Turn Drupal website inquiries into proposed email replies your team can review. This guide explains how Webform, ECA, and Drupal’s AI framework work together, with practical setup steps and checks before launch.

Your website may have the information people need. But the way they discover and evaluate their options is changing, with AI-generated answers becoming part of the journey.

EAB’s survey of more than 5,000 U.S. high school students, conducted in late 2025 and published in February 2026, 46% reported using AI tools during their college search, up from 26% in spring 2025. A separate EAB survey published in August 2026 found that 57% of more than 2,500 U.S. parents surveyed had used AI to evaluate colleges and compare options for their children.

Together, these findings suggest that students and families are adding conversational tools to the ways they research universities. For institutions, that raises a practical question: could a more guided experience also help people make sense of the information on their own websites?

Growing adoption doesn’t mean trust is guaranteed. Pew Research Center found that 66% of U.S. adults were extremely or very concerned about people getting inaccurate information from AI. For institutions exploring AI-assisted guidance, that makes accuracy, transparency, and testing with real users central to the experience.

For Higher Education institutions, this raises a practical question: could a more guided experience help students and families make sense of institutional information while preserving accuracy, trust, and control?

On October 29, 2026, at 9:30 am PT / 12:30 pm ET / 4:30 pm GMT, join James Hall, Product Lead for Websites at Everyone TV, as he chats with Joe Kwan of the University of Waterloo, and John Tran, CTO at ImageX about “Navigation to Guidance Using AI to Improve Digital Experiences”. They’ll share a behind-the-scenes look at an AI-powered admissions advisor proof of concept, with practical lessons for anyone exploring where AI could improve a digital experience.

Start with the questions people are trying to answer

The University of Waterloo and ImageX began by working with Waterloo’s graduate and undergraduate admissions teams to understand the student journey.

Where were students getting stuck? Which questions came up repeatedly? Where did search and navigation fall short? And when did students need guidance from a person?

Those conversations shaped a conversational prototype designed to help prospective students find trusted information, compare programs, understand requirements, and navigate next steps.

The project offers a useful starting point for other organizations: identify a specific moment where people struggle, then explore whether AI could help. That gives teams a concrete problem to investigate and a clearer basis for deciding whether to invest further.

Find out what users actually think

A working prototype is only part of the story. The team also tested the experience directly with prospective students. Research showed strong interest in a more conversational way to explore university information. It also surfaced important considerations around privacy, tone, usability, content quality, transparency, and trust.

The webinar will explore what the team learned through that testing and where human guidance remains essential.

The session will focus on discovery, prototyping, and user research, and what those stages can help an organization understand before moving toward production.

Where Drupal fits

An AI-assisted experience raises questions about the information behind it: Where does it come from? Who maintains it? How is it reviewed? And what happens when it changes?

For the Drupal community, the session will explore the role Drupal can play as the governed content foundation behind these experiences, connecting AI assistance to institutional information that an organization manages and trusts. For marketing, digital, and service leaders, the broader question is equally relevant: how can you make information easier to use while retaining oversight of its quality and accuracy?

You don’t need to work with Drupal or in higher education to benefit from the discussion. The approach is relevant to teams considering AI for complex information journeys across nonprofits, public services, and businesses.

What you’ll take away

Join the webinar to explore:

• How discovery with internal teams can uncover AI use cases worth investigating.
• What prospective students thought about using AI to explore university information.
• What user testing revealed about trust, privacy, tone, transparency, and usability.
• Where human guidance remains essential.
• How governed content can support AI-assisted experiences.
• How to validate an idea with real users before moving toward production.

Whether you’re a Drupal practitioner, a higher education leader, or someone responsible for a complex website, this session offers a practical example of moving from an AI idea to an experience you can test and evaluate.

Join James Hall, John Tran and Joe Kwan on October 29, 2026, at 9:30 am PT / 12:30 pm ET / 4:30 pm GMT for From Navigation to Guidance Using AI to Improve Digital Experiences.

Register for the webinar →

With Drupal 12 on the horizon and Drupal 10 reaching end of life in December, I'm facing two challenges. First, I need to upgrade my current site from Drupal 10 to Drupal 11. Second, I need to update my contributed modules to support Drupal 12, while still supporting Drupal 10. Frankly, I am more anxious about upgrading to Drupal 11 and supporting Drupal 12 than about integrating AI into my workflow.

Upgrading to Drupal 11

Upgrading to Drupal 11 has gotten easier over the years thanks to tools such as Drupal Rector, the Drupal Lenient Composer Plugin, the Upgrade Status module, and the Project Update Bot. Still, if you rely on contrib and custom modules, you'll have a lot to tweak and test.

I've done a "big-bang" upgrade via a dedicated branch, using the Lenient plugin and the Project Update Bot's patches for contrib modules, and fixing deprecations in custom code with Drupal Rector. There were always a few rough edges. Ideally, I'd like to gradually test my upgrade to Drupal 11 while continuing to support Drupal 10 in the same codebase using the DeprecationHelper.

As a maintainer of a contributed module, I face a slightly different challenge: supporting Drupal 12, 11, and 10.

