http://sulu.io/blog01a0236b-1050-7028-ac98-2c8a9668d5a1Wed, 26 Aug 2026 08:23:34 +0000One password is a thin line of defence for an admin interface that can publish to every webspace you run.Sulu has supported two-factor authentication for a while, but in practice most teams stopped at the email method. It works, it is easy to explain to editors, and it depends on a mailbox that is often protected by exactly one password itself. Authenticator apps solve that. They work offline, they do not depend on the user's mailbox at all, and enterprise security policies ask for them by name.The pieces existed in the Symfony ecosystem. scheb/2fa-totp has been battle-tested for years, and Sulu already builds on that open source bundle. What was missing was the part nobody enjoys building, the guided setup inside the admin interface: show a QR code, verify a first code before anything is switched on, hand out backup codes, and give administrators a way to reset all of it when a phone is lost.That part now exists, and we did not write it.http://sulu.io/blog/two-factor-authentication-with-an-authenticator-app01a0205e-9fdb-7b64-a1a3-301226a0978aTue, 25 Aug 2026 18:11:07 +0000We have published two new patch releases: 2.6.26 and 3.0.9. Both branches gain two features: two-factor authentication with an authenticator app and AI disclosure information for media. Sulu 3.0.9 also adds Symfony 8 support, widens the columns for slugs and webspace keys, and fixes several routing and navigation issues.http://sulu.io/blog/sulu-releases-2-6-26-and-3-0-9019fffbd-ecf4-7a1c-95d0-db393294b4adWed, 19 Aug 2026 10:07:44 +0000For most of the last decade the CMS market moved in one direction: headless, composable, best-of-breed. Breaking systems apart gave us cleaner architectures and content that could finally live beyond a single website. It also gave us stacks that take a whole team to hold together. Every product in the stack is another integration to build, another contract to manage, and another dependency to maintain for years, and many teams are feeling that weight now.The market has noticed. Dan Drapeau, writing about DXP selection this year, calls it convergence: suite vendors have become more modular, headless platforms have expanded their native capabilities, and both sides are growing toward the middle. And on top of that, AI is changing how software gets built, and with it the math behind many of these decisions.So this is a good moment to ask where separation still pays off, and where it has just become a habit.Most of the industry discusses this as a purchasing question, composable versus suite. I think that framing is the problem. It describes how software is packaged and sold, and says nothing about what a team has to integrate, extend and keep running for the next five years. That second question is the one we live with every day, and it is worth asking whether separating concerns really requires separating every capability into another product.http://sulu.io/blog/are-cms-suites-coming-back019fdb98-5364-79c3-b71b-6dac02710968Wed, 12 Aug 2026 09:40:20 +0000We're excited to announce the first release of the Sulu MCP Bundle, available today on GitHub under the MIT license as 1.0.0-RC1. The bundle turns a Sulu 3.x installation into an MCP server, so AI assistants such as Claude, ChatGPT and Codex can work on your content directly instead of handing you text to paste into the admin.You know the routine it replaces. You draft in a chat window, copy the result into Sulu, repair the formatting, hunt for the right category, and upload the image by hand. With the bundle installed, that handover disappears.MCP, the Model Context Protocol, is an open standard for connecting assistants to external systems. Once you connect an assistant, it no longer has to guess how your content is structured. It can work with your webspaces, templates, pages, and media, and it does so within the permissions of the Sulu user who connected it.http://sulu.io/blog/sulu-mcp-bundle-let-ai-assistants-work-directly-inside-sulu019f7f4a-4d27-7e7c-b0da-c67e7dbb5504Thu, 06 Aug 2026 11:30:03 +0000A Developer's GuideThis is the third and final post in a three-part series on Intelligent Search. The first post made the case for why website search needs to change; the second explained how the system works. This one is the hands-on walkthrough.Intelligent Search brings AI-powered, cited question answering to your Sulu website. It combines semantic retrieval with a language model that answers exclusively from your published pages and articles. This guide focuses on the practical side: enabling the feature, indexing your content, seeing it in action, and extending it to fit your needs. By the end, you should feel confident enough to think: "I could set this up today."One practical note before you get started. Intelligent Search is currently available through a private onboarding program. We'll guide you through the setup, answer any questions, and help you get everything running smoothly. If you'd like to use Intelligent Search on your own site, schedule an onboarding session and we'll get you started.http://sulu.io/blog/setting-up-sulu-intelligent-search019fa91c-0cd9-7045-90e6-274b881a6d51Tue, 04 Aug 2026 14:23:35 +0000Sulu.ai 0.7 is here, and it's about one thing: visibility. As AI projects grow, so do the questions. Which experts are actually being used? Where do the credits go? What is actually happening inside a project? Until now, answering meant checking invoices or asking us. With 0.7, you no longer have to guess.Before AI assistants can become a trusted part of your content workflows, you need to see how they're already being used. That is the thread running through this release: 0.7 