This Month in TYPO3: October, 2026

With the first Unit members meeting this month, November starts with real momentum.

• TYPO3-PSA-2026-001: PHP update required for all installations — Two critical PHP vulnerabilities mean every TYPO3 site should update PHP right away. TYPO3 itself is not affected, so no TYPO3 update is needed, but your hosting stack is.
• TYPO3 14.3.9 security release published — A security release for the v14 LTS line, published on 13 October alongside the core advisory below. Teams on 14.3 should update promptly.
• TYPO3-CORE-SA-2026-024: Security Misconfiguration in Form Framework — The Form Framework could ignore the configured upload storage. This was the only core advisory of the month.
• Nine TYPO3 extension advisories on 20 October — One batch from the Security Team covered extensions for cookie consent, forms, file management, shops, analytics, and AI integration. Issues range from SQL Injection to Broken Access Control, so check your installed extensions against the list.
• TYPO3 14.3.8 and 13.4.36 maintenance releases — Regular bugfix releases for both LTS lines, published on 9 October. A routine but worthwhile update for anyone running v14 or v13 in production.
• TYPO3 10.4.61, 11.5.55, and 12.4.50 ELTS released — The same day, TYPO3 GmbH shipped updates for all three Extended Long Term Support lines, keeping older installations patched while upgrades are planned.
• TYPO3 14.3.10, 13.4.37, 12.4.51, 11.5.56 and 10.4.62 maintenance releases — Maintenance releases across five branches that update third-party dependencies with security advisories, including svg-sanitize and several Symfony components. No database upgrades needed.
• TYPO3 v11.5 ELTS renewal reminder for year three — Still on v11.5? ELTS year three runs through October 2027, and the renewal deadline was 1 November 2026, so check your subscription status now.

The October edition of TYPO3 Contribution in Numbers has not been published yet and will follow in the coming days. The month's visible work already tells a story: a fresh Extbase documentation chapter, Best Practices Team sprint reports, a composer.json-native Extension Repository, and new community-funded extensions.

• Association members approve a new governance structure — 204 of 272 votes (75%) backed the bylaw amendments, which take effect immediately. Units and a Unit Cooperation Panel now own the TYPO3 product, and Board and BCC members are limited to two re-elections.
• Members called to vote on the new governance structure — The proposal that set up the 21–29 October online vote, explaining how Units give TYPO3 CMS its own governance alongside the Board and the Business Control Committee.
• Board Meeting Protocol (30 September 2026) — Proposed term limits, preparations for the online by-law vote and General Assembly, and lessons from open source events in North America topped the agenda.
• TYPO3 Association joins the European Open Source Academy's Partner Program — Funded by the Community Expansion Committee and starting 1 November, the partnership opens joint work on open source policy, skill transfer, and local business models across Europe.
• Apply to the TYPO3 Surf Camp 2027 — A week of projects, mentorship, and surf lessons in Porto for young TYPO3 professionals. Applications close on 30 November 2026.

• 3–5 November 2026 — Boye Aarhus, Aarhus, Denmark
• 6–8 November 2026 — TYPO3 Camp RheinRuhr, Kamp-Lintfort, Germany
• 11–12 November 2026 — CloudFest Americas, Miami, USA
• 12 November 2026 — Digital Commons Policy Summit, Brussels, Belgium
• 12–14 November 2026 — CMS Conf, Gdynia, Poland
• 23–25 November 2026 — German-African Business Summit (GABS), Accra, Ghana
• 2–4 December 2026 — TYPO3 Camp Africa, Diani Beach, Kenya
• 19–20 January 2027 — CMS Kickoff, St. Petersburg, USA
• 29 January 2027 — EU Open Source Policy Summit, Brussels, Belgium
• 13–20 March 2027 — T3BOARD27, Canazei, Italy

With the bylaws freshly amended, it helps to know where the source of truth sits. The by-laws, Code of Conduct, decision-making process, and team policies are all maintained together, so browse the TYPO3 Policy Directory before your next governance discussion.

• Open source contribution as an agency investment — How contributing to TYPO3 helps agencies build expertise, attract and retain talent, and create business value that lasts.
• Best Practices Remote Code Sprint: August 2026 — Oliver Klee reports on the team's 3 August sprint, focused on TYPO3 14 LTS compatibility for the Tea example extension.
• Meet the TYPO3 Dev Companion — A small, local, read-only server that gives coding agents version-bound TYPO3 knowledge, answers from your own installation, and step-by-step workflows.
• TYPO3 Camp Africa comes to Kenya — The Community Expansion Committee invites government digital leaders and developers to Diani Beach in December. Registration is open, with 60 places.
• Extbase and translations: the full picture — Anja Leichsenring presents the first chapter from the second round of community-funded Extbase documentation work.
• The Extension Repository speaks composer.json — TER now accepts composer.json as an extension's only manifest, and for v14.3+ versions it publishes the exact archive the author uploaded.
• api.typo3.org now links classes to the docs and changelog — Each API entry now lists every place in the official documentation and Core Changelog that mentions it. ConnectionPool, for example, points to 69 TYPO3 Explained pages and 10 changelog entries.
• Typed Content Models for TYPO3 — Funded by the community budget, the Content Models extension gives developers a structured way to work with pages, content elements, and other records.
• The Great Content Rescue — Kai Unterberg of KM2 shows how automated migration rescued 50,000 fragmented content elements on Gerresheimer's website, a talk from the TYPO3 North America Summit.
• Notes from DrupalCon Rotterdam 2026 — Mathias Bolt Lesniak spent three days with Drupal's European community and found that its biggest worry is one TYPO3 shares.
• Optimizing AI search and GEO for TYPO3 websites — Beat Köck and Frank Nägler explain how sites can stay visible in AI-generated answers through GEO, content quality, and strong brand signals.
• Notes from Kirby Konf 2026 — Martin Helmich at the first Kirby CMS conference, where a designer-heavy crowd offered fresh takes on AI, sustainability, and community.
• What's new in DDEV for TYPO3 folks: October 2026 — This month is all about databases: seeded snapshots, a database per branch, and faster throwaway instances, several built by TYPO3 community members.
• Relaunch Redirects finds broken URLs before go-live — A new extension checks old URLs on staging, flags future 404s, proposes redirects, and can stop a deployment when old links would fail.
• How toujou turns enterprise sites into a repeatable pattern — Viviane Gebelein shows how Rotkäppchen-Mumm launched 40+ brand websites in two and a half years with TYPO3.
• Forum PHP 2026 in Disneyland Paris — The French TYPO3 committee returns for a third year with a booth and a talk on the Cyber Resilience Act, in a tough year for the event.
• Notes from Contao Summit 2026 — Martin Helmich spoke about AI and content management in Leipzig and found a fellow CMS community wrestling with a familiar question: who pays?

Did you lead a relaunch with a redirect plan that actually held, wire a coding agent into your TYPO3 workflow, or run your first user group meetup this autumn? Others want to learn from it. Tell us your TYPO3 story and we may feature it next month.

Thank you to the Security Team and extension maintainers who coordinated a large advisory batch, the release managers who kept five branches patched, the governance volunteers who saw the bylaws through, and everyone writing docs, building tooling, and representing TYPO3 at events across the world.