Supporting Drupal 10, 11, and 12

As a maintainer of multiple contributed modules, I need to test them across previous, current, and next Drupal versions. I typically use dedicated DDEV instances for each Drupal version. I've started using Git worktrees to maintain a single Drupal playground with branches for each Drupal version. Still, maintaining a composer.json file that targets different Drupal versions across branches is challenging because it...Read More

A second workplace platform may help governments survive a technology disruption. Whether it also gives them the freedom to leave a dominant supplier is a harder test.

We are back from Rotterdam, and we are still blown away. Three weeks later we are still processing what happened. We brought a whole bouquet of topics: structured concurrency for PHP, Translation Bliss, our page builder session and CrowdPower.Digital. Some days felt a bit like a movie. One conversation led to the next, and suddenly we were at a table with people whose names we have read in the issue queue for years.

Nearly two decades after development began, Outer-Core is evolving without starting over. Alessandro Feijó explains the decisions behind its revival.

PHP2Shell, and DDEV v1.25.5

On October 21, PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell". A single unauthenticated request could run code on any server running PHP. PHP's security advisory↗ has the details.

Local DDEV projects listen only on your own computer, so nobody on the internet could reach them. Projects exposed with ddev share or used for casual hosting↗ were at risk, and so were your production servers. Stas wrote up the same day what DDEV users needed to do, including how to get the fixed PHP into projects before a new DDEV release: PHP2Shell: What DDEV Users Need to Know.

DDEV v1.25.5 shipped on October 26 with the fixed PHP in ddev-webserver. PHP 8.1 and older are past end of life and get no fixes from PHP, but deb.sury.org patched every version it ships, so PHP 5.6 through 8.1 in DDEV are fixed too. Upgrade, run ddev restart, and check ddev php -v. If you haven't updated PHP on the servers where your sites are hosted, do that first.

v1.25.5 also brings 142 community PRs that were waiting for the next release:

• A rebuilt ddev tui that fits any window and shows database addresses, snapshots, ports, and add-on updates
• ddev config global --ssh-agent-upstream=host, so containers use the SSH agent you already run (macOS agent, 1Password, Secretive, YubiKey)
• ddev restart -s <service> to recreate only the services you name
• QR codes from ddev share and ddev launch --qr, replacing the ddev-qr add-on
• zstd for ddev import-db, ddev export-db, and ddev import-files
• Global hooks, and global_config.*.yaml files merged over global_config.yaml
• Initial PHP 8.6 support (RC3, which doesn't have the PHP2Shell fixes yet)

The release post covers these and the changes that might affect you.

Standing on the Shoulders of Giants

DDEV couldn't have shipped a PHP fix this way on its own. It has always depended on two upstreams that most PHP developers rely on without thinking about them.

Ondřej Surý has packaged PHP for Debian since PHP 5, and maintains deb.sury.org↗, the repository that ddev-webserver, the ondrej/php PPA, and a large part of the PHP world install from. On the day of the PHP release, he published fixed AMD64 packages for every PHP version back to 5.6, including versions PHP itself no longer supports. As he writes on his site, "The PHP packaging is time consuming and I do this mostly in my free time." The BBC told his story in How one man became the unsung hero of the internet during a cyber-security scramble↗. His day job is director of DNS engineering at ISC↗, the nonprofit behind the BIND DNS server, and when the PHP2Shell details leaked early he had less time than planned to build the packages: "The feeling is like I am responsible for all these people and I can't fail them." Donations that week passed $10,000, which he said was "basically about a year's worth of the contributions that I got before." His message to the companies that depend on his packages: "If you just take and don't give back then it will backfire."

The PHP Foundation leads development and maintenance of PHP itself, including the security work behind releases like this one. The team is small for a language that runs so much of the web. "We have one full-time staff member (that's me) and 14 mostly part-time contractors," Executive Director Elizabeth Barron told CNA↗ after the release, adding that "it is clear that PHP is incredibly under-funded." In 2025 its developers made 2,929 commits across 9 PHP repositories and reviewed 1,685 community PRs in php-src (2025 impact report↗). On release day it also published Today's PHP Security Release, and How We're Strengthening PHP Security↗.

The DDEV Foundation has sponsored both for years, because DDEV is built on their work. If PHP is part of how you make a living, please support them too:

• Ondřej Surý: GitHub Sponsors↗ or Open Collective↗. Companies that need a supported PHP for older versions can look at PHP LTS from Freexian↗.
• The PHP Foundation: Open Collective↗. Company memberships are on the sponsor page↗.

Community Projects

DDrovr: a native macOS app for DDEV — A SwiftUI desktop interface from Bison Digital for projects, logs, databases, Git, and settings, with start and stop from the menu bar. It runs the DDEV CLI and reads .ddev/ rather than replacing anything. Version 1.0.3 needs macOS 14 and DDEV v1.24 or later. ddrovr.com↗

ddev-openlitespeed — An add-on from morvy that replaces DDEV's web server with OpenLiteSpeed running lsphp, for PHP 5.6 through 8.5. It honors .htaccess and works with the LiteSpeed Cache WordPress plugin. Install with ddev add-on get morvy/ddev-openlitespeed. GitHub↗

ddev-clim — A small terminal UI from lemachinarbo for starting and stopping DDEV projects, which can also restore your running projects at boot, with a systemd user service on Linux. Available from the AUR. GitHub↗

