# TYPO3 News

> Stay informed with the TYPO3 News Hub: articles on product updates, community stories, events, governance, and CMS insights—all in one place.

## News & Events Hub

- [News & Events Hub](https://news.typo3.com/index.md)

## Categories

- [The Project](https://news.typo3.com/categories/the-project/index.md)
- [Showcase & Success](https://news.typo3.com/categories/showcase-success/index.md)
- [Product Updates & Roadmap](https://news.typo3.com/categories/product-updates-roadmap/index.md)
- [Personal Stories & Opinions](https://news.typo3.com/categories/personal-stories-opinions/index.md)
- [Market & Sell](https://news.typo3.com/categories/market-sell/index.md)
- [Developer & Technology](https://news.typo3.com/categories/developer-technology/index.md)
- [Best Practice & Learning](https://news.typo3.com/categories/best-practice-learning/index.md)
- [Security](https://news.typo3.com/security/index.md): Stay up to date with TYPO3's latest security advisories.

## Events

You can take part in official events organized by the TYPO3 Association, events organized by the TYPO3 community, and events where TYPO3 participates.

- [Events](https://news.typo3.com/events/index.md)

## Newsletter

Explore TYPO3 Pulse, the official TYPO3 newsletter. Browse the latest editions for exclusive updates, events, and insights from the TYPO3 community.

- [Newsletter](https://news.typo3.com/newsletter/index.md)


