Planning a DNN to Drupal migration? See how Drupal helps government agencies meet WCAG 2.1 AA, Section 508, and ADA Title II rules with stronger web governance.

Date: 2026-October-21Description: 

PHP has announced a critical PHP security release for Wednesday, October 21, 2026, at 14:00 UTC. We recommend that all Drupal site owners reserve time to ensure their PHP version is updated as soon as the release is available.

Site owners are responsible for maintaining the security of their hosting platform

It is the policy of the Drupal Security Team that site owners are responsible for monitoring and maintaining the security of third-party libraries and any non-Drupal components of the application and hosting platform. In rare cases, the Drupal Security Team will post an informational public service announcement (PSA) such as this one, but the remit of the Drupal Security Team remains limited to code hosted on Drupal.org’s systems. Previous PSAs on third-party code in the Drupal ecosystem include:

• External libraries and plugins - PSA-2011-002
• Various Third-Party Vulnerabilities - PSA-2019-09-04
• Third-Party Libraries and Supply Chains - PSA-2024-06-26
• Third-Party Libraries and Supply Chains - PSA-2025-09-17

This post is likely to be updated as the situation evolves and more information is available.

Coordinated By: 

• Lee Rowlands (larowlan) of the Drupal Security Team
• James Gilliland (neclimdul) of the Drupal Security Team
• Angie Byron (webchick) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

On 21 October 2026, as scheduled, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. Every PHP installation that serves web requests is in scope: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP security team rates both 9.2 out of 10 (CVSS v4.0) and considers the risk highest for mod_php, where a demonstrated exploit runs before any application code.

In practice, anyone who can reach your site like an ordinary visitor, with no account or password, could run their own commands on your server: read the database, steal passwords and API keys, change pages or install malware. The bugs sit in PHP, the language Drupal and WordPress run on, so updating Drupal or WordPress will not help. PHP runs 69% of websites whose server-side language W3Techs can identify, and the researchers demonstrated attacks against Drupal, WordPress and Joomla. They say temporary web firewall rules do not replace the PHP update.

If a host or developer runs your site, ask them today whether PHP has been updated. At Tag1 we have been updating client servers all day, and we made sure Drupal.org, whose infrastructure we manage, is patched.

What to do now

If a host or developer runs your server, start with them. Ask which PHP version is running and when PHP was restarted, then use the checks below.

Otherwise, update PHP. This is the only complete fix. I would patch mod_php servers first; where no patched build exists yet, use the stopgaps below. As of 18:25 UTC on 21 October:

• Ubuntu has published USN-8948-1 for 22.04, 24.04, 26.04 and 26.10, and USN-8948-2 for 14.04 to 20.04 through Ubuntu Pro.
• Debian has published DSA-6574-1 for trixie and, through Debian LTS, DLA-4848-1 for bookworm.
• Docker Hub has fixed images for all four branches on the main architectures, and latest now points at them. Pull fresh and rebuild; running containers keep the old PHP.
• The Remi repository carries the fixed releases for Enterprise Linux 9 (for example 8.4.27).
• Ondřej Surý's deb.sury.org repository is publishing the fix for every branch from 5.6 to 8.5, amd64 first. The ppa:ondrej/php PPA has the fix for every branch on amd64 for Ubuntu 22.04 and 24.04, but some arm64 and ppc64el builds were still pending, so check that apt installed a new PHP package.

Then restart PHP. After the update, restart Apache (for mod_php), PHP-FPM and any long-running PHP processes.

To confirm, check the version your site reports: Drupal shows it on its status report and WordPress under Tools > Site Health > Info > Server. Builds from php.net show the new number. Distribution packages often keep the old one: Ubuntu 24.04's fixed package is 8.3.6-0ubuntu0.24.04.13, yet the site still reports 8.3.6. There, check the installed PHP packages (for example dpkg -l | grep php) against your distribution's notice, or ask whoever runs the server to.