Mage 3.0 detects DDEV — Sean van Zuidam's CLI for Magento 2 and Mage-OS now detects DDEV and runs its commands inside the container, so mage cache:clean works without ddev exec. Release post↗

Talks and Tutorials from Around the Web

• What's New in DDEV for TYPO3 Folks, October 2026 → Snapshots and seeded databases, Branchery, TYPO3 Quickstarter, Knecht, and PHP2Shell, for TYPO3 developers. Read on news.typo3.com↗
• René Kreijveld at Joomla World Conference → Joomla development with DDEV. View the slides↗
• DDEV for Drupal: setup, import, and export → Nadeem Mir of Dynamosys on setting up a Drupal 11 project, importing a site's database and files, and exporting it again, with warnings about what ddev import-db and ddev import-files overwrite. Read on dynamosys.com↗
• Migrating a 13-year-old WordPress blog to Drupal CMS → Christian López Espínola (penyaskito) moved a 722-post blog to Drupal CMS 2.2. The WordPress clone ran as its own DDEV project, and the Drupal project read its database container directly with wordpress_migrate_sql across 24 migrations. Read on penyaskito.com↗
• Import a WordPress site with BackWPup → Matthias Andrasch shows how to pull a BackWPup backup into DDEV with a custom provider and ddev pull backup. It's from 2023, so adjust the versions in the example config. Read on dev.to↗

DDEV Live Training

All sessions are open to everybody.

Shopware with DDEV, with Benny Poensgen — The October 21 session is recorded. Watch the recording↗, browse the slides↗, or read Benny's Shopware on DDEV post.

Hobobiker Rides Again, at the Drupal AI Learners Club — Randy, Amber Matz, and Angie Byron are migrating hobobiker.com, a Drupal 6 site from 2009, with Claude, live and in three parts. Everything runs in DDEV, and the repository, a sanitized database, and the slides are linked from the hobobiker.com README↗.

• Part 1, Road Test (October 16) → Before migrating anything, Claude wrote a Playwright test suite against the old site. Working from the raw Drupal 6 database, it found the content types on its own, knew to use only the latest node revisions, and flagged problems nobody asked about, including database backups that anyone could download. Watch the recording↗ or read the club's recap↗.
• Part 2, The Last Ride (October 23) → Claude retired the site as static HTML, following Lullabot's "Sending a Drupal Site into Retirement" and checked against the tests from Part 1. The archive is now live at static.hobobiker.com↗. Watch the recording↗ or read the club's recap↗.
• Part 3, The Long Haul (Friday, October 30 at 10:30 AM US Mountain / 12:30 PM US Eastern / 17:30 CET) → Drupal 6 to Drupal 11. Claude explores the source and the destination and writes a migration plan before touching any code, and the finished site has to pass the same test suite. Register on Luma↗

The next DDEV training session:

• November 11, 2026 at 8:00 AM US Mountain / 10:00 AM US Eastern / 16:00 CET — Advanced Coder.ddev.com Techniques
  Using the coder CLI, local and web-based VS Code, and remote-controlling Claude, including the freeform template.
  Add to Google Calendar • Download .ics

Zoom Join Info:
Link: Join Zoom Meeting
Passcode: 12345

Governance

• The next DDEV advisory group meeting, open to everybody, is November 4, 2026 at 8:00 AM US Mountain / 10:00 AM US Eastern / 16:00 CET. Add to Google Calendar • See the agenda. We love to hear from our community!

Sponsorship Update

We so appreciate all of you supporting the project!

September 2026: ~$10,099/month (84.2% of goal)

October 2026: ~$10,239/month (85.3% of goal)

If DDEV has helped your team, consider sponsoring. → Become a sponsor↗

Contact us to discuss sponsorship options that work for your organization.

Stay in the Loop—Follow Us and Join the Conversation

• Blog↗
• LinkedIn↗
• Mastodon↗
• Bluesky↗
• Discord↗

Compiled and edited with assistance from Claude Code.

Aidan Foster's keynote on adapting to AI: balance cheap execution with human judgment, deep customer relationships, and strategic creativity.

On October 25, Akismet turns 21. We’re celebrating with a few new guests: an official Drupal module, a PHP SDK, and another year of improvements to our WordPress plugin. Spam still isn’t on the list.

Akismet launched in October 2005 to help people spend less time dealing with comment spam and more time enjoying their blogs. The web has changed a lot since then. People build communities, collect inquiries, accept donations, and create applications on all kinds of platforms. Each of those places gives people a way to contribute. It also gives spammers somewhere to try their luck.

Since then, Akismet has blocked over 570 billion pieces of spam. Every one is something a site owner didn’t have to spend time sorting through. Our birthday wish is to keep making more room for the real people.

Welcome, Drupal

This year, we released the official Akismet Drupal module, built by the team behind Akismet. It brings our spam protection to Drupal comments, contact forms, webforms, and user registrations, with tools for moderators to review submissions and send corrections back to Akismet.

We’ve continued building on that welcome. The latest release supports Drupal 12 and passes richer bot-detection signals into spam scoring. On Drupal 12, comments and registrations are supported now; contact forms, webforms, and the Key module will follow as those modules become ready for Drupal 12.

