PHP 8.6 turns on strict mode, httponly and SameSite=Lax by default. For a Drupal box that's a non-event for web traffic — Drupal forces all three. The real exposure is CLI scripts and SSO flows. Test, don't assume.
Between 23 Sep and 7 Oct 2026, four Drupal contrib modules got advisories for the same bug class — user strings evaluated as Twig. Plus the 14 Oct core release window, and the fifteen-minute audit I ran on my own VPS.
Opening Craft's Plugin Store and seeing a price on the field type you need is a values-level culture shock for a Drupal dev used to free GPL contrib. How the money works (20% cut, one-time + annual renewal), why the paid model is a feature disguised as a tax (maintenance funded by self-interest, not goodwill), and the real lock-in: 'we stopped paying' and 'we stopped getting security updates' are the same sentence.
The thing that made Craft feel different from Drupal wasn't a missing feature — it was a missing screen. There's no Views UI; you fetch content by writing element queries (a fluent Twig/PHP API) or hitting Craft's free first-party GraphQL. For a developer that's mostly better — all in code, all reviewable. For the site builder who shipped listings without a developer, it's a real loss worth naming.
The tidy story is 'Gin replaces Claro as Drupal's admin theme.' The reality that landed in core is a merge, not a swap: a new experimental 'Admin' theme (Gin was built on Claro, so the codebases had to be reconciled), shipped ~3 months late and alpha, with Claro still the default. What it means for gin_toolbar, and why 'default in Drupal 12' is likely-not-guaranteed.
Picking up a Craft CMS backend as a Drupal veteran, the first thing I looked for was config management. Craft's project config solves the same problem with a gentler philosophy — the database stays the runtime source of truth and you can rebuild the YAML from it. Gentler is mostly good, and a drift trap if you skip allowAdminChanges=false. A working comparison.
Drupal taught me to juggle nodes, paragraphs, blocks and media — four entity types with four APIs. Craft 5 collapsed almost all of it into one primitive: everything is an entry, and Matrix blocks are just nested entries. The conceptual economy is real. What a Drupal dev gains (nesting that just works) and gives up (Views, SQL-shaped reporting).
The tidy 'Rules is stuck, use ECA' story is out of date — Rules shipped a stable 4.0.1 in Feb 2026. But it already lost, and why says something honest about 'no-code': ECA models are version-controlled YAML you can't actually review in a diff, can't breakpoint, can't unit-test. Where ECA is the right tool, and where a 30-line event subscriber wins.
Every time() and new \DateTime() buried in your logic is a hidden dependency on the one thing you can't pause — and it's why your time-sensitive tests are flaky. Inject Drupal's TimeInterface (already there) or Symfony's Clock (freeze and advance instantly in tests). Where Drupal's built-in falls short, and the discipline that makes 'what happens at midnight?' a test you can actually run.
Project Browser hit stable: browse contrib and click 'Add and Install', no Composer, no terminal. But it needs a web-writable codebase and is local-dev-only — and that limitation isn't unfinished, it's a security decision in disguise (a writable codebase is exactly what production hosts forbid). Why the catch is the most reassuring part.