If you run PHP 8.1 or older, plan the upgrade. The PHP project no longer releases those versions, but its security team published minimal source backports for 7.4, 8.0 and 8.1 for people who build PHP themselves. deb.sury.org, listed above, packages the fix for 5.6 through 8.1. When you do upgrade, skip 8.2: it reaches end of life on 31 December 2026.

If you cannot update today

The PHP project's advisory lists stopgaps that reduce exposure to specific attack paths. They are a bridge to the update, not a fix. Restart every PHP worker after applying them:

• Set session.upload_progress.enabled=0 in php.ini, the FPM pool or the Apache configuration. Do not rely on ini_set() or FPM .user.ini files.
• Set memory_limit=-1 with php_admin_value so applications cannot override it, and put a container or cgroup memory limit in its place. This blocks only one route to CVE-2026-109618. Do not use RLIMIT_AS or RLIMIT_DATA for the replacement limit.
• Cap post_max_size at 8M if you accept no uploads, or 32M if you do, and keep upload_max_filesize below it.
• On PHP 8.5, also set fatal_error_backtraces=0.

After you patch

Patching does not tell you whether anyone got in first. The researchers list signs to look for, such as oversized PHPSESSID cookies, memory limit errors after multipart requests, and unexplained worker crashes. They add that none of these proves or rules out an attack. I would also look for PHP files in the web root that you did not deploy, and for new cron jobs and accounts. Because CVE-2026-109619 can leak process memory even if the attacker never gains code execution, I would rotate the database password and API keys on any internet-facing server that ran an affected version.

Thank you to the PHP security team, who shipped fixes for four branches and backports for three unsupported versions. The status list above is a snapshot from 18:25 UTC on 21 October, so check the linked sources for anything newer.

PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026. They fix CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell", two vulnerabilities that can let a single unauthenticated request run code on a server. According to PHP's security advisory, every PHP installation that serves web requests is at risk.

TL;DR:

• If you use DDEV only for local development, your DDEV projects aren't affected.
• Update PHP on the servers where your sites are hosted.
• If you use DDEV for casual hosting or ddev share, get the fixed PHP into those projects now, as described below, or upgrade to DDEV v1.25.5, which we hope to release on October 22.

What It Means for Your DDEV Projects

Local development isn't affected because a DDEV project listens only on your own computer, so nobody on the internet can send it a request. A project is exposed in two cases:

• Casual hosting runs a public site with DDEV. An attack would run code in the project's web container rather than on the host, but that container can still change the site's files and reach its database.
• ddev share puts a project on a public URL. Don't share a project until it has the fixed PHP.

:::warning[Update PHP where your sites are hosted] Your production servers are exposed to the internet, so update PHP there first; distributions and LTS vendors got the patches in advance. PHP 8.1 and older get no updates from the PHP project, so check with your vendor or upgrade. If you can't update right away, see Reducing Exposure below. :::

Getting the Fixed PHP Into DDEV Before v1.25.5

DDEV gets PHP from deb.sury.org. When we checked around 16:00 UTC on October 21, it had fixed packages for PHP 5.6 through 8.5 for Intel and AMD processors (AMD64), which run the vast majority of the world's web servers, most Windows and Linux computers, and Intel Macs. The builds for ARM processors (ARM64), such as Apple Silicon Macs (M1 and later), come later, and v1.25.5 waits for them.

On Intel and AMD computers, you don't have to wait for v1.25.5:

• PHP 5.6 through 8.1 aren't in the ddev-webserver image. DDEV installs them when it builds the project's web image, so a rebuild installs the fixed packages. The version number doesn't change for these old versions, so check that ddev php -v shows built: Oct 21 2026 or later:

  ddev restart --no-cache # or: ddev utility rebuild ddev php -v

• PHP 8.2 through 8.5 are in the image. Create this file in the project, rebuild, and check that ddev php -v shows 8.5.12, 8.4.27, 8.3.36, or 8.2.35:

  # .ddev/web-build/Dockerfile.php2shell # Safe to keep; you can delete it after upgrading to DDEV v1.25.5 RUN (apt-get update || true) && apt-get install -y --only-upgrade 'php*' ddev restart --no-cache # or: ddev utility rebuild ddev php -v

We tested both cases on DDEV v1.25.4 on an Intel computer, with and without use_hardened_images. On Apple Silicon Macs (M1 and later) and other ARM computers, wait for deb.sury.org's ARM64 builds or for v1.25.5.