For people using the older community module, we also built an upgrade path to the official module that carries their API key and protection settings across. The migration guide explains the requirements and which settings need attention.

Welcome, PHP developers

Akismet’s API has long made it possible to protect sites beyond WordPress. This year’s official PHP SDK gives developers a first-party client for bringing that protection into their own PHP applications, including projects built with Laravel or Symfony.

The SDK handles the Akismet API integration so developers can focus on their application. It supports checking submissions, reporting spam and legitimate content, and retrieving usage and account information. The official Drupal module uses it too.

If you’re building a place where people can post, sign up, or send a message, there’s a new tool to help you keep the spam out.

A familiar guest, with a few improvements

WordPress has been with us from the beginning. This year, we kept improving that experience: clearer setup and error messages, accessibility improvements, better detection of automated submissions, and compatibility fixes. You can find the details in the WordPress plugin release log.

Version 5.7 also added support for Abilities and Connectors, helping Akismet fit into WordPress’s evolving tools for integrating external services.

More room for real people

A comment worth replying to. A message from a future customer. A donation to a cause someone cares about. Those are the things we want coming through.

Thank you to everyone who uses Akismet, builds an integration, reports a problem, or helps us improve. You’ve been part of these 21 years, and you’re very much invited to the celebration.

Whether your site runs on WordPress, Drupal, or something you’re building yourself with the PHP SDK, there’s room at the table.

Just no room for spam.

Try out the Drupal module today!

Opening access is only the first step. Sustaining the people, institutions and infrastructure that keep knowledge available is the greater challenge.

Behind every published research paper lies years of work, often supported by public funding. Yet the institutions producing that knowledge do not necessarily control how it reaches the world. New research released by SPARC on 14 October, ahead of International Open Access Week, estimates that more than 95% of investment in a typical research article occurs before publisher submission, based on its accounting model. A companion study found operating margins of 24% to 38% among major academic publishers in 2025. The figures raise an uncomfortable question: who should benefit from knowledge that society has largely paid to create?

Removing paywalls is important, but it does not automatically make scholarly publishing fair or sustainable. Some open-access models shift costs from readers to researchers through publication fees, potentially excluding scholars with fewer resources. Alternatives exist. Harvard Library, for instance, supports journals that charge neither authors nor readers. Such models still require institutional investment, editorial labour and dependable technology. The real challenge is not simply making research available, but ensuring that openness does not depend on another form of exclusion.

The same challenge extends to the infrastructure behind public knowledge. A 14 October appeal from SCOSS sought renewed funding for the Research Data Alliance and Software Heritage, noting that insufficient funding had delayed some planned standards work. Open-source communities understand these pressures. Drupal, for example, supports complex institutional publishing environments, including a UK university platform managing more than 190,000 research records. Maintaining such systems requires continuing work on security, accessibility, data management and technical reliability. The software may be open, but the responsibility of sustaining it remains substantial.

Perhaps the most important lesson from this year's Open Access Week is that openness needs a long-term commitment, not just a declaration of principle. Universities, governments and other institutions should treat shared digital infrastructure as an essential public investment, with predictable funding, accountable governance and support for the people maintaining it. The open-source movement has demonstrated what communities can build together. Its continuing challenge is ensuring that those contributions remain useful and accessible for generations. Knowledge should belong to everyone, but keeping it that way must also become everyone's responsibility.

Follow The DropTimes on LinkedIn and Bluesky, or join #thedroptimes on Drupal Slack.

Kazima Abbas wrote and curated this issue of Editor’s Pick.

Drupal.org accepts AI-assisted work only from contributors who have checked it, can explain every change and say when a tool wrote a significant share.

Colour choices can influence how people experience a website, but assumptions about emotion and culture need testing. Kanopi Studios' Anne Stefanyk shares three practical ways to make colour decisions more consistent, evidence-led and accessible.

Everyone’s talking about the 9.2 PHP vulnerability that dropped on a Wednesday evening. We patched 30+ Drupal sites in 24 hours with zero downtime. Here’s what our audit found next.

We checked the homepages and platforms of 95 of the world's most-visited museums. What the best museum websites put first, and which CMS they run.

In a Talking Drupal Cafe conversation, Stephen Cross chats with recent Talking Drupal Guest Host, Tim "Tea Sharp," a relatively new Drupal user at Appalachian State University, starting with a light discussion about a 3:00 PM drink before digging into Tim's path from sustainability science and design through nonprofit work, WordPress site building, and finally Drupal in higher ed. Tim describes learning Drupal 7, discovering Views, and then helping his team manually consolidate hundreds of departmental subdomain sites while migrating to Drupal 10 using a product approach and a shared distribution initially built with Lullabot. He discusses training and documentation for non-technical site managers, professional development through DrupalCon Atlanta and Drupal Camp Asheville, interest in Drupal AI for tasks like alt text generation, and aspirations to keep speaking, contribute more, and improve module discoverability and documentation.

