EmDash won't beat WordPress. Drupal just needs to wait.
Cloudflare announced a "WordPress killer" called EmDash. It's a TypeScript rebuild of WordPress: Astro under the hood, serverless-first, AI agents doing most of the construction over two months.
Headline architectural decision: the plugin sandbox. Plugins run in an isolated Worker with explicitly declared capabilities, like OAuth scopes. No more plugins silently owning the database and filesystem. Cloudflare claims this prevents 96% of WordPress vulnerabilities. It probably also prevents a lot of what made WordPress flexible.
Matt Mullenweg responded quickly: "You can come after our users, but please don't claim to be our spiritual successor without understanding our spirit." The spirit he's defending (run it anywhere, democratize publishing, genuine openness). It's also a defense that's gotten harder to make while he's been pulling the WordPress governance structure toward himself over the past year.
What makes EmDash interesting even for those of us not building with it: It doesn't need to win. It just needs WordPress' community cohesion to keep eroding enough that developer energy stops routing into the plugin and theme ecosystem. Some of that energy is already moving toward Ghost, Payload, Astro-native setups. The moat narrows.
EmDash doesn't yet ship a visual block editor, and that's a gap. It's both an intended and unintended one. Gutenberg stores content as serialized HTML in a single database field rather than structured data: a problem with a long history. EmDash gets the storage right with structured JSON content schemas but ships without the editor. Gutenberg has the editor, not the architecture. Neither has both yet.
Drupal quietly did the unglamorous modernization work. Composer, Drupal 10 and 11, decoupled architecture, rebuilt credibility in enterprise. Drupal CMS 2.0, just out this January, adds visual building, AI integration, and site templates. Everyone wrote it off as too hard for normal people. That was always right.
There's a parallel worth watching: Drupal CMS orbits Acquia the way WordPress.org orbits Automattic. The same structural tension. But Drupal's ecosystem modernized alongside its commercial layer; WordPress's plugin economy didn't. One alliance produced a fracture. The other hasn't yet.
Drupal doesn't need a fork to work with modern stacks.
I started using Drupal in 2008, took a long hiatus, and coming back it's interesting to see how it's made itself a core part of the CMS world — but not the whole thing.
I had no idea Movable Type was still around!