Reducing Exposure Until You Can Update

PHP's advisory lists settings that block the attack paths it knows about. They don't make an installation safe, and a low post_max_size can break large uploads, so update as soon as you can. In a DDEV project, put them in a file and run ddev restart:

; .ddev/php/php2shell.ini ; Delete this file once PHP is updated session.upload_progress.enabled = 0 ; Use 32M if the site takes file uploads post_max_size = 8M upload_max_filesize = 6M

On PHP 8.5, also add fatal_error_backtraces = 0. DDEV adds .ddev/php files to PHP-FPM's configuration, so they apply before PHP parses a request, as the advisory requires. On other servers, the same lines go in php.ini or PHP's conf.d directory, followed by a restart of every PHP worker. The advisory has the full list.

Thanks, Ondřej

Ondřej Surý, who maintains the PHP packages for Debian and Ubuntu that DDEV and much of the PHP world use, published fixed packages for Intel and AMD processors for every version back to PHP 5.6 on the day PHP released the fixes, with ARM builds to follow. If your work depends on those packages, consider sponsoring him.

We'll update this post when DDEV v1.25.5 is out. If you have questions, reach out in any of the support channels.

This article was edited and refined with assistance from Claude Code.

A common interface cannot settle every question about responsibility. Jürgen Haas examines the choices beneath Drupal’s orchestration ambitions.

This post is adapted from the DA Insider, the Drupal Association's monthly newsletter. Subscribe here to get it in your inbox each month.

A note from our CTO

The Drupal Association team is incredibly grateful to have spent time with our community at DrupalCon Rotterdam. Dries Buytaert made one thing clear: Drupal is light-years ahead of its reputation. Our keynotes proved it, and stories from brands like Mars and World Cancer Day showcased Drupal's global power and ability to scale for good, both with cutting edge page building and AI integrations.

We were thrilled to celebrate our International Splash award winners, and the winners of the Women in Drupal award. It's our mission moving forward to expand our recognition for Makers, Patrons, and Advocates across the Drupal ecosystem, and to share Drupal's story beyond our own community.

Thank you to every attendee, speaker, sponsor, volunteer, and contributor who made Rotterdam absolutely unforgettable. We're excited to share what's next.

Tim Lehnen, CTO

DrupalCon Rotterdam Was Everything & More!

This year's event welcomed 876 participants across 46 countries for four days of sessions, summits, workshops, and contribution activities at the Postillion Hotel & Convention Centre WTC Rotterdam.

The Driesnote was remarkable. Key highlights included the launch of the Drupal Advocacy Program, which awards contribution credit for writing, recording, and sharing about Drupal; the announcement of the Rosetta Sprint, aimed at making Drupal's capabilities readable by AI agents, systems, and humans alike; and a new public AI demo site showcasing Drupal's growing AI capabilities — watch the six demos here.

Dries also introduced the concept of Stewarded Open Source, positioning Drupal as the ideal platform for Europe's push for digital sovereignty. Read the full Driesnote recap here.

International Splash Awards

The International Splash Awards 2026 celebrated outstanding Drupal projects from across the globe, with a 40% increase in submissions this year. Congratulations to all the winners and runner-ups.

Women in Drupal Awards

The Women in Drupal Awards, now in their fifth year, recognized three outstanding contributors: Antonella Severo, Nikita Aswani and Rachel Lawson. Congratulations to all three for their remarkable contributions to the Drupal community.

A huge thank you to every attendee, speaker, sponsor, volunteer and contributor who made DrupalCon Rotterdam unforgettable. Relive the memories through the official photo pool from the event.

The Drupal community doesn't stop. Next stop: Orlando (March 22-25) and Edinburgh (October 25-28) in 2027! See you there!