For show notes visit: https://www.talkingDrupal.com/cafe021

Topics

• Finding Talking Drupal
• From Sustainability to Design
• Pandemic Pivot to Web
• WordPress Site Builder Era
• Discovering Drupal at App State
• Drupal 10 Rebuild and Consolidation
• Team Structure and Iteration
• AI in Drupal Workflows
• Upgrade Blockers Cleared
• Aspiring Drupal Speaker
• Raycast Productivity Talk
• Stage Fright Reframed
• Posting Beyond Comfort
• Finding a Username
• Joining Talking Drupal
• Better Module Discovery
• Open Source Burnout Lessons
• Why More TD Cafe
• Final Encouragement

Tim Sharp

Tim is a self-taught Web Developer at Appalachian State University in Boone, North Carolina. At App State, he works with a team of developers to support over 300 websites. Tim is passionate about community organizing and recently became a co-organizer of Drupal Camp Asheville.

Stephen Cross

Stephen is the founder of Talking Drupal and Drupal Developer.

Guests

Tim Sharp - tea-sharp Stephen Cross - stephencross

DDEV v1.25.5 is out sooner than we planned, because PHP published fixes for two critical vulnerabilities and we wanted ddev-webserver to ship them. It also brings 142 PRs from the DDEV community that were already waiting for the next release: your suggestions, bug reports, code, and financial support made them possible.

Table of Contents PHP Security Fixes

ddev-webserver now ships PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, which fix CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"). Projects on PHP 5.6 through 8.1 get deb.sury.org's fixed packages too, because upgrading DDEV rebuilds their web image. Every project picks up the fixed PHP the next time it starts. PHP2Shell: What DDEV Users Need to Know explains who is affected.

DDEV now applies two of PHP's mitigations by default: session.upload_progress.enabled is 0 in every PHP version, as PHP's October 23 advisory suggests, and fatal_error_backtraces is 0 in PHP 8.6. Few applications use session upload progress, and the PECL uploadprogress extension that Drupal uses isn't affected. To turn either back on, see Custom PHP Configuration.

/phpstatus now answers only requests from inside the web container, and with nginx-fpm, PHP files in CMS upload directories no longer run. If you removed #ddev-generated from .ddev/nginx_full/nginx-site.conf, merge the new rule into your copy.

Initial PHP 8.6 Support

You can test a project on PHP 8.6 before its final release:

ddev config --php-version=8.6 && ddev restart

DDEV ships 8.6.0 RC3, which doesn't have the PHP2Shell fixes yet, because deb.sury.org hasn't packaged RC4. The mitigations above don't cover everything, so don't expose a PHP 8.6 project. Some extensions aren't packaged for 8.6 yet either, and enabling Xdebug, XHProf, or Blackfire on it shows an error instead of breaking the container.

A Rebuilt ddev tui

Running ddev with no arguments opens the TUI, and it has a new layout that fits any window size and shows the project list before Docker responds. Here are 15 projects, 10 of them running, in v1.25.4 (top) and v1.25.5 (bottom). The list now says how many projects are running, and the header shows the health of the SSH agent next to the router:

The project view adds the database address from your host, from the project, and from other projects; snapshots; the published ports of every service; and add-ons that have an update available, like ddev-redis here. When it doesn't fit the window, it scrolls:

Paths and URLs are clickable links, and o, v, and p open the project in your file manager, VS Code, or PhpStorm. D deletes a project, thanks to @MitraKumar. ? lists every key, and the help now fits the window:

Two keys changed: R restarts and r refreshes, swapped from before, and only enter opens the project view.

SSH Agent Passthrough

If your SSH keys live in an agent instead of ~/.ssh, such as the macOS agent, 1Password, Secretive, a YubiKey through gpg-agent, or an agent forwarded with ssh -A, DDEV's containers can now use it directly:

ddev config global --ssh-agent-upstream=host ddev auth ssh # lists the keys your containers can use

After that, every project uses your agent, and there are no key files to add with ddev auth ssh. DDEV also follows a symlinked agent socket, such as VS Code Remote's /tmp/vscode-ssh-auth-sock-*. Which agent your containers get on macOS depends on your Docker provider, and Rancher Desktop and Podman aren't supported; Using an Existing SSH Agent has the table.

Restart Only the Services You Name

ddev restart -s recreates the services you name and leaves the rest of the project running:

$ ddev restart -s redis Restarting redis in project docs-portal... Building images for [redis].... built in 1.0s Container Recreated: ddev-docs-portal-redis Container Started: ddev-docs-portal-redis Waiting for containers to become ready: [redis]... ready in 0.5s ddev-router already running, pushing new config... ready in 0.9s Restarted redis in docs-portal

That took under four seconds here. It takes a comma-separated list, as in ddev restart -s solr,redis, and ddev utility rebuild -s now accepts several services too. ddev restart --profiles=x replaces ddev restart && ddev start --profiles=x.

Interrupting DDEV is also safer now. Ctrl-C, SIGTERM, or closing the terminal no longer leaves temporary containers like start-chown-* holding project volumes, and interrupting ddev import-db, ddev export-db, or ddev snapshot leaves no partial dump or snapshot behind.