## Articles
- [Notes From Contao Summit 2026](https://news.typo3.com/article/notes-from-contao-summit-2026/index.md): Martin Helmich spoke about AI and CMS backends at Contao Summit 2026 in Leipzig, Germany, and found a community facing TYPO3's own funding questions.
- [TYPO3 Association Members Approve New Governance Structure](https://news.typo3.com/article/typo3-association-members-approve-new-governance-structure/index.md): Units and a Unit Cooperation Panel will organize volunteer work on TYPO3 CMS. The bylaw amendments passed with 75% in favor and take effect immediately.
- [Why You Should Apply to the TYPO3 Surf Camp 2027](https://news.typo3.com/article/why-you-should-apply-to-the-typo3-surf-camp-2027/index.md): Join the TYPO3 Surf Camp 2027 in Porto: a week of projects, mentorship and surf lessons. Apply by November 30, 2026.
- [Forum PHP 2026: The French TYPO3 Committee Returns to Disneyland Paris](https://news.typo3.com/article/forum-php-2026-the-french-typo3-committee-returns-to-disneyland-paris/index.md): Rachel Foucard on Forum PHP 2026 in France: the French TYPO3 committee's booth, her Cyber Resilience Act talk, and an open letter to save tech events.
- [Faster. Smarter. Scalable.  How toujou Turns Enterprise TYPO3 Websites into a Repeatable Pattern](https://news.typo3.com/article/faster-smarter-scalable/index.md): At the TYPO3 North America Summit, Viviane Gebelein of toujou showed how Rotkäppchen-Mumm launched 40+ brand websites in just two and a half years.
- [Relaunch Redirects Extension Finds Broken URLs Before the Go-Live](https://news.typo3.com/article/relaunch-redirects-extension-finds-broken-urls-before-the-go-live/index.md): The Relaunch Redirects extension checks old URLs against a relaunched TYPO3 site, finds would-be 404 errors on staging, and creates redirects with one click.
- [TYPO3 14.3.10, 13.4.37, 12.4.51, 11.5.56 and 10.4.62 maintenance releases published](https://news.typo3.com/article/typo3-14310-13437-12451-11556-and-10462-maintenance-releases-published/index.md): The versions 14.3.10, 13.4.37, 12.4.51, 11.5.56 and 10.4.62 of the TYPO3 Enterprise Content Management System have just been released.
- [TYPO3 Association Board Meeting Protocol (30 September 2026)](https://news.typo3.com/article/typo3-association-board-meeting-protocol-30-september-2026/index.md): TYPO3 Association board protocol: proposed term limits, member vote on new by-laws before the 29 October General Assembly, and event reports.
- [What’s New in DDEV for TYPO3 Folks: October 2026](https://news.typo3.com/article/whats-new-in-ddev-for-typo3-folks-october-2026/index.md): October’s DDEV update for TYPO3 developers is about databases: seeded snapshots, a database per branch, and faster throwaway instances.
- [TYPO3-PSA-2026-001: Critical PHP security release: PHP update required for all TYPO3 installations](https://news.typo3.com/article/typo3-psa-2026-001/index.md): The PHP project has published a security release fixing two critical vulnerabilities in PHP. Given the critical severity, TYPO3 users should update PHP on their installations without delay.
- [TYPO3-EXT-SA-2026-036: Broken Access Control in extension "shop" (shop)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-036/index.md): It has been discovered that the extension "TYPO3 Shop by coding.ms" (shop) is vulnerable to Broken Access Control.
- [TYPO3-EXT-SA-2026-035: Multiple vulnerabilities in extension "TYPO3 AI Integration Extension" (ns_t3ai)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-035/index.md): It has been discovered that the extension “TYPO3 AI Integration Extension” (ns_t3ai) is vulnerable to SQL Injection and Sensitive Data Exposure.
- [TYPO3-EXT-SA-2026-034: SQL Injection in extension "File manager" (ameos_filemanager)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-034/index.md): It has been discovered that the extension "File manager" (ameos_filemanager) is vulnerable to SQL Injection.
- [TYPO3-EXT-SA-2026-033: Multiple vulnerabilities in extension "TYPO3 Fluid-Form" (fluid_form)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-033/index.md): It has been discovered that the extension "TYPO3 Fluid-Form by coding.ms" (fluid_form) is vulnerable to Cross-Site Scripting and Broken Access Control.
- [TYPO3-EXT-SA-2026-032: Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-032/index.md): It has been discovered that the extension "Kitodo.Presentation" (dlf) is vulnerable to Server-Side Request Forgery.
- [TYPO3-EXT-SA-2026-031: Multiple vulnerabilities in extension "Analytics" (analytics)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-031/index.md): It has been discovered that the extension "Analytics" (analytics) is vulnerable to Insecure Direct Object Reference (IDOR) and Broken Access Control.