Introducing the Drupal Advocacy Program

Drupal is light-years ahead of its reputation. We can change that together.

We've launched the Drupal Advocacy Program: a new Drupal Association pilot that awards contribution credit for content that helps the world discover modern Drupal.

Write a blog post for your market. Record a demo. Speak at a non-Drupal event. Translate a case study for your language. Appear on a podcast. Even boosting someone else's talk or story counts.

Throughout the year, we'll roll out themes with ready-made messaging and proof points for you to make your own — and themed content earns 2x–3x credits.

The Engineering Team Had A Busy DrupalCon.

The Drupal Association engineering team was just on-site at DrupalCon Rotterdam, presenting the latest updates and working with the community in the contrib room on everything from the future of Drupal.org, to reducing friction with our GitLab contribution tools.

One of the major highlights of DrupalCon was the release of a brand-new Drupal AI demo experience. This new demo showcases the incredible breadth and depth of AI capabilities in Drupal, including page building capabilities and extremely powerful tools for context and governance.

If you attended Rotterdam but missed the session, keep an eye out in your inbox for a link to the private playlist. For the public at large, the DrupalCon session recordings will be available to everyone after a 30 day embargo from the end of the event.

Get Involved With DrupalCon Orlando 2027 Speak

The Drupal community thrives on the knowledge and experiences its members bring to the stage. Submit your session proposal for DrupalCon Orlando 2027 and share your expertise with the global Drupal community. The Call for Speakers closes October 20, 2026.

Register

Early Bird registration is open, register by January 30, 2027 to save on your ticket. Consider adding a Summit or training to connect with industry peers and deepen your Drupal knowledge.

Sponsor

A variety of sponsorship packages are available, from exhibitor booths and high-visibility branding to smaller events like the Business Leaders Dinner, Summits, and training. Explore sponsorship opportunities and find your right fit.

Volunteer

Want to give back to the Drupal community while making DrupalCon Orlando 2027 an unforgettable experience? Volunteer applications are open for a new set of committees. Explore volunteer opportunities. Apply by October 30, 2026.

Attend

If you need financial assistance to attend DrupalCon Orlando 2027, this is your chance! The Inclusion and Community Scholarships are now open. Apply by October 30, 2026.

Participate

Can't make it to a Drupal event? You can still enter the Mascot Contest featuring an alligator. Be it a plushy, a photo, or a friend in a gator costume! If you prefer to stay off social media, let us know and we’ll post it anonymously for you.

This roundup is adapted from the DA Insider, the Drupal Association's monthly newsletter. Want it in your inbox? Subscribe to email communications and browse previous editions.

Why It’s vital to upgrade, and how to easily move to D11 hassle-free Better a little bit of time & money for an efficient solution, than a lot of time & money for a big problem . Your Drupal site may be one unpatched vulnerability away from trouble. Drupal 7, 8 & 9 no longer receive security updates, and end-of-life for Drupal 10 is around the corner this December. Here’s why it matters. If your site goes unsupported: There aren't community-supported updates for any new vulnerabilities that may come up There aren't community-supported updates for most contrib modules While your site may still be running and your visitors keep browsing, the gap between "working" and "protected" widens Your content, your user data, and your organization's reputation are at risk An unpatched website can become an audit finding in security and compliance reviews The longer you wait to address it, the bigger (and more expensive) the upgrade job becomes. The good news? Fixing it doesn't have to be a long

An AI-generated image can reach a Drupal site with a digital signature attached, and leave it with another one. Three modules sit in between, and each does one job. Here I follow them one by one on a real image, the cover of this article made with ChatGPT, and I say what held up on my test site and where it broke. What an AI image carries and how AI Disclosure, the module I created on drupal.org within the Drupal AI Initiative, labels it is covered in the article on metadata and labels for AI images. Content Credentials reads: it opens the signature of the files an editor uploads and, if it says the file was made with AI, proposes the grade in AI Disclosure. AI Disclosure declares: it keeps the grade the editor confirms, shows the label to readers where the law asks for it and writes the metadata into the copies.

