7 min read
PHP2Shell: patch PHP now, then assume your secrets leaked
CVE-2026-109618 / CVE-2026-109619: unauthenticated RCE in PHP itself. Fixed versions, why updating Drupal or WordPress does nothing, and what to rotate.
Read more →#drupal
5 min read
Drupal AI is production-ready. Its AI agents are not.
The Drupal AI module has 23,475 installs and security team coverage. The AI agents everyone is excited about ship with "do not use this in production".
Read more →4 min read
Drupal 12 ships December 7. Upgrade to Drupal 11.5 instead.
Drupal 12 lands December 7, Drupal 10 dies December 9. Why PHP 8.5, the modules leaving core and contrib lag make 11.5 the right place to land.
Read more →4 min read
Search API Solr at 5 million users: custom datasource and tracker
Indexing 5 million users in Solr breaks the default Search API setup. A custom datasource, a watermark tracker, and the role-transition bug nobody handles.
Read more →3 min read
Drupal 10 end of life (Dec 9, 2026): your six-month plan
Drupal 10 support ends December 9, 2026. What EOL really means, what Drupal 11 requires, and a month-by-month plan to upgrade without a Q4 panic.
Read more →4 min read
Drupal 11.4 blocks search query URLs in robots.txt: what to check
Drupal 11.4 (July 2026) adds Disallow rules for /search? query URLs and halves database queries. Exact rules, who must act manually, and how to verify.
Read more →4 min read
Why your Drupal admin is slow — an Admin Toolbar maintainer’s guide
Editors complaining the back office crawls? The real causes of slow Drupal admin pages, ranked and fixed — by a co-maintainer of the Admin Toolbar module.
Read more →3 min read
Migrating from Drupal 10 to Drupal 11: the practical guide
Drupal 10 reaches end of support in December 2026. A complete checklist for a calm move to Drupal 11: audit, deprecations, contrib modules, delivery.
Read more →4 min read
Rebuilding my 2016 Drupal site with Astro 7: field notes
Why a senior Drupal developer rebuilt his site as static Astro 7: fonts, JSON-LD graphs, hreflang, OG images, Cloudflare — the SEO-first recipe.
Read more →3 min read
Headless, partially decoupled or monolithic Drupal: how to choose
Full headless, progressively decoupled or classic Twig? A decision framework from someone running a Drupal 10 + Symfony front architecture in production.
Read more →3 min read
Drupal security updates: a maintainer’s playbook
How Drupal security releases really work and the update routine I apply to client sites — from a maintainer of 24 modules who has shipped fixes under embargo.
Read more →3 min read
Web accessibility: what WCAG really asks of a Drupal developer
WCAG, the European Accessibility Act and France’s RGAA: real obligations and concrete Drupal practices — from a developer applying W3C standards daily.
Read more →3 min read
Core Web Vitals on Drupal: diagnosis and fixes that work
LCP, INP, CLS: where Drupal loses points and how to win them back — caching, images, fonts, JavaScript. A complete diagnostic method with ranked fixes.
Read more →