- [TYPO3-EXT-SA-2026-030: Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-030/index.md): It has been discovered that the extension "Accessible Form Captcha" (bw_captcha) is vulnerable to Captcha Bypass.
- [TYPO3-EXT-SA-2026-029: Multiple vulnerabilities in extension "sgalinski Cookie Consent" (sg_cookie_optin)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-029/index.md): It has been discovered that the extension "sgalinski Cookie Consent" (sg_cookie_optin) is vulnerable to SQL Injection and Missing Authorization.
- [TYPO3-EXT-SA-2026-028: Broken Access Control in extension "FAL Protect" (fal_protect)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-028/index.md): It has been discovered that the extension "FAL Protect" (fal_protect) is vulnerable to Broken Access Control.
- [Beyond the Rim of the Plate: Notes From Kirby Konf 2026](https://news.typo3.com/article/beyond-the-rim-of-the-plate-notes-from-kirby-konf-2026/index.md): Martin Helmich spent two days in Mainz, Germany, at the first Kirby Konf, where a designer-led CMS community shared its views on AI, sustainability, and funding.
- [TYPO3 Association Joins the European Open Source Academy’s Partner Program](https://news.typo3.com/article/typo3-association-joins-the-european-open-source-academys-partner-program/index.md): The TYPO3 Association joins the European Open Source Academy on 1 November 2026 to work on open source policy, skills transfer, and local business models.
- [TYPO3 Association Members to Vote on New Governance Structure](https://news.typo3.com/article/typo3-association-members-to-vote-on-new-governance-structure/index.md): TYPO3 Association members vote 21–29 October 2026 on bylaw amendments that introduce Units. Find out what changes and how to vote.
- [Optimizing AI Search & GEO for TYPO3 Websites: From Win the Click to Win the Answer](https://news.typo3.com/article/optimizing-ai-search-geo-for-typo3-websites/index.md): From rankings to AI-generated answers: discover how TYPO3 websites can improve their visibility in AI search through GEO, content, and strong brand signals.
- [Also Light-Years Ahead of its Reputation: Notes From DrupalCon Rotterdam 2026](https://news.typo3.com/article/also-light-years-ahead-of-its-reputation-notes-from-drupalcon-rotterdam-2026/index.md): A TYPO3 view of DrupalCon Rotterdam 2026: Drupal's reputation gap, an AI-first Drupal CMS, and ideas TYPO3 can borrow back from its open source neighbor.
- [The Great Content Rescue: How TYPO3 Turned a Massive Legacy Website Into a Future-Ready Platform](https://news.typo3.com/article/the-great-content-rescue/index.md): At the TYPO3 North America Summit, Kai Unterberg of KM2 >> showed how automated migration rescued 50,000 fragmented content elements on Gerresheimer’s website.
- [TYPO3 14.3.9 security release published](https://news.typo3.com/article/typo3-1439-security-release-published/index.md): The version 14.3.9 of the TYPO3 Enterprise Content Management System has just been released.
- [TYPO3-CORE-SA-2026-024: Security Misconfiguration in Form Framework](https://news.typo3.com/security/advisory/typo3-core-sa-2026-024/index.md): It has been discovered that TYPO3 CMS is susceptible to ignored upload storage configuration in the Form Framework.
- [Typed Content Models for TYPO3](https://news.typo3.com/article/typed-content-models-for-typo3/index.md): Funded through the TYPO3 community budget, the new Content Models extension gives developers a structured way to work with pages, content elements, and other records managed by TYPO3.
- [TYPO3 10.4.61, 11.5.55, and 12.4.50 ELTS Released](https://news.typo3.com/article/typo3-10461-11555-and-12450-elts-released/index.md): Today, TYPO3 10.4.60, 11.5.54, and 12.4.49 have been released. Gain peace of mind by opting for one of TYPO3 GmbH’s Extended Support offers!
- [TYPO3 14.3.8 and 13.4.36 maintenance releases published](https://news.typo3.com/article/typo3-1438-and-13436-maintenance-releases-published/index.md): The versions 14.3.8 and 13.4.36 of the TYPO3 Enterprise Content Management System have just been released.
- [TYPO3 Extension Repository Speaks composer.json](https://news.typo3.com/article/ter-speaks-composerjson-now/index.md): The TYPO3 Extension Repository (TER) now accepts extensions with composer.json as their only manifest. Authors no longer need an ext_emconf.php file to upload, and for versions that require TYPO3 v14.3 or newer, TER publishes the exact archive the author uploaded.
- [TYPO3 v11.5: ELTS Renewal Reminder for Year Three](https://news.typo3.com/article/v115-elts-year-3/index.md): Ensure uninterrupted support for TYPO3 v11.5 with ELTS year 3. Renew by Nov 1, 2026, for security updates and peace of mind through October 2027.