QR Codes for ddev share and ddev launch

ddev share prints a QR code for the tunnel URL, so you can open the shared site on your phone without typing it. ddev launch --qr prints the project URL with its QR code:

This replaces the ddev-qr add-on, which ddev start now removes. Thanks to @tyler36, who started all of this in ddev-qr.

zstd for Database and File Imports and Exports

ddev import-db and ddev import-files accept zstd files, and ddev export-db picks the format from the file extension:

ddev export-db -f db.sql.zst ddev import-db -f db.sql.zst

--compression chooses gzip, bzip2, xz, zstd, or none explicitly. One consequence: ddev export-db --file=x.sql now writes plain SQL. Before, it wrote gzip data to a file named .sql.

Global Hooks and global_config.*.yaml

Global hooks in ~/.ddev/global_config.yaml run for every project, before the project's own hooks:

hooks: post-start: - exec-host: "echo a global hook ran"

A project can opt out with skip_global_hooks: true. global_config.*.yaml files in ~/.ddev are merged over global_config.yaml, the way config.*.yaml files are in a project, so a team can hand out a global_config.team.yaml without touching the file DDEV rewrites. Check ~/.ddev for leftovers like global_config.old.yaml, because those are merged now too.

New pre-delete and post-delete hooks clean up files a project created, without doing it on every ddev stop, thanks to @wazum.

Changes That Might Affect You

• WP-CLI, Drush 8, the Backdrop Drush extension, magerun, magerun2, and Symfony CLI are installed only in the project types that use them. To use one elsewhere, add it in a web-build Dockerfile; see Project-Specific Utilities.
• A custom service or add-on whose container_name isn't ddev-<project>-<service> is renamed, with a warning. Reach it by its service name instead.
• DDEV assigns host ports itself. Unconfigured db, web, and Mailpit host ports move to 20000-29999 the next time their containers are created, and the router's fallback ports move to 30000-32000. Ports you set with host_*_port don't change.
• --profiles replaces COMPOSE_PROFILES, as in Docker Compose, so on a stopped project ddev start --profiles=x no longer starts the profiles in COMPOSE_PROFILES as well.
• ddev delete exits with an error and keeps the project listed when it can't remove a volume. Before, it reported success.
• DDEV_DEBUG no longer shows per-layer image download progress or routine start messages; DDEV_VERBOSE does.
• The database buffer pool drops from 1024M to 512M, which can slow large imports, and each project's database volume grows by about 160-210M on the first start after upgrading. On MySQL 8.0, 8.4, and 9.7 and MariaDB 11 and later, the connection collation is now utf8mb4_unicode_520_ci, matching the server's.

Regressions, Fixed

• Directory listing works again. The 403 explanation page in v1.25.4 had disabled it for every project.
• ddev composer create-project again passes flags like --no-dev and -vvv to the Composer scripts it runs after creating the project, which v1.25.3 stopped doing.
• Magento, Magento 2, and Maho show their own 404 pages again, instead of DDEV's explanation page, thanks to @gunnie-agency.

Everything Else

ddev list, ddev describe, and ddev tui respond faster, and the more projects you have running, the bigger the difference. nginx passes PATH_INFO to PHP, so URLs like /index.php/foo/bar work as they do with Apache, and running ddev start or ddev poweroff in several terminals at once no longer breaks the shared router. See the release notes for the rest.

From all of us, thanks for using, promoting, contributing, and supporting DDEV!

If you have questions, reach out in any of the support channels.

If you wonder how all this could be done, it's because of generous sponsors who let two of us work on this every day. If you and your team aren't already financially supporting DDEV, consider joining our sponsors.

Follow our blog, Bluesky, LinkedIn, Mastodon, and join us on Discord. Sign up for the monthly newsletter.

This article was edited and refined with assistance from Claude Code.

PHP2Shell: What Happened and How to Know Your Site Is Safe demet Fri, 10/23/2026 - 10:18

A pair of critical PHP vulnerabilities affected much of the web this week. Here’s how they were fixed, how to check your site, and how to stay protected going forward.

This week’s disclosure of PHP2Shell, a pair of security vulnerabilities that impacted up to two-thirds of the internet and resulted in the temporary shutdown of many high-profile websites, was, for many people, the first real look at how AI is changing digital security. The vulnerabilities are now patched, and if you’re a Palantir.net client, your sites are protected. Below, we explain what happened, how to confirm your site is safe, and how to stay protected going forward.

Those of us who design, develop, and support digital applications have anticipated a disclosure like this for some time. Over the last year or so, AI coding tools have grown increasingly capable of finding and exploiting previously undetected software vulnerabilities.

The good news is that the same tools are also helping the people who build and maintain software find and fix vulnerabilities faster. Many open source software projects have dedicated security teams that work in collaboration with other projects and organizations like Alpha-Omega, who have access to security-focused AI models that are not available to the general public.

What is PHP2Shell, and who was impacted by it?

PHP2Shell is the collective name given to a pair of critical vulnerabilities discovered in PHP, a popular scripting language that many websites and web applications are written in, including content management platforms like Drupal, WordPress, and Joomla, as well as the software that powers Wikipedia. It is estimated that between half and two-thirds of sites on the internet run on PHP.

The vulnerabilities affect all versions of PHP released in the last 20 years. They allow attackers to run executable code on a target’s server and access passwords and other sensitive data stored in process memory. These flaws had been present in PHP for many years, but there were no known ways to exploit them until an independent audit of the codebase using AI tools was conducted in August.

How were the PHP2Shell vulnerabilities fixed?

