Draft roundup for the week of 30 June 2026. The commentary below is drafted in your voice, edit or overwrite freely before publishing.
Core & releases
Drupal 11.4.0 landed on 1 July, a little behind schedule. The release managers' time had gone to back-to-back security releases. The headline change: drupal/core-recommended no longer pins minor versions of dependencies like Guzzle, Twig and the Symfony polyfills, so those can take security updates without waiting for a whole new core release. (TheDropTimes)
About time. Pinning Guzzle and Twig to the patch level meant a single dependency CVE could hold all of core hostage until the next release window. Unpinning it is the sane move, and it has already saved me a core update this week.
Security
Five core advisories dropped on 17 June, across Drupal 10 and 11: a critical PHP object injection (SA-CORE-2026-005), a gadget chain, a cache-poisoning and open-redirect pair, an SSRF, and an improper-validation issue. Fixed in 10.5.12, 10.6.11, 11.2.14 and 11.3.12. A second batch on 1 July covered the Colorbox, FlowDrop and Drupal Canvas contrib projects. (Drupal security)
Five in one drop looks alarming, but the number that actually matters is how many sites will sit unpatched for months. I have spent this week dragging an estate of end-of-life Drupal 8 and 9 sites back toward current, and the ones that bite are always the ones nobody has touched since launch day. Patching is the cheapest insurance you will ever buy.
Drupal CMS
Drupal CMS 2.1.0 brings first-class site templates, free and premium, with a refactored installer that now opens on a template picker complete with screenshots and descriptions. (Drupal.org)
This is either the thing that finally fixes Drupal's first ten minutes, or the first step toward the theme-shop economy we spent years avoiding. I am cautiously in favour. The out-of-the-box experience has needed the help for a long time, and a good starting point beats a blank Bartik any day.
The stack: PHP
PHP 8.5 is now the current release (8.5.6), and the standout addition is the pipe operator |>, which lets you chain calls left to right instead of nesting them inside-out. PHP 8.4's active support runs to the end of 2026. (php.net)
I moved everything to 8.4 this week and stopped there on purpose, 8.5 is barely warm and I like my production PHP boring. But the pipe operator is the first new syntax in a while I genuinely want. Reading a transform forwards instead of unpicking it from the inside out is worth more than it sounds.
Community & events
Drupal Zurich meets on 9 July on agentic CMS and AI workflows; the Splash Awards 2026 deadline moved to 16 July; and DrupalCon Rotterdam runs 28 September to 1 October. (TheDropTimes)
Every meetup agenda this year has "agentic" somewhere on it, and I am not entirely sure we have agreed what it means yet. Rotterdam at the end of September, though, is real and worth the trip. Might see you there.
Compiled from the week's Drupal and PHP news; sources linked inline.