TheDropTimes: If Knowledge Belongs to Everyone, Why Does It Cost So Much?

If Knowledge Belongs to Everyone, Why Does It Cost So Much?

Editor's Pick | Vol. 4 | Issue. 44

Opening access is only the first step. Sustaining the people, institutions and infrastructure that keep knowledge available is the greater challenge.

Behind every published research paper lies years of work, often supported by public funding. Yet the institutions producing that knowledge do not necessarily control how it reaches the world. New research released by SPARC on 14 October, ahead of International Open Access Week, estimates that more than 95% of investment in a typical research article occurs before publisher submission, based on its accounting model. A companion study found operating margins of 24% to 38% among major academic publishers in 2025. The figures raise an uncomfortable question: who should benefit from knowledge that society has largely paid to create?

Removing paywalls is important, but it does not automatically make scholarly publishing fair or sustainable. Some open-access models shift costs from readers to researchers through publication fees, potentially excluding scholars with fewer resources. Alternatives exist. Harvard Library, for instance, supports journals that charge neither authors nor readers. Such models still require institutional investment, editorial labour and dependable technology. The real challenge is not simply making research available, but ensuring that openness does not depend on another form of exclusion.

The same challenge extends to the infrastructure behind public knowledge. A 14 October appeal from SCOSS sought renewed funding for the Research Data Alliance and Software Heritage, noting that insufficient funding had delayed some planned standards work. Open-source communities understand these pressures. Drupal, for example, supports complex institutional publishing environments, including a UK university platform managing more than 190,000 research records. Maintaining such systems requires continuing work on security, accessibility, data management and technical reliability. The software may be open, but the responsibility of sustaining it remains substantial.

Perhaps the most important lesson from this year's Open Access Week is that openness needs a long-term commitment, not just a declaration of principle. Universities, governments and other institutions should treat shared digital infrastructure as an essential public investment, with predictable funding, accountable governance and support for the people maintaining it. The open-source movement has demonstrated what communities can build together. Its continuing challenge is ensuring that those contributions remain useful and accessible for generations. Knowledge should belong to everyone, but keeping it that way must also become everyone's responsibility.

Follow The DropTimes on LinkedIn and Bluesky, or join #thedroptimes on Drupal Slack.

Kazima Abbas wrote and curated this issue of Editor’s Pick.

On the Limits of Drupal Orchestration and Shared Infrastructure

Jürgen Haas discusses the direction of Drupal orchestration and the case for shared infrastructure. He examines workflow engines, cross-system failure, data contracts, AI permissions and user experience. His answers raise practical questions about what Drupal should control and who will maintain the common foundations.

Drupal 12 Upgrade Guide: Release Date, Requirements and Removed Modules

Drupal 12 is in beta ahead of its target stable release in December 2026, and security support for Drupal 10 ends on 9 December 2026. The 12.0.0 alpha and beta releases set a minimum platform of PHP 8.5, Symfony 8.1 and PHPUnit 12.5, drop database updates from before Drupal 11.3.0, and move nine core modules and three themes to contributed projects. Site owners on Drupal 11 can check readiness today with Upgrade Status, PHPStan Drupal and Drupal Rector, and should require contributed replacements with Composer before upgrading rather than uninstalling removed core extensions.

Pantheon P1 Brings AI Agents to Web Building Without Replacing Drupal

Pantheon introduced P1 at its GoLive conference in Miami on 6 October 2026 and opened a limited paid beta. The platform lets people and AI agents build and review websites using approved components and shared release workflows. Drupal sites can continue managing their structured content while P1 handles the presentation and release of connected web experiences.

Southwestern Ontario Drupal Camp 2026 Tackles AI Trust and Drupal 12 Readiness

Southwestern Ontario Drupal Camp takes place on 23 and 24 October 2026 in Kitchener-Waterloo, Canada. Nine speakers shared insights with The DropTimes about artificial intelligence, accessibility, cloud infrastructure, Drupal CMS and module modernisation. The event combines technical presentations with practical training and opportunities to contribute to Drupal.

