This Month in TYPO3: May 2026

Certification task forces are sprinting toward their August v14 target, while community-funded tooling — from Fluid in VSCode to the SEAL ecosystem — crossed major milestones. Developer Days is on the horizon, and May's quiet progress will show up loudly.

• TYPO3 14.3.2 and 13.4.30 maintenance releases — Published 26 May, these routine stability updates cover both the v14 and v13 LTS lines. If you haven't patched yet, now is the moment.
• TYPO3 14.3.1 and 13.4.29 maintenance releases — An earlier maintenance round dropped 12 May. Two patch cycles in a single month signals active, attentive care across both supported branches.
• Remote Code Execution in Content Element Selector (ceselector) — TYPO3-EXT-SA-2026-013, published 19 May. RCE severity; affected installs should update immediately. No delay warranted.
• SQL Injection in Address List (tt_address) — TYPO3-EXT-SA-2026-012, 19 May. SQL injection in a widely used address and contact record extension. Patch as soon as possible.
• Multiple vulnerabilities in Faceted Search (ke_search) — TYPO3-EXT-SA-2026-011, 19 May. Three findings in one advisory: XML External Entity injection, Path Traversal, and Information Disclosure. Check your installations.
• SQL Injection in News system (news) — TYPO3-EXT-SA-2026-010, 19 May. SQL injection in one of the most widely deployed TYPO3 extensions. Treat as urgent.
• Broken Access Control in Frontend User Registration (sf_register) — TYPO3-EXT-SA-2026-009, 19 May. Access control bypass in the frontend registration extension. Update to the patched version.
• Remote Code Execution in Site Crawler (crawler) — TYPO3-EXT-SA-2026-008, 19 May. RCE in the crawler extension. High severity — prioritize this one alongside the ceselector advisory.

The May 2026 contributor roundup is forthcoming — expect it in early June. The April 2026 roundup (published 1 May) sets the baseline: 71 contributors, 47 patch authors, and 214 reviews during the month v14 LTS launched. May kept that momentum, with security coordination, two maintenance cycles, documentation updates, tooling releases, and multiple in-person certification sprints all happening in parallel.

• TYPO3 Compliance Officer Mandate announced — A structural gap left by the six-member 2026 Board election became an opportunity. Rachel Foucard takes on a dedicated Compliance Officer role outside the Board, covering ethical compliance, conflict-of-interest frameworks, mediation processes, and regulatory readiness including Cyber Resilience Act preparedness.
• SEAL ecosystem hits all three milestones — Tim Lochmüller's Q1/2026 Community Budget project is complete. Index 2.2.0, SEAL 1.1.0 (faceted search, geo radius search, dashboard analytics), and SEAL AI 1.0.0 (vector search with AI-synthesised result summaries at the top of page one) are all in the Extension Repository.
• Education Committee sprint in Lübeck, Germany — All four certification task forces met in April to coordinate the v14 update. Skill trees are being restructured, exam questions reviewed, and an AI-assisted approach is being piloted to flag questions that need revision. The release target is August, at Developer Days.
• TCCI Task Force sprints on the v14 syllabus — Six members of the Integrator Certification Task Force gathered in Filderstadt on 9–10 May, working through around 130 skills. TypoScript's share of the exam scope is shrinking in favour of Fluid and data processors — an honest reflection of where modern integrator practice actually sits.
• Bug Bounty Program scope narrows — Financial rewards for extension vulnerability reports end 31 May 2026. Extension reporting continues — the Security Team still reviews, coordinates with maintainers, and publishes advisories — but paid bounties now focus exclusively on Core, infrastructure, and server findings.

• 1–2 Jun 2026 — Neos Conference, Karlsruhe, Germany
• 4 Jun 2026 — TYPO3 On-Site Certification Day, Düsseldorf, Germany
• 5–7 Jun 2026 — TYPO3 Camp Vienna, Vienna, Austria
• 22–26 Jun 2026 — UN Open Source Week, New York, NY, USA
• 4–5 Aug 2026 — CMS Connect, Montréal, Canada
• 6–8 Aug 2026 — TYPO3 Developer Days, Karlsruhe, Germany
• 11–13 Sep 2026 — TYPO3 Camp München, Munich, Germany
• 15–16 Sep 2026 — TYPO3 University Days 2026, Erfurt, Germany
• 23–24 Sep 2026 — DMEXCO, Cologne, Germany
• 15–17 Oct 2026 — TYPO3 Camp Berlin, Berlin, Germany

• Fluid in VSCode is here — A first-party VSCode extension for Fluid templating is now available under the FriendsOfTYPO3 namespace. Syntax highlighting, ViewHelper snippets, and live template analysis powered by the actual Fluid engine — and it works with VSCodium, Cursor, and Windsurf too.
• Sitepackage tutorial updated for v14 — A community budget project delivered: the educational Sitepackage Extension and its full tutorial have been refreshed for TYPO3 v14 by Karsten Nowak for the Documentation Team. The standard onboarding path for new integrators is now current.
• The next wave of TYPO3 — Kendall Litton's reflection from TYPO3 Surf Camp in Fuerteventura: a younger generation of contributors is already here — reconnecting at events, submitting talks, and stepping into the community as peers, not just attendees. The call for papers at Developer Days is open.
• The agency operating model has a problem — A frank look at what's pressuring agencies right now: campaign validation, ROI measurement, stakeholder alignment, and AI disruption are straining assumptions that used to hold. Worth reading if you work with — or inside — a digital agency.

With v14 LTS just a month old, the TYPO3 v14 Release Materials hub is worth a bookmark: Official presentation slides, a downloadable fact sheet, backend screenshots, and pixel-art graphics ready for your own channels — all collected in one place for anyone making the case for v14 to a client or stakeholder.

Shipped a v14 migration, built a tool the community would benefit from, or mentored someone new to TYPO3? Stories like those are exactly what this series is made for — submit yours through the community form and it could appear right here next month.

A genuine thank-you to the people who kept May moving: the Security Team for coordinating six advisories and a policy change in a single week; the TCCI and Education Committee volunteers who gave days to sprint on certification content for v14; Karsten Nowak and the Documentation Team for delivering the updated sitepackage tutorial; Simon Praetorius for shipping the Fluid VSCode extension; and Tim Lochmüller for completing all three SEAL milestones. Volunteer effort, community funded — that's what TYPO3 runs on.