Because the vulnerabilities exist in the PHP code itself, the only way to fix them was with a software patch written by the PHP security team, a very time-consuming process given the complexity and sophistication of the issue. Following established best practices, this work was conducted privately, because once the vulnerabilities were disclosed publicly, they could be exploited by malicious actors.

On October 20, the PHP security team issued an advisory that a critical security patch would be released the following day, giving software vendors and the general public time to prepare. The patch was then released on the 21st at 9am Central US Time  (14:00 UTC).

At that point, web hosting and application vendors began integrating the patch into their software, testing it to make sure that it didn’t break pre-existing configurations or take their clients’ sites offline. Many hosting and developer platform companies, including the ones who host our clients’ sites, implemented short-term mitigations designed to temporarily protect their sites while the patch was still being rolled out; others simply took their sites offline until the patch was deployed.

How do I know if my site is safe from PHP2Shell?

You can tell if your website or application is protected by confirming it is running one of the latest supported versions of PHP. If you’re running a content management platform built in PHP, like Drupal or WordPress, you can look up the PHP version number in your site’s administrative interface:

• Drupal: by going to “Status Report” in the “Reports” menu.
• WordPress: by going to “Site Health” in the “Tools” menu, then clicking on “Info” and opening the “Server” section.

Your site should be running one of the following versions of PHP:

• 8.5.12 (or better)
• 8.4.27 (or better)
• 8.3.36 (or better)
• 8.2.35 (or better)

Keep in mind that updating Drupal or WordPress does not update the version of PHP running underneath it. PHP updates come from your server or hosting provider, and the server typically needs to be restarted before the patched version takes effect.

If you are running PHP version 8.1 or earlier, it is still possible that your site is protected, but you will need to confirm this with your hosting provider. The PHP team did not release official updates for these older versions; it published only minimal source code fixes that hosting providers must apply themselves.

Is it possible that my site was hacked before the patch was applied?

While some information about the PHP2Shell vulnerabilities was leaked in advance of the patch’s release and both Amazon and Cloudflare have reported early attempts to exploit them, there are currently no confirmed reports of any successful attacks before the patch was released.

Sites that use Cloudflare’s web application firewall (WAF) received protection more than 10 hours before the patch’s release, and as mentioned above, many hosting providers, including those who host our clients’ websites (Acquia, Pantheon, and Upsun), also applied temporary mitigations. The Drupal Association has posted information on how administrators can audit their sites to see if they were probed in the days leading up to the patch’s release.

How can I protect my site from future security vulnerabilities?

The best way to be sure that your site remains secure is to keep it up to date with the latest security releases. This includes not only server-level languages like PHP, but the applications that run on top of them like Drupal and WordPress.

We utilize automated security scanning to ensure that critical issues that impact your site’s content management platform are identified and addressed as quickly as possible. Our proactive approach anticipates potential issues instead of reacting to them, so you’re prepared when a new vulnerability is announced.

As an example, just one week before the release of PHP2Shell, a patch was released to address a critical vulnerability in Drupal’s core software. We made sure that all of our clients’ sites were up to date in advance of the patch’s release, applied mitigations within an hour of its release, and had all sites patched within three hours.

We also partner with hosting platforms like Acquia and Pantheon who are part of the Drupal Steward Program, which provides mitigation for critical Drupal security vulnerabilities in advance of their official release. In addition, these partners have long and well-established records of keeping their platforms secured from threats that occur outside the application layer.

Staying secure as AI changes the landscape

AI is speeding up security work on both sides. The same tools that uncover vulnerabilities are also helping maintainers, hosting partners, and teams like ours find and fix them faster. Staying secure in this environment comes down to steady habits: keeping every layer of your site current, working with hosting partners who mitigate threats early, and having people watching on your behalf.

If you’re a Palantir.net client, there’s nothing you need to do. Your sites are running patched versions of PHP, and our team continues to monitor for new issues. If you’re not a client and want help confirming your site is protected, or want to build a support plan that keeps you ready for the next disclosure, get in touch with us.

Cover illustration created using Google Gemini.

Major Drupal conferences can be difficult to attend for people with limited budgets or family commitments. Megan McDermott explains why regional events matter and how local sponsorship helps bring learning opportunities within reach.

How much should developers trust AI, and what changes will Drupal 12 demand of maintainers? Nine speakers share practical lessons on development, accessibility, infrastructure and governance ahead of Southwestern Ontario Drupal Camp.

Drupal dropdown menus: how to build them in Drupal 11 Jurriaan Fri, 10/23/2026 - 08:27

A dropdown menu in Drupal 11 always starts in the same place: the core menu system, where you nest links under a parent. What turns that structure into a dropdown is either your theme or a menu module. This post walks through both routes, shows what the result looks like on desktop and on a phone, and compares the menu modules that are maintained for Drupal 11 today.

The screenshots come from a Drupal 11.4 site with DXPR Theme 8.2.2, taken in October 2026; the module details come from drupal.org on 23 October 2026.

In short: build the menu under Structure, Menus, nest the links, and tick Show as expanded on every parent. A theme with dropdown support, such as Olivero (one dropdown level) or DXPR Theme (three levels, automatic columns), then renders the dropdowns. Add a module such as Superfish or The Better Mega Menu only when the theme cannot do what you need.