introduces Insights, a complete request history for every project. Alongside it, Intelligent Search becomes more flexible, translations improve through DeepL's latest model, and the platform gets faster and holds up better under load.http://sulu.io/blog/sulu-ai-0-7-see-what-your-projects-are-actually-doing019fae6e-51e7-7d92-872a-82e4c57d5094Thu, 30 Jul 2026 15:11:33 +0000On 2 August 2026, the transparency rules in Article 50 of the EU AI Act start to apply. If your team uses AI to write, translate, or generate images before you publish, this is the part of the law that reaches your desk. The good news, up front: most of what you already do is fine.Let me keep this practical. First, what is actually happening. Then what it means for you and your content team. And finally, because that is the only reason we are writing about a piece of legislation at all, what it means if you use Sulu.ai.A quick note before we start. We are not lawyers, and this is not legal advice. On 20 July 2026 the European Commission adopted detailed guidelines on how these rules work, and they remain the authoritative source for your own edge cases.http://sulu.io/blog/new-ai-transparency-rules-what-they-mean-for-content-teams-and-for-sulu-ai019f6a18-1f9c-7eb6-b734-b386f074cab7Tue, 28 Jul 2026 08:43:13 +0000Over the past couple of years, more than one company we've talked to has watched the open source software they built on quietly change its license. Same code, new terms, and suddenly a five-figure bill to explain to management. What stays with me is how fast the conversation turns from features to harder questions. Who owns this? How much control do we still have? Where does this leave us in five years?I've been thinking about that a lot. Partly because it sits next to a bigger shift in what companies are trying to build, where a website is no longer the whole job, but the starting point for something larger. And partly because it raises a fair question about us, too. We've spent this year evolving, adding products alongside our open source core, and more than one person has asked whether that's a sign of strength or a reaction to pressure. Honestly? It's both. I don't think that's a contradiction. Let me explain, because the answer runs right through what's happening in our market.http://sulu.io/blog/the-market-is-changing-and-so-are-we019efe28-8d9e-7199-b0a8-aabbf6b6c6e6Wed, 22 Jul 2026 09:42:11 +0000This is the second post in a three-part series on Intelligent Search. In the first article, we explained why website search needs to evolve from pages to answers. This post focuses on the technical side: how does Intelligent Search actually work? How does a published page become searchable, how does a visitor's question turn into a citation-backed answer, and what role do embeddings, vector databases, and Retrieval-Augmented Generation (RAG) play along the way?If you're evaluating Intelligent Search for a Sulu project, this guide explains the architecture and the core concepts behind it. I assume you know Symfony. I don't assume you know RAG or vector databases. I will explain those as we go.http://sulu.io/blog/from-pages-to-answers-how-sulus-intelligent-search-works019f6f6c-49e9-78a3-87c2-b075b45b1ee8Tue, 21 Jul 2026 09:33:15 +0000We have published two new patch releases: 2.6.25 and 3.0.8. Both close three security issues, so upgrading is worthwhile for every project on either branch. Sulu 2.6.25 also makes content inside global block sections findable again. Most of the remaining work landed in Sulu 3.0.8, which improves routing when pages are moved or copied, fixes a range of shadow and ghost locale issues, and makes content inside global blocks searchable again.http://sulu.io/blog/sulu-releases-2-6-25-and-3-0-8019eef66-a425-746e-a4f6-59d4af026e69Tue, 07 Jul 2026 12:55:41 +0000We're excited to announce stable Sulu 3.0 releases for six ecosystem bundles: Form, Headless, Community, Redirect, Automation and Comment. With these releases, the most widely used Sulu bundles are now compatible with the new content architecture introduced in Sulu 3.0. This architecture replaces the PHPCR storage layer with Doctrine ORM, the document manager with a dimensions-based content model, and MassiveSearch with the SEAL  search abstraction.A guiding goal of these releases was to stay as close to the 2.6 behaviour as possible, so existing projects can upgrade with minimal changes. Some breaking changes remain and are documented in each bundle's upgrade guide. A maintained 2.x line also stays available for projects still on Sulu 2.6.http://sulu.io/blog/six-sulu-bundles-released-for-3-0019ef9f2-0168-7c9b-8a6b-b05a7d417546Thu, 25 Jun 2026 14:04:07 +0000Most site search tools require visitors to think like the people who wrote the content. They type a keyword, you match it against your text, and if their word isn't your word, they get nothing useful. Synonyms break it, different phrasing breaks it, and increasingly people don't want a list of links at all. They want answers.The problem is that most websites were built for a different era. We invested years into pages, articles, product information, documentation, and knowledge bases. But when someone wants information, we still ask them to dig through that content by hand. Meanwhile, expectations have moved on. People ask ChatGPT a question in plain language and get a direct response, and they now expect the same from websites, customer portals, documentation, and knowledge bases.It's becoming clear that people want something better than a traditional search box. What that looks like is still an open question, though, because an AI model by itself isn't enough.http://sulu.io/blog/from-pages-to-answers-why-website-search-needs-to-change