--- title: TYPO3 9.5.6 and 8.7.25 security releases published url: "https://news.typo3.com/article/typo3-956-and-8725-security-releases-published" description: The TYPO3 Community announces the versions 9.5.6 LTS and 8.7.25 LTS of the TYPO3 Enterprise Content Management System. image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Developer & Technology" - "Product Updates & Roadmap" --- # TYPO3 9.5.6 and 8.7.25 security releases published - [Developer & Technology](https://news.typo3.com/article/category/developer-technology) - [Product Updates & Roadmap](https://news.typo3.com/article/category/product-updates-roadmap) TYPO3 9.5.6 and 8.7.25 security releases published ================================================== 07 May 2019 The TYPO3 Community announces the versions 9.5.6 LTS and 8.7.25 LTS of the TYPO3 Enterprise Content Management System. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/860e9e538aa963a3600a2488dff48070.jpeg)[Benni Mack](https://news.typo3.com/article/author/benni-mack) We are announcing the release of the following TYPO3 updates: - TYPO3 9.5.6 LTS - TYPO3 8.7.25 LTS All versions are security releases and contain important security fixes - read the corresponding Security Advisories here: - [TYPO3-CORE-SA-2019-009: Information Disclosure in Page Tree](https://typo3.org/security/advisory/typo3-core-sa-2019-009/) - [TYPO3-CORE-SA-2019-010: Information Disclosure in User Authentication](https://typo3.org/security/advisory/typo3-core-sa-2019-010/) - [TYPO3-CORE-SA-2019-011: Security Misconfiguration in User Session Handling](https://typo3.org/security/advisory/typo3-core-sa-2019-011/) - [TYPO3-CORE-SA-2019-012: Possible Arbitrary Code Execution in Image Processing](https://typo3.org/security/advisory/typo3-core-sa-2019-012/) - [TYPO3-CORE-SA-2019-013: Cross-Site Scripting in Fluid Engine](https://typo3.org/security/advisory/typo3-core-sa-2019-013/) - [TYPO3-PSA-2019-004: Cross-Site Scripting in jQuery before 3.4.0](https://typo3.org/security/advisory/typo3-psa-2019-004/) - [TYPO3-PSA-2019-005: Cross-Site Scripting in Bootstrap CSS toolkit before 3.4.1 and 4.3.0](https://typo3.org/security/advisory/typo3-psa-2019-005/) - [TYPO3-PSA-2019-006: Security Misconfiguration since TYPO3 9.4.0](https://typo3.org/security/advisory/typo3-psa-2019-006/) - [TYPO3-PSA-2019-007: By-passing protection of Phar Stream Wrapper Interceptor](https://typo3.org/security/advisory/typo3-psa-2019-007/) - [TYPO3-PSA-2019-008: By-passing protection of Phar Stream Wrapper Interceptor](https://typo3.org/security/advisory/typo3-psa-2019-008/) ### Important note regarding security updates Some security fixes can be considered as breaking changes in order to apply strong security defaults. Please read the security bulletins carefully - manual adjustments concerning backward compatibility are described there as well. ### Important non-security related changes TYPO3 v9.5.6 LTS contains some note-worthy changes that site administrators and extension authors should be aware of: 1. [Enhanced options for language fallback of content renderings](https://docs.typo3.org/typo3cms/extensions/core/latest/Changelog/9.5.x/Feature-86762-EnhancedFallbackModesForTranslatedContent.html) This feature allows to configure streamlined language fallbacks more diverse to allow proper fallback of language configurations for e.g. Swiss-German to German. New options within the Site Module and for the site configuration file are available. 2. [Additional hook for generating slugs via Extensions](https://docs.typo3.org/typo3cms/extensions/core/latest/Changelog/9.5.x/Feature-88198-TCA-basedSlugModifiersForExtensions.html) This feature allows extension authors to modify generated URL Segments ("slug") for customizing stored URLs for pages/records depending on e.g. the current pagetree, or when a page is within a Storage Folder. 3. [Streamlined FAL Search functionality](https://docs.typo3.org/typo3cms/extensions/core/latest/Changelog/9.5.x/Feature-87610-New-FAL-API-to-search-for-files.html) A new FAL API allows to also search through files properly and their metadata, which has been incorporated within the FileList Backend module already. #### Page is being generated functionality removed Thanks to a combined effort of Benjamin Franzke, Helmut Hummel and Markus Klein, the infamous "Page is being generated" message functionality has been removed in both TYPO3 v9.5.6 and TYPO3 v8.7.25. Page-locking of concurrent requests creating the page has been heavily [improved and simplified](https://docs.typo3.org/typo3cms/extensions/core/latest/Changelog/master/Important-87980-PageIsBeingGeneratedMessageHasBeenRemoved.html), which leads to a better experience for every website visitor and TYPO3 user. ### Further upgrade instructions No database upgrades are required for this maintenance release. Download ---------- TYPO3 can be installed in various ways. For example the traditional way by using the source package at [get.typo3.org](https://get.typo3.org) or the modern way by setting up a project using composer, to name just two. Further details can be found in the according release notes: - - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/d2f68d86720b93361f6910922465f559.jpeg) About the Author [Benni Mack](https://news.typo3.com/article/author/benni-mack) CTO at b13,Stuttgart, Germany [Website](https://b13.com/)[Twitter](https://twitter.com/bennimack)[LinkedIn](https://www.linkedin.com/in/benjaminmack/) Being the CTO at b13 GmbH, Benni is the TYPO3 Core Project Lead and one of the driving forces behind the TYPO3 community in the last years. [More posts by this author](https://news.typo3.com/article/author/benni-mack)