- [Extbase and Translations: The Full Picture](https://news.typo3.com/article/extbase-and-translations-the-full-picture/index.md): Anja Leichsenring reports on the first chapter delivered in the second round of community-funded Extbase documentation work.
- [TYPO3 Camp Africa Brings Public Sector and Web Professionals Together in Kenya](https://news.typo3.com/article/typo3-camp-africa-brings-public-sector-and-web-professionals-together-in-kenya/index.md): The TYPO3 Community Expansion Committee invites government digital leaders and developers from across the continent to Diani Beach in December for workshops, peer learning, and networking around open-source public websites. Registration is open, with 60 places available.
- [Meet the TYPO3 Dev Companion: TYPO3 Knowledge for Your Coding Agent](https://news.typo3.com/article/meet-the-typo3-dev-companion-typo3-knowledge-for-your-coding-agent/index.md): Coding agents read a TYPO3 project well, but know TYPO3 badly. The TYPO3 Dev Companion fixes that: a small, local, read-only server that gives your agent version-bound TYPO3 knowledge, answers from your own installation, and step-by-step workflows for real TYPO3 tasks.
- [This Month in TYPO3: September, 2026](https://news.typo3.com/article/this-month-in-typo3-september-2026/index.md): September was a month of recalibration. The public Bug Bounty Program came to an end, members funded four more community ideas worth €40,000, and the rules for TYPO3 Units moved through public review.
- [Best Practices Remote Code Sprint: August 2026](https://news.typo3.com/article/best-practices-remote-code-sprint-august-2026/index.md): Oliver Klee shares a report on the Best Practices Team's Remote Code Sprint on 3 August 2026, where the team worked on TYPO3 14 LTS compatibility for the Tea example extension.
- [Open Source Contribution as an Agency Investment](https://news.typo3.com/article/open-source-contribution-as-an-agency-investment/index.md): Explore how TYPO3 open-source contributions can help agencies build expertise, attract talent, strengthen retention, and create lasting business value.
- [TYPO3 Contribution in Numbers: September 2026](https://news.typo3.com/article/typo3-contribution-in-numbers-september-2026/index.md): See the full recap of TYPO3's September core contributions with 82 contributors, 315 reviews, bug fixes, features, and a big thank-you to our developers.
- [TYPO3 Documentation Now Renders to Markdown](https://news.typo3.com/article/typo3-documentation-now-renders-to-markdown/index.md): TYPO3 documentation is now available as Markdown, giving you the complete page at a fraction of the size, ready to download or hand to automated tools. New JSON files also make the Core Changelog searchable by PHP class ahead of a major update.
- [Building Business with TYPO3: A 90-Day Playbook for Agencies](https://news.typo3.com/article/building-business-with-typo3/index.md): Luisa Sofie Faßbender closed TYPO3's first North American Summit with a practical playbook for turning TYPO3's enterprise strengths into new business.
- [Growing TYPO3 Camps Together: Takeaways from the Roundtable at TYPO3 Camp Munich](https://news.typo3.com/article/growing-typo3-camps-together-takeaways-from-the-roundtable-at-typo3-camp-munich/index.md): Fewer attendees, later sign-ups: TYPO3 Camps and other events are facing tough times. At TYPO3 Camp Munich 2026, we held a roundtable to tackle this challenge together. Here are the best ideas from our roundtable to fill the next camp.
- [TYPO3 Camp Munich 2026: A Barcamp That Still Delights a Regular](https://news.typo3.com/article/typo3camp-munich-2026-a-barcamp-that-still-delights-a-regular/index.md): Martin Helmich on TYPO3 Camp Munich's 19th year: a two-day German-language barcamp mixing AI, business, and community sessions, plus a Bavarian beer garden.
- [TYPO3 Association Board Meeting Protocol (16 September 2026)](https://news.typo3.com/article/typo3-association-board-meeting-protocol-16-september-2026/index.md): Decisions included approving a partnership with EOSA and a statement on copyright liability for TYPO3 Core and extensions. Preparations are also underway for an Extraordinary General Assembly, proposed for 29 October 2026, and a Unit Kick-Off Day in November.
- [How we Built a Fully Open-Source AI Chatbot for TYPO3](https://news.typo3.com/article/how-we-built-a-fully-open-source-ai-chatbot-for-typo3/index.md): A modern AI chatbot can run completely on open-source technologies with just one TYPO3 extension. No external providers are needed — just a connection to an LLM.
- [TYPO3 Community Expansion Committee — First Half-Year Report for 2026](https://news.typo3.com/article/typo3-community-expansion-committee-first-half-year-report-for-2026/index.md): The TYPO3 Community Expansion Committee (T3CEC) advanced government partnerships on three continents in the first half of 2026. It held its first in-person sprint, in Madrid, and began shaping a TYPO3 camp for Africa later in the year.
