"Hackers automate but the Drupal Community still downloads updates [...]"
summary
Claims that most Drupal sites still update manually: 59% still download modules from drupal.org, with 24% using the Update UI and 22% using Composer. Notes attackers start exploitation within four hours and tens of thousands of sites remain unpatched after months. Describes a proof-of-concept updater model that reads core update info, creates jobs, uses processor plugins that integrate with GitHub/Bitbucket and trigger CI builds, then deploys to staging and production — fully automated end-to-end.
AI-written summary · about
chapters (7)
- 0:00Intro
- 1:00Maintenance and support
- 1:55Personas
- 3:07Update behavior
- 4:08Security perspective
- 5:58The reality
- 12:05The strategy
related talks
01h 04mImproving your Drupal 8 development workflow
21mKeepers of the Machines: Examining How System Administrators Manage Software Updates
05mSecurity, Availability, and Multiple Information Sources: Exploring Update Behavior
47mTrust, Community, and Automatic Updates
38mAutomate or Stagnate: Surviving the Era of Continuous Updates
42mSecurity in Drupal: what can go wrong?
46mHow to hack a node app?
33mThe Anatomy of a Hack 24 Hours in the DevSecOps ER