Charter first, price tag later: thoughts on a Drupal Federation Photo by Annie Spratt on Unsplash Jürgen Haas Tue 20 Oct 2026 - 12:50

In May 2025, the Drupal Association proposed an International Drupal Federation under Belgian law. It could unlock European public funding, give Drupal's assets a neutral legal home, and reduce dependence on a single legal system. At its public board meeting in Rotterdam, the DA said it supports the idea but won't drive it. Somebody else has to pull the strings. Jürgen, watching from the outside, sees one trap: every stakeholder starting with "what's in it for us?" and "how much is it?". He suggests two phases. First, write a charter that defines the Federation's objectives, responsibilities, decision-making, legal framework, membership and conflict resolution, with everyone's own stakes left out. Then let each prospective member decide whether to join.

Build a reliable local Drupal environment with DDEV. Follow the steps to start a new site, import an existing project, and export the code, database, and uploaded files needed to recreate it elsewhere.

Working with AI, developer Brandon Thomas says he has recreated seven Adobe applications as open-source alternatives through ArtCraft. His pitch promises familiar tools without subscriptions, with code people can inspect, modify and keep. For users frustrated by proprietary terms, the attraction is a credible alternative they can make their own.

Credibility takes time to establish. PhotoCraft’s documentation describes an early alpha that is not yet a Photoshop replacement for daily professional work. Its future usefulness will depend on continuing improvements, compatibility and support, alongside the freedom its licence provides.

Drupal founder Dries Buytaert explains that distinction in his essay on licence-only and stewarded open source. Both are open source, but stewardship adds an ongoing commitment to the software and the people who depend on it. Maintainers fix failures, coordinate releases and respond to security issues, while organisations help fund the infrastructure and continuity that adoption requires.

Drupal illustrates why that continuing care matters. Its community and supporting organisations sustain a shared platform that users can retain while choosing different providers to host, extend or support it. The opportunity for new AI-built alternatives is to develop comparable continuity around their code. Established projects, including Drupal, must keep demonstrating that their stewardship delivers dependable software and meaningful choice.

A plausible outcome is more freely available alternatives, with lasting adoption concentrated around projects that sustain that care. Proprietary vendors may respond through better services or greater dependence on hosted features, while open projects can offer independence backed by accountable maintenance. Funding security, compatibility, documentation and long-term support would help make those alternatives viable. The strongest challenge to proprietary control could come from communities that give people both the freedom to leave and confidence in what comes next.

Follow The DropTimes on LinkedIn and Bluesky, or join #thedroptimes on Drupal Slack.

Allen Jason wrote and curated this issue of Editor’s Pick.

Website teams can generate new pages faster than they can govern them. Pantheon's P1 beta tests a different approach to sharing that responsibility.

The image above shows me holding a plant that represents a small piece of code or an idea I want to share with someone else. To me, sharing code feels like planting something in someone else's garden. The analogy of open-source code and projects as plants and gardens appeals to me because plants are organic and essential to sustaining life, and the gardens we plant require significant planning and care. Open-source contributions come in all shapes and sizes, like gardens and the plants they hold, and both need maintenance. Some gardens require more maintenance than others.

My past two posts/tales focused on building and maintaining a Drupal module using AI, and now I want to discuss contributing to a module using AI. To continue my garden analogy, the projects I maintain are like my personal gardens.

Personal garden

By building and maintaining a Drupal module, I have control over my personal garden, but it exists within a community of gardens. I can decide which code/plants stay or go. Ultimately, I am responsible for the health of the project/garden. My project/garden is part of the Drupal gardens community (pun/irony intended). I am hyper-aware of the Drupal community where my Drupal garden lives.

