 16, 2026

The technology to generate content, personalise experiences, and orchestrate complex user journeys is already here. But as many organisations are discovering, having access to an AI model is not the same as having a scalable AI operation.

In this session, we will explore the critical gap between technological capability and organisational readiness. The focus will be on the necessity of an AI Management System (AIMS) — a structured approach to governing AI adoption.

This is where Drupal AI's philosophy truly shines. When we talk about Drupal as an "AI platform," we are talking about built-in governance. Organisations locked into proprietary platforms often struggle to adapt their AI infrastructure as new models emerge or regulations change. Lightweight SaaS tools, conversely, often lack the rigorous audit trails enterprise IT requires.

This talk will illustrate why the organisations that win in the age of AI will be those that prioritise structural sovereignty — the ability to control their own data, choose their own models, and enforce their own brand guidelines at scale. It’s the exact reason why the Drupal AI Initiative developed the Context Control Center (CCC), ensuring that AI-generated content is always grounded in verified, human-authored brand rules.

Running with scissors: Using AI to explore, build, maintain, contribute, and secure Drupal" is the title of my DrupalCon Orlando session proposal. I've been using and writing about AI as a Drupal developer for the past year, and I look forward to sharing my experience with fellow Drupalers at the conference. There is so much discussion about AI and Drupal, and I'd like your help with my DrupalCon session proposal.

We should assume most session proposals will focus on AI inside and outside Drupal from the perspective of site owners and builders. Meanwhile, if we want to encourage people to try Drupal, we also need to sell it to developers. My goal is to sell "using AI to explore, build, maintain, contribute, and secure Drupal" to developers and vibe coders, while acknowledging the challenges and risks by comparing how fast we've had to adopt AI to "running with scissors."

Running with scissors

I first heard the expression "Running with scissors" in the title of Augusten Burroughs' memoir. I enjoyed reading that book, and now I am listening to the audiobook while working on this blog post. A subtle takeaway from the memoir is that sometimes you may find yourself "running with scissors' involuntarily (or voluntarily), and you have to decide how to handle that scenario.

Related to AI, "running with scissors" captures the extremely fast, collectively exceptional pace we're in: a remarkably massive societal shift, comparable to the Industrial Revolution, is unfolding. The Industrial Revolution took decades to unfold, whereas the AI Revolution is unfolding in a few years, especially among software developers.

The AI Revolution is probably the right term, and it could foreshadow AI winning the revolution, leading to humankind's demise. BTW, this won't be the focus of my session...Read More

Shared code creates shared security needs. European product rules raise a more specific question: who must act?

Importing content with the Default Content module is really useful when populating a site with content. There's an increasing number of recipes and modules that can be used to populate a site with content either for setup or demonstration purposes.

Default content is really useful when figuring out how a system works as it can show relationships between content types that are not always simple to discern through the site itself. It also has a place when deploying content between sites as you can package up some default content and include that in a deployment step.

Occasionally, you'll want to tweak the content that is imported for different situations; with the reasons why you would want to do this being numerous. It might just be that you have a demo site and you wanted to tweak the content imported to better tailor it for the user. You could have a single recipe that contains the content and want to alter that for a specific demo.

I needed to do this selected default content import on a recent site as I was installing. A contributed module was used to populate the site with content to create a collection of examples. Although the content was good, I didn't want to import it all as some of it didn't make sense for a couple of scenario that I was looking at. That lead me to seeing if I could alter the content automatically as it was imported into the site, rather than manually delete content after the fact.

In this article we will look at some of the actions I tried to prevent content from being imported, before moving onto what the actual solution was. If you are following along at home, it is assumed that you already have a default content process setup and are just looking for change what content is imported without altering the source files.

Read more

Drupal's Form API comes with built-in tooling to allow any form element to initiate a submission. When combined the support for returning HTML fragments in htmx 4, it's very easy to make an interactive form for your users.