Let an AI agent build the menu. A menu is a list of links with a hierarchy, the kind of structured task a coding agent does well. With the Drush Webmaster skill, an agent creates and orders the menu links from a short brief, and with DXPR Theme's agent skill it sets the header layout and menu colors to match the brand. You review the result on the site.

1. Create the menu structure in Drupal core

Go to Structure, Menus, and edit the menu that sits in your header, usually Main navigation. Add the links with Add link, then drag each child under its parent so it indents one level, and press Save.

Next, edit every parent link and tick Show as expanded. Without it, Drupal only renders a parent's children on that parent's own page, so the dropdown stays empty everywhere else. To expand every parent at once, tick Expand all menu links in the settings of the menu block instead. For a parent that should only open its dropdown, enter <button> or <nolink> as the link instead of a page.

2. Let the theme render the dropdowns

Most current Drupal themes turn a nested menu into dropdowns on their own; how deep they go and how the dropdown looks differs per theme.

• Olivero, Drupal core's default front-end theme up to Drupal 11.4, places its main menu block with a depth of two: the top level plus one dropdown level, with a button next to each parent.
• DXPR Theme renders three levels. A dropdown with 8 or more links splits into columns, and from 15 links it spans the full width of the header, which gives you a mega menu without a module. On a mouse, dropdowns open on hover, and when any dropdown has a third level they open on click. Below the mobile breakpoint, 1200 pixels by default, the menu folds into a hamburger menu that expands each level in place. The mega menu guide covers every setting.

3. Or add a menu module

A module makes sense when the theme cannot render what you need, for example images or blocks inside the dropdown, or a separate off-canvas menu for phones. These are the maintained options for Drupal 11:

ModuleWhat it doesLatest stable releaseReported sites Superfish Dropdown MenuDropdowns from the jQuery Superfish plugin, with multi-column sub-menus and right-to-left support; needs the Superfish library in /libraries8.x-1.17, 16 Oct 2026, Drupal 9 to 1164,556 The Better Mega MenuAn admin interface for dropdowns that combine menu links with images, videos and blocks8.x-1.10, 28 Aug 2025, Drupal 8 to 1118,522 Responsive and off-canvas menuA horizontal menu on wide screens and an off-canvas menu on phones, through the mmenu library4.4.5, 4 Feb 2025, Drupal 9.3 to 1110,647 Drupal Mega MenuA drag-and-drop mega menu builder with layout styles and animations; minimally maintained8.x-1.17, 22 Sep 2026, Drupal 10.3 and 115,067 Simple Mega MenuFoundations for a mega menu you build yourself with Twig and content entities2.2.0, 9 Sep 2024, Drupal 10.3 and 111,655

To show only part of a menu elsewhere on the page, for example the children of the current section in a sidebar, core's menu blocks have Initial visibility level and Number of levels to display settings, and the Menu Block module adds options such as rooting the block at a specific menu item.

Which option should you pick?

• Links only, one dropdown level: core menus and your theme, nothing to install.
• Three levels, columns or a full-width mega menu, and a mobile menu: a theme that renders them, such as DXPR Theme, so the menu stays plain Drupal configuration.
• Images, videos or blocks inside the dropdown: The Better Mega Menu or Drupal Mega Menu. Each one adds its own configuration screen and markup to maintain.
• A dedicated off-canvas menu on phones: Responsive and off-canvas menu.

Questions about Drupal dropdown menus How do I make a dropdown menu in Drupal?

Nest the child links under their parent in Structure, Menus, save the menu, and tick Show as expanded on each parent link. A theme with dropdown support, such as Olivero or DXPR Theme, then shows the children as a dropdown. If your theme does not, add a module such as Superfish.

Why does my Drupal menu not show its dropdown?

Usually because the parent link does not have Show as expanded ticked, so Drupal only renders its children on the parent's own page. Ticking Expand all menu links in the menu block's settings fixes that for every parent at once. The other common cause is the block's Number of levels to display, which limits how deep the block renders; a value of 1 hides every dropdown.

Can a Drupal dropdown menu contain images or blocks?

Not with core menus alone: a core menu holds links. Mega menu modules such as The Better Mega Menu and Drupal Mega Menu let you place images, videos and blocks inside a dropdown. Many sites keep the menu to links and put that content on the landing pages the menu leads to, which is easier to maintain and to translate.

How do dropdown menus work on phones?

Responsive themes fold the menu behind a hamburger icon below a breakpoint and open each level on tap; DXPR Theme does this below 1200 pixels by default, and the breakpoint is a theme setting. For a separate off-canvas menu on phones, the Responsive and off-canvas menu module adds one through the mmenu library.

Can AI build my Drupal menu?

Yes. With the Drush Webmaster skill installed, a coding agent such as Claude Code creates, nests and orders menu links from a brief, and with DXPR Theme's agent skill it also sets the header layout and menu colors. A person reviews the result on the site before it goes live. See the DXPR agent skills.

A mega menu without a module.

DXPR Theme turns your Drupal menu into multi-level dropdowns, full-width mega menus and a mobile menu, styled from its settings. Try it in the live demo or read the step-by-step guide.

Try Live Demo Read the mega menu guide