119 posts tagged with "WordPress"

Google made per-request inference meaningfully cheaper, three webapp exploit classes from the mid-2010s showed up again in production software, and the PHP ecosystem started admitting out loud that it cannot sustain its own patch cadence. A useful week if you pay attention to the right parts.

Pantheon Content Publisher shipped to general availability after months of pre-release messaging since October 2025. The AI-assistive capabilities target content acceleration and quality — two words that marketing departments love combining and operations teams learn to distrust. For CMS teams evaluating this, the question worth asking is whether the controls keep up with the speed, or whether you're just publishing mistakes faster.

GraphQL for Drupal 5.0.0-beta2 (tagged on February 19, 2026) is a meaningful beta step: it fixes a cacheability metadata gap in current:user query results and adds node preview URL support in route-based entity resolution.

A new public code search service now targets Drupal contrib projects compatible with Drupal 10+, with a UI at search.drupal-api.dev and an API at api.tresbien.tech. For maintainers and upgrade teams, this is immediately useful: you can query real contrib code patterns before writing migrations, patches, or architecture decisions.

One missing cache tag can quietly force expensive rebuilds on every request. A February 2026 report described exactly that pattern behind a 4.2-second Drupal product page.

As of February 27, 2026, WordPress 7.0 Beta 2 (released February 26, 2026) is in active testing ahead of the planned final release on April 9, 2026. I reviewed what can break for custom plugins and themes, and built a minimal checklist to reduce upgrade risk.

February 2026 felt like the month where everyone agreed AI coding is "real now," then immediately discovered the bill: secrets sprawl, shaky governance, fragile tests, and communities trying to stay relevant without becoming AI-themed marketing departments.

I reviewed Drupal advisories SA-CONTRIB-2026-011 through SA-CONTRIB-2026-019 (published on 2026-02-25) and mapped them against active drupal-* projects. Nine advisories, nine modules, one triage session.

WordPress 6.9 added assertEqualHTML(), which removes a whole category of brittle test failures caused by formatting-only HTML differences. I reviewed the implementation and mapped out concrete migration patterns for plugin and theme test suites.

If your test suite has ever failed because of a whitespace difference in rendered HTML, this is for you.

Wordfence's February 9-15, 2026 report is a reminder that WordPress security is not a reading hobby. It is an operations loop. Sites that treat it like newsletter content are volunteering for downtime.

Use WarpBuild runners for the compute-heavy parts of your DDEV Drupal pipeline, keep cache keys deterministic, and gate rollout by p95 runtime and failure-rate SLOs. This gives you faster CI without turning your pipeline into a probabilistic black box. I verified this playbook against DDEV v1.25.1 (released February 23, 2026) and WarpBuild docs as of February 25, 2026.

If you maintain a Drupal 10/11 contrib module, the biggest security misses are still predictable: missing access checks, weak route protection, unsafe output, and incomplete release hygiene. The fastest hardening path is to enforce explicit access decisions, protect state-changing routes with CSRF requirements, ban unsafe rendering patterns, and ship every release with a repeatable security gate.

Cloudflare viNext is the fastest path today to run modern Next.js apps on Workers with less adapter glue. But the safe adoption pattern is not "AI rewrites everything." The practical pattern is AI for scoped transforms, deterministic checks for every change set, and a canary rollback plan.

That combination gives speed without losing production stability.

Drupal does not need more hot takes; it needs a cleaner signal path so you can see what changed, what might break, and what to do next before release day punches you in the face.

SearXNG in Drupal AI assistants matters because it gives you controllable, inspectable retrieval without funneling your org's prompts and context into yet another black-box "trust us" API.

As of February 24, 2026, WordPress 7.0 is in Beta 1 (released February 20, 2026), and the post editor is planned to run inside an iframe regardless of block apiVersion. If your plugin still depends on top-window DOM selectors, legacy block registration, or unflagged classic meta boxes, this is the migration window to fix compatibility before the planned 7.0 release on April 9, 2026.

WordPress 7.0 Beta 1 is here, and it is not an incremental update. The two big moves are real-time collaboration and native AI integration via the Abilities API. Whether that makes WordPress "an intelligent workspace" or just a more complicated CMS depends entirely on the execution.

I dug into the developer-facing features. Some are genuinely good. Some need caveats.

Agentic AI moves fast. A few lines of code, a powerful LLM, and suddenly an agent is doing something that looks impressive. The rapid iteration is addictive, but it leads to a development style I call "vibe coding" -- tweak a prompt, rerun, and if the output feels right, ship it.

This works for a demo. It is a recipe for disaster in production.

DDEV v1.25.0 fundamentally improves how we share work in progress. The new modular share provider system with Cloudflare Tunnel as the default is the best developer experience improvement in DDEV in years. Zero config, zero accounts, zero friction.

I have been using it daily since the release, and the old ngrok workflow feels ancient.

Dries Buytaert has introduced "Drupal Digests," a new initiative that uses AI to summarize development activity across Drupal Core, Drupal CMS, Canvas, and the AI Initiative. This is one of the most practical uses of AI in open-source project management I have seen.

Instead of building AI into Drupal, this is using AI to make the Drupal project more navigable. Smart move.