DrupalCamp Italy 2026 Speakers Preview AI Migrations, Civic Platforms and Enterprise Security

DrupalCamp Italy 2026 takes place in Bologna on 22 October, with six speakers sharing original insights with The Drop Times ahead of the event. Their experiences cover public-sector platforms, AI-assisted migrations, enterprise security, decoupled architecture and content editing. The accounts offer practical lessons for developers, architects, site builders and editorial teams working with Drupal.

Bringing Drupal Learning Closer to Home: Southwestern Ontario Drupal Camp 2026

Southwestern Ontario Drupal Camp returns to Kitchener-Waterloo, Canada, on 23 and 24 October 2026. Its expanded programme includes an AI keynote, Drupal in a Day training and contribution time, with sponsorship keeping admission free. Organiser Megan McDermott says regional events help students and professionals access learning opportunities without the travel costs associated with larger conferences.

Drupal Association Audits Drupal.org After PHP2Shell Fixes

The Drupal Association says Drupal.org has received the PHP security fixes and is undergoing a retrospective infrastructure audit. Amazon detected attempts to exploit PHP2Shell before the vulnerabilities were publicly disclosed, while new guidance identifies records worth examining. Drupal site operators are being urged to preserve evidence and investigate suspicious activity rather than relying on patch status alone.

Drupal Issues 34 Contrib Security Advisories, Including Highly Critical RCE

The Drupal Security Team published 34 contributed-project security advisories on 21 October 2026. The vulnerabilities include remote code execution, authentication failures, cross-site scripting and restricted-file exposure across 31 projects. Administrators need project-specific fixes while also checking compatibility ahead of Drupal 12.

Jürgen Haas Proposes Charter-First Approach to Drupal Federation

Drupal contributor Jürgen Haas has proposed a charter-first approach to the International Drupal Federation. His plan would establish the organisation's governance and responsibilities before prospective members consider joining and paying fees. The proposal contributes to an existing community discussion and has not been formally adopted.

Independent Audit Verifies Three Accessibility Fixes in Convivial for GovCMS

IncluD has independently verified three accessibility fixes in Morpht's Convivial for GovCMS starter site. Its follow-up assessment found no outstanding issues or warnings across 52 audited pages. The findings highlight why Drupal teams must continue checking components and editorial content as websites evolve.

Drupal CMS Speeds Up Prototyping, but Delivery Still Depends on More

Pamela Barone built a working Drupal CMS prototype in a two-hour period using Canvas and Mercury. Projects by Tojio and Mars with JAKALA offer a wider perspective on reusable components: they can accelerate implementation, but design, integration and stakeholder decisions still determine delivery.

Dries Buytaert Demonstrates Drupal Tool Reuse Across AI, APIs and Workflows

Dries Buytaert has documented how his Drupal photo module reuses tool and data descriptions across several interfaces. Tool API supports AI and workflow calls, while custom code connects the same definitions to OpenAPI and Drupal components. The Rosetta initiative seeks a broader approach that module maintainers could share.

Drupal AI Disclosure Beta Adds Spoken Audio Notices and Video Labels

The AI Disclosure module for Drupal now supports spoken declarations for qualifying AI-generated audio alongside video labelling. Its October beta release can prepare audio files with audible notices and produce video copies with visible disclosure icons. The functionality gives Drupal publishers additional transparency tools while leaving legal classification and compliance decisions with site operators.

FlowDrop 2.7 Adds In-Editor Workflow Testing and Execution Fixes

FlowDrop released three stable updates on 17 and 18 October 2026. The releases introduce testing inside the workflow editor and address problems with cancellation, resumed execution and operator responses. Drupal teams using FlowDrop should also review database updates, chat configuration and integration compatibility before upgrading.

Mercury Editor 3 Reaches Stable Release With Autosave, Undo and Component Navigation

Mercury Editor 3 reached its first stable release on 14 October 2026. The updated visual page builder adds autosaving, undo and redo controls, and an outline for navigating components. Drupal teams using Paragraphs-based layouts now have a stable upgrade option, with dependencies and customisations to review.

Symfony 8.2 to Add Declarative Controller Locking With #[Lock] Attribute

Symfony has announced a new controller locking feature for its upcoming 8.2 release. The feature automatically manages locks and can reject conflicting requests or make them wait. Drupal already has its own locking API, but using this Symfony feature would require additional integration.