- [From Blog to News Hub: Unifying the TYPO3 Ecosystem](https://news.typo3.com/article/from-blog-to-news-hub-unifying-the-typo3-ecosystem/index.md): Transforming the TYPO3 company blog into a unified News & Events Hub, bringing ecosystem news together with better navigation, sharing, and UX.
- [Summary of the Public Review: Rules for TYPO3 Units and the Unit Cooperation Panel](https://news.typo3.com/article/summary-of-the-public-review-rules-for-typo3-units-and-the-unit-cooperation-panel/index.md): The public review of the proposed Rules for TYPO3 Units and the Rules for the TYPO3 Unit Cooperation Panel closed on 6 September 2026. The Governance Working Group has since revised both documents and expanded the FAQ based on the feedback received.
- [Images, Videos, and Files for the MCP Server — TYPO3 Community Budget Project Delivered](https://news.typo3.com/article/images-videos-and-files-for-the-typo3-mcp-server/index.md): The MCP Server for TYPO3 can now handle files. Thanks to the TYPO3 Community Budget, AI assistants like Claude and ChatGPT can upload images, embed videos, browse file storage, and place media on pages — with a review safety net before going live.
- [TYPO3 Association Board Meeting Protocol (2 September 2026)](https://news.typo3.com/article/typo3-association-board-meeting-protocol-2-september-2026/index.md): The public review phase for the Unit Structure Proposal is ending, and the Board talked about the feedback and how it will be adapted. Also: finalizing the Conflict of Interest Policy review, new Committees and planning the fourth Quarterly Summit of the Association in November.
- [TYPO3 Public Bug Bounty Program Discontinued](https://news.typo3.com/article/bug-bounty-program-discontinued/index.md): The public TYPO3 Bug Bounty Program is ending. Security reporting and coordinated disclosure continue unchanged.
- [TYPO3 14.3.7 and 13.4.35 security releases published](https://news.typo3.com/article/typo3-1437-and-13435-security-releases-published/index.md): The versions 14.3.7 and 13.4.35 of the TYPO3 Enterprise Content Management System have just been released.
- [TYPO3 10.4.60, 11.5.54, and 12.4.49 ELTS Released](https://news.typo3.com/article/typo3-10460-11554-and-12449-elts-released/index.md): Today, TYPO3 10.4.60, 11.5.54, and 12.4.49 have been released. Gain peace of mind by opting for one of TYPO3 GmbH’s Extended Support offers!
- [TYPO3-CORE-SA-2026-023: Missing Authorization in lowlevel commands](https://news.typo3.com/security/advisory/typo3-core-sa-2026-023/index.md): It has been discovered that TYPO3 CMS is susceptible to unauthorized modification of system-wide configuration.
- [TYPO3-CORE-SA-2026-022: Information Disclosure via Backend Localization Wizard](https://news.typo3.com/security/advisory/typo3-core-sa-2026-022/index.md): It has been discovered that TYPO3 CMS is susceptible to information disclosure.
- [Scaling From Within: Building an Agency Business Unit](https://news.typo3.com/article/scaling-from-within-building-an-agency-business-unit/index.md): Learn how 3m5. built a 30-person TYPO3 business unit from within through mentoring, knowledge sharing, certifications, and employee participation.
- [JuneTech 2026: A New TYPO3 Community Takes Shape in Burundi](https://news.typo3.com/article/junetech-2026-a-new-typo3-community-takes-shape-in-burundi/index.md): Alina Fleser and Philippe Fekete from the TYPO3 Community Expansion Committee traveled to Burundi for JuneTech, a five-day technology event for students, startups, and young entrepreneurs.
- [The Website Builder Is Dead, Long Live Content Management](https://news.typo3.com/article/the-website-builder-is-dead-long-live-content-management/index.md): AI is making it easier than ever to create a website. That could be bad news for website builders — but it is also an opportunity for content management systems to finally move beyond the website and rediscover why they matter.
- [Members Have Selected Four Ideas to be Funded in Round Three 2026](https://news.typo3.com/article/members-have-selected-four-ideas-to-be-funded-in-round-three-2026/index.md): Round Three of the 2026 budget idea member poll has finished. This time four winning ideas will be funded by the TYPO3 Association.
- [This Month in TYPO3: August, 2026](https://news.typo3.com/article/this-month-in-typo3-august-2026/index.md): August was a governance month. The Association opened its proposed Rules for TYPO3 Units to community review, introduced an independent mediation service for Code of Conduct support, and put six Round Three budget ideas to a member vote.
- [TYPO3 Contribution in Numbers: August 