Early on, when I took over building and maintaining the Webform module, I realized I was responsible for more than code; I was responsible for the entire experience of building Webforms for site builders and for supporting the module's extensibility for developers. To assist site builders and developers, I continually created videos and code examples as I built out the module. My blog explored and shared all aspects of the Webform module, including Read More

An AI-generated video that looks real has to be declared to the people watching it, and on a site the declaration has to be both on the page and inside the file. Here I follow how AI Disclosure, the module I created on drupal.org within the Drupal AI Initiative, does it. Images have an article of their own, and so does audio. A video needs a label when it is a deep fake: when it credibly shows a person, a place, an object or an event that exists or could exist, and whoever watches it would take it as real. A synthetic avatar presenting a company's results falls within it, if the viewer mistakes it for a real person. A cartoon or a clearly fictional video keeps the label in a lighter form, next to the video rather than on it. The obligation falls on the publisher, under Article 50(4) of the AI Act, and it applies from 2 August 2026.

As we work with our consulting clients on site-builds, we are often asked to include modules related to newsletters and analytics. Sometimes, our clients don't fully understand the ramifications of adding external scripts to their sites, so we end up having a larger data privacy discussion. In most cases, we recommend to our clients that they limit external embeds and scripts on their site mainly in the interest of user privacy. We figured it was about time that we took a closer look at our own site. With that in mind, we recently made the decision to remove most 3rd-party embeds and tracking scripts from this site with a few exceptions: Our Mautic marketing automation system (which we self-host and completely control.) Termageddon (affiliate link) content for our Terms of Service and Privacy Policy pages. Embedded YouTube videos. We have removed: All embedded EventBrite forms (which we haven't used in a very long time!) All references to Mailchimp (again, we haven't used it in a long

Six hats off to DrupalCon Rotterdam

Most of the year my six hats take turns. At DrupalCon they all show up at once, and I end up wearing a "hat tower". Rotterdam last month was an absolute whirlwind again, and I came home tired but buzzing with energy. Here is the view from under each hat.

Gábor Hojtsy Sat, 10/17/2026 - 18:02

There’s an incredible amount of things happening in the world of Drupal and AI. It’s very exciting, but almost impossible to keep up with. I’d been planning for a while to seriously dive into agentic coding. I feel a little late to the party, but at the same time, I get the impression that many organizations haven’t got the faintest idea that this revolution is happening.

Until now, I’d mainly been experimenting with frontier models like ChatGPT and Claude through their AI chat interfaces. But I’ve finally found the time to take the plunge into agentic coding myself.

At my day job, we recently had a client who wanted to bring us a project but had to persuade a large group of stakeholders. I was able to create a functioning version of the site they described in less than 2 hours.

BigCommerce is a SaaS platform that has earned its reputation with B2B sellers. Its B2B Edition handles selling with quotes, its catalog supports far more product options than most SaaS platforms, and its open APIs make it friendlier to integrations than many of its competitors. If your business fits neatly inside its walls, it's a legitimate choice. Many distributors and manufacturers have found success on the platform.

The trouble starts when your requirements don't match the platform's assumptions. Its best B2B features sit behind the top-tier plan. Gross Merchandise Value (GMV) caps force automatic upgrades as you grow. A new fee introduced in June 2026 charges a percentage on orders processed through non-embedded gateways, including offline payments like purchase orders. And when your order workflows, product types, or integrations go beyond what the platform anticipated, you're forced to work around BigCommerce rather than with it.

Drupal Commerce is an open-source alternative built on Drupal. You own the code and the data, there are no license or transaction fees, and every part of the platform, from checkout to order workflows to the product data model, can be shaped to fit how your company already works.

Read more

Today we are talking about the UN, Open Source, and Drupal with guests Tim Lehnen & Henry Poole. We'll also cover Live Update as our module of the week.

For show notes visit: https://www.talkingDrupal.com/574

Topics

• What Is UN Open Source Week
• Why Open Source Fits UN Goals
• Who Attends and What Tech Is There
• Conference Audience and DPI DPG
• Drupal as a Digital Public Good
• UN Uses Drupal at Scale
• Why Attend and What to Gain
• Upstream First Contracting
• Open Procurement Curriculum
• Reaching Procurement Conferences
• Steering Spend Upstream
• Funding Open Source Legally
• Talking Louder Beyond Drupal
• Digital Sovereignty Explained
• Governance Values Matter
• Fixing Funding Perception
• Community Next Steps Closing

Resources

• Appalachia
• Omar Mohsine
• Digital public infrastructure - DPI
• Digital public good - DPG
• ShareIT act
  • Agencies need to use open source
  • PDF: https://www.govinfo.gov/content/pkg/COMPS-17951/pdf/COMPS-17951.pdf
• Ditap
• NCMA
• Sovereign tech agency
• Palantir blog
• Eva black - Four opens
• FSF - Four freedoms
• Drupal's open web manifesto
  • https://www.drupal.org/association/open-web-manifesto
  • https://openwebsitealliance.org/charter.html#open-web-manifesto

Guests

Henry Poole - civicactions.com henry-poole Tim Lehnen - drupal.org hestenet

Hosts

Nic Laflin - nLighteneddevelopment.com nicxvan John Picozzi - epam.com johnpicozzi Tim Sharp - tea-sharp

MOTW Correspondent

Martin Anderson-Clutz - mandclu.com mandclu

• Brief description:
  • Have you ever wanted parts of your Drupal pages, like blocks, views, or notifications, to update in real time without a page refresh, and without having to stand up extra infrastructure to do it? There's a module for that.
• Module name/project name:
  • Live Update
• Brief history
  • How old: created in Sep 2026 by Alessandro Feijó (afeijo) of Mindcore
  • Versions available: 1.0.0-alpha6, which works with Drupal 11 and 12
• Maintainership
  • Actively maintained, latest release just a week ago
  • No security coverage yet, since it was just created and only has alpha releases
  • Test coverage
  • Documentation: a detailed README, plus a roadmap doc and a built-in demo page
  • Number of open issues: none
• Usage stats:
  • 14 sites
• Module features and usage
  • Live Update positions itself as a generic real-time event layer for Drupal: modules publish events to named channels, and browsers subscribed to those channels update just the affected part of the page
  • Out of the box it uses plain HTTP polling back to Drupal, every 5 seconds by default, so it works on pretty much any host with no extra services
  • The transport is pluggable, though. Set it to automatic and it'll try WebSockets first, then an experimental Server-Sent Events submodule, then fall back to polling
  • For site builders, the base module adds an "Update this block live" checkbox to any block in the block layout, no code needed
  • There's also a whole suite of submodules: live-refreshing Views displays, single-entity updates, user presence blocks like "who's viewing this page", a notification bell with toasts, queue progress monitoring, remote JSON API tables, and an admin dashboard with an event monitor
  • One I think editorial teams will like: Live Update Form, which warns you when someone else is editing the same content you are
  • For developers, publishing is one line, a liveupdate_publish() helper or an injectable service, and on the front end you can either use data attributes in your markup or subscribe through a small JavaScript API
  • Every channel is access-controlled, and modules can weigh in on who's allowed to subscribe through by implementing hook_liveupdate_channel_access()
  • Under the hood, events are stored in their own database table with an optional time-to-live, and expired ones get cleaned up on cron. Polling clients just ask for anything newer than the last event ID they saw
  • There's a solid set of Drush commands too, including one to publish a test event straight from the command line, which is handy for debugging
  • Caveat: this is very new and still alpha, so I'd treat it as one to watch and experiment with rather than deploy into production today
  • And if polling isn't enough for you, there's a companion project, Live Update Go: https://www.drupal.org/project/liveupdate_go
  • It's the push transport Live Update is designed around. A small Drupal module, plus a standalone gateway written in Go that gives browsers a native WebSocket connection
  • Drupal stays in charge: it checks channel access, hands the browser a short-lived signed token, and sends signed events to the gateway, which fans them out to connected clients
  • You run the gateway as its own service, with systemd or Docker, behind a TLS reverse proxy. The README is very clear that you shouldn't try to launch it from PHP
  • It can scale horizontally using Redis or Valkey pub/sub, one gateway can serve multiple Drupal sites with isolated tenants, and if it ever goes down, Live Update falls back automatically and switches back once it recovers
  • Same maintainer, created at the start of October, and also alpha, with an alpha1 release and one reported site so far