This Month in TYPO3: September, 2026

Add documentation that now renders to Markdown and an MCP server that finally handles media, and October opens with plenty to build on.

• TYPO3 14.3.7 and 13.4.35 security releases published — Both LTS branches were patched on 8 September. No database upgrades are required, though running the database analyzer after updating is recommended.
• TYPO3-CORE-SA-2026-022: Information Disclosure via Backend Localization Wizard — TYPO3 CMS was found susceptible to information disclosure through the backend localization wizard (CVE-2026-77132). Fixed in 14.3.7 and 13.4.35.
• TYPO3-CORE-SA-2026-023: Missing Authorization in lowlevel commands — Low-level commands allowed unauthorized modification of system-wide configuration (CVE-2026-85400). Covered by the same releases, so one update closes both.
• TYPO3 10.4.60, 11.5.54, and 12.4.49 ELTS released — Same-day updates for installations still on older branches under TYPO3 GmbH's Extended Long Term Support.

No extension security advisories were published in September.

82 contributors and 315 reviews in September — 50 patch authors covering 17 features, 137 bugfixes, and 138 tasks, plus 8 documentation improvers and over 4,800 words translated in Crowdin. Reviews more than doubled from August's 148.

• The public Bug Bounty Program is discontinued — The 2026 budget is exhausted and a growing flood of low-severity, often AI-generated reports made the program unsustainable. Responsible disclosure, advisories, CVEs, and researcher credit all continue.
• Members funded four ideas in Round Three — €40,000 from 200 valid votes: Extbase documentation phase 2, FAIR protocol support in TER, visual backend permissions, and AI-ready search for EXT:index and EXT:seal. Work runs until 30 November.
• Rules for TYPO3 Units revised after public review — The review closed on 6 September. The Governance Working Group has since revised both the Unit Rules and the Unit Cooperation Panel rules, and expanded the FAQ.
• Board protocol, 2 September — The Board discussed feedback on the Unit Structure Proposal, finalizing the Conflict of Interest Policy review, new committees, and planning for the fourth Quarterly Summit in November.
• Board protocol, 16 September — Approved a partnership with EOSA and a statement on copyright liability for Core and extensions. An Extraordinary General Assembly is proposed for 29 October, with a Unit Kick-Off Day in November.
• Community Expansion Committee half-year report — Government partnerships advanced on three continents, the committee held its first in-person sprint in Madrid, and planning began for a TYPO3 camp in Africa.
• From blog to News Hub — The story behind merging the TYPO3 company blog and Association news into one News & Events Hub, with better navigation, sharing, and user experience.

• 8–9 October 2026 — Meet TYPO3 at Forum PHP, Chessy (Paris), France
• 13–15 October 2026 — Meet TYPO3 at Smart Country Convention, Berlin, Germany
• 15 October 2026 — Meet TYPO3 at Contao Summit, Leipzig, Germany
• 15–17 October 2026 — TYPO3 Camp Berlin, Berlin, Germany
• 19–22 October 2026 — TYPO3 Community Sprint October 2026, Düsseldorf, Germany
• 20–21 October 2026 — Meet TYPO3 at Open Source CMS 26 Conference, Utrecht, Netherlands
• 22 October 2026 — TYPO3 On-Site Certification Day, Düsseldorf, Germany
• 3–6 November 2026 — Meet TYPO3 at Boye Aarhus, Aarhus, Denmark
• 6–8 November 2026 — TYPO3 Camp RheinRuhr, Kamp-Lintfort, Germany

The most direct way to put your security know-how to work is the Security Team. The team reviews real vulnerability reports and coordinates fixes across Core and extensions — a hands-on education in web security. Find out how to join the TYPO3 Security Team.

• TYPO3 documentation now renders to Markdown — Every docs page is available as Markdown at a fraction of the size, ready to download or hand to automated tools. New JSON files also make the Core Changelog searchable by PHP class before a major upgrade.
• The MCP Server for TYPO3 now handles files — A delivered Community Budget project: AI assistants can upload images, embed videos, browse file storage, and place media on pages, with a review safety net before anything goes live.
• A fully open-source AI chatbot for TYPO3 — Eike Starkmann shows how a modern chatbot runs on open-source technology with a single TYPO3 extension and nothing more than a connection to an LLM — no external providers.
• Solr indexing on save with solr-eager-flush — Wolfgang Klinger's extension sends a saved record to Solr at the end of the same request instead of waiting for the Index Queue Worker. Bulk changes still go through the queue. Supports TYPO3 13.4 and 14.3.
• Disposable TYPO3 instances in one command — typo3quickstarter is a bash script that sets up DDEV with the right PHP version, installs TYPO3 via Composer, creates the database and admin user, and opens the backend. Ideal for comparing versions side by side.
• A new TYPO3 community takes shape in Burundi — Alina Fleser and Philippe Fekete of the Community Expansion Committee report from JuneTech, a five-day event for students, startups, and young entrepreneurs.
• The website builder is dead, long live content management — Mathias Bolt Lesniak argues that AI-made websites threaten builders, but give CMSs the chance to look beyond the website and rediscover why they matter.
• TYPO3 Camp Munich turned 19 — Martin Helmich, a regular since 2011, on why the barcamp still delights: over 100 people gathered on 12–13 September and built the program on the spot.
• Growing TYPO3 camps together — Fewer attendees and later sign-ups are squeezing events. Niklas Bruhn collects the best ideas from a Camp Munich roundtable on filling the next camp.
• Scaling from within — How 3m5. grew a 30-person TYPO3 business unit internally through mentoring, knowledge sharing, certifications, and employee participation.
• A 90-day playbook for agencies — Luisa Sofie Faßbender's closing talk from the first North American Summit, on turning TYPO3's enterprise strengths into new business.
• TYPO3 Contribution in Numbers: August 2026 — Published 1 September: 80 contributors and 148 reviews across Core in August, with the usual rundown of bug fixes and features.

Ran a session at a camp this month, wired an AI assistant into a TYPO3 backend, or finally wrote up the migration you keep meaning to share? Someone out there needs exactly that. Tell us your TYPO3 story and help it reach them.

Thanks to the Security Team for two coordinated Core fixes and a candid change of course, the Governance Working Group for working through every piece of Units feedback, the documentation team for Markdown rendering, and the organizers and travelers who kept camps and new communities growing.