If your site uses Field UI in drupal/core, this week's advisories include a remote code execution vulnerability in that module. It isn't directly exploitable with core alone, but I'd still check your installed version.

The fixes are in 10.6.19 / 11.3.19 / 11.4.10 / 12.0.0-beta2, depending on your branch. Those releases address all three core advisories:

• drupal/core, Field UI: remote code execution, with the core-alone limitation noted above.
• drupal/core, Link: insufficient sanitization of certain markup.
• drupal/core, Navigation: insufficient attribute sanitization that can lead to cross-site scripting (XSS).

I read the new Composer advisories each week. For the week of 12 October 2026, these are the ones I'd check first on Drupal sites.

Full list with advisory links: https://patchclock.com/security-digest/2026-w42?utm_source=reddit

Disclosure: I build PatchClock, a CRA compliance tool for PHP vendors. The weekly list itself is free.

When I started my postion as a Drupal Web Developer I inherited a very poorly maintained Drupal site. It was on Drupal 9 when I started, a week before it went EOL. It took me a year to clean it up enough to make the jump to D10, and that was with a lot of help from my predecessor, who we had to bring in on a consulting fee, and while he was great and wicked smart, he was not a great teacher. I've been in my position for 3 years and have been so bogged down in front end content management that I haven't had time to do anything other than regular D10 patches. Now we're looking to jump to D11, since D10 is going EOL, and this new PHP nonesense is driving me up the wall trying to figure out how to fix all this without torching the site.

At this point I'm looking for a company who can come in and clean up all the wonky database mess we have, figure out what packages are being used, and basically clean up the back end of the site so I can have a clean build to work with. Who can I reach out to for a consultation and figure out how I can get this site back to a manageable build?

This may be of interest to some folks.

At Kitchener Public Library. I'll be speaking on the Hosting Panel, so I hope to see some of you there! 😄

This game was made just to teach people about the Drupal AI ecosystem, but it is hopefully fun to play for anyone.

The game can be played online or downloaded here: https://macpackwala.workflows-of-ai.com/

Some more information here: https://workflows-of-ai.com/blog/i-vibe-coded-a-point-and-click-game-to-learn-about-the-drupal-ai-ecosystem

If you can't patch yet.

I can't load drupal.org for the last few minutes. Some pages have been unavailable longer than that. Most of the down detectors say it is still up, but not for me. I am in St. Louis.

Anyone else seeing this? Thanks.

My take is that contributing to and growing an open-source project is easier with AI than without it. Still, while working on the Webform module's security issues, I was terrified that a single AI-generated misstep would draw vitriol.

Let's talk about our Drupal gardens and engage in an open dialogue among those who are AI-pilled, AI-curious, and AI-cautious.

A year ago, I attended a one day drupal training camp and met a few absolutely wonderful people.

So encouraging and just consistently hyping me up any time I got stuck. I tried to download the cms on my chrome book with Linux emulated and forgot to give it enough disk space and they didn't let that keep me behind.

They instead introduced drupal forge to me and made sure I left with some knowledge which I can't thank enough.

However, icl I kinda got lost and could not learn any more cause the difficulty increased tenfold so I never picked it up again but, I'd really like to learn it purely to make my, one day, mentors proud💚

This is mainly targetted at the broader AI community, but it also has a section what we mean to implement in AI Image Crop module

I am running two docker services that use the same Drupal instance.
The first one, let's call it "http", serves the site, and the second one, let's call it "amqp" runs a drush command that listens to AMQP messages (via rabbitmq) to alter content.

The amqp service process tasks that outlive a normal request; a task can take up to several minutes.

I am experiencing cache issues between both services: when a configuration is updated on the "http" service, the "amqp" service still uses a cached version, and when an entity is updated on "amqp" service, the "http" service still shows the old cached version.

I managed to fix the first issue by calling "ConfigFactory::reset" before retrieving the config object when a new message is processed, but this seems like a dirty fix, and I don't see how I can apply such a fix for the issue regarding entities.

Has anyone experienced such an issue ?
Any ideas of how to deal with this ?

P.S: I have APCu and memcache enabled, but the issue appeared before memcache was installed.

Any help will be highly appreciated.

A demo on the work that I've been doing on exposed slots in Drupal Canvas.

This is still a proof of concept, we are not there yet.

I hope this demo gets people as excited as I am about this feature.

I think this one is very important to drive Canvas adaption.

Let me know what you think!

MR: https://git.drupalcode.org/project/canvas/-/merge_requests/1359

I've been thinking about how much money gets wasted on development and staging environments that sit idle most of the time.

For example, DigitalOcean still charges you for a Droplet even when it's powered off. The only way to stop compute charges is to destroy it entirely.

But then you have to deal with snapshots, restoring env vars, networking, etc. whenever you need it again.

I'm curious how other developers deal with this. Do you just leave everything running and accept the cost? Destroy and recreate environments manually?

Especially sketchy is that it goes back to 8.x so any unsupported sites floating around out there could be in trouble

Remark: I work at CKEditor as a Developer Advocate 🥑

Drupal 12 is in beta since DrupalCon Rotterdam, and today both official CKEditor contrib modules got their matching 2.0.0-beta1 releases:

• CKEditor 5 Plugin Pack 2.0.0-beta1
• CKEditor 5 Premium Features 2.0.0-beta1

What to know before you try them:

• 2.x requires Drupal 12 and is not compatible with Drupal 10 or 11. The 1.x line stays for Drupal 10.3+ and 11.
• Both modules have to be upgraded together with core, in one Composer operation:

``` composer require \ 'drupal/core-recommended:<sup>12.0@beta'</sup> \ 'drupal/core-composer-scaffold:<sup>12.0@beta'</sup> \ 'drupal/core-project-message:<sup>12.0@beta'</sup> \ 'drupal/ckeditor5_plugin_pack:<sup>2.0@beta'</sup> \ --no-update

composer update --with-all-dependencies ```

• Already on Drupal 12 without the modules? Then just composer require 'drupal/ckeditor5_premium_features:^2.0@beta' 'drupal/ckeditor5_plugin_pack:^2.0@beta'.
• Both betas switch to the CKEditor 5 UMD installation method that Drupal 12 uses. Premium Features also adds a collapsible AI container, AI Chat context configuration, configurable heading levels in the document outline, clipboard mode for collaboration, and Arabic-Indic numbering for footnotes.

I tried to kick this off a bit during DrupalCon Rotterdam, the slides give the high-level idea of the 1.x vs 2.x split: CKEditor in Drupal: News in Content Editing

Are the release notes clear? If anything in the upgrade path is confusing or breaks on your Drupal 12 test site, say it here and I will pass it on to the module maintainers.

The usual way to put a map on a Drupal site is Google Maps. It is easy to start: get an API key, paste it in, and a monthly free allowance covers your first maps. After that, Google bills per map load. The map of a venue is the same for every reader, yet every view is a new request, counted and billed, and every reader's browser talks to Google while they look. The map doesn't change; the meter keeps running.

There is an open alternative to Google's data. OpenStreetMap is built by volunteers and published under an open licence. I wanted maps drawn from it that a site downloads once and keeps, so I built Maper.

What it does

• Your server downloads each map tile once, keeps it in private files, and draws the map itself. Browsers receive the finished drawing, never a tile, so no third party sees your readers.
• No API key and no per-view billing. Tiles come from OpenFreeMap, a free, donation-funded service, or from a Protomaps file you host yourself, in which case nothing is downloaded at all.
• It is polite to the tile provider: downloading stays off until you set a contact address. After that, every download respects daily and per-job limits, one request at a time, and backs off when the provider asks.
• Restyling is free. Tiles hold shapes and names, not colours, so switching or editing a map style redraws every map from the tiles you already have. Three styles ship today, and five more come in the next release.
• It works the Drupal way: a Maper map block for nodes (a venue, or the dates of a tour), and a Maper map format for Views, where every result row becomes a pointer with its own card.
• Headless if you want it: the server hands any front end the map as JSON, with a reference script in plain JavaScript.

Is it real?

It runs in production on Oído en Vivo, a live-music listings site in Colombia: 836 tiles, 69 MB, serving the maps of 550 places and every search. See it at https://oidoenvivo.com/buscar

Where it stands

This is 1.0.0-alpha1. It needs Drupal 11.2+, PHP 8.3 and a private file path. Alphas have no upgrade path, so reinstall between them. Beta comes next, and from then on every change carries an update.

• Project: https://www.drupal.org/project/maper
• composer require drupal/maper:1.0.0-alpha1

I'm the author. I'd welcome bug reports, rough edges and questions in the issue queue, or right here.

Map data © OpenStreetMap contributors (ODbL).

I support our Drupal page in the company, and the part in the red circle bothers everyone for some reason. Is there any way to get rid of it?

There will be an upcoming critical security release of Drupal core this coming Wednesday, October 14. For more information please see https://www.drupal.org/psa-2026-10-12 - the security team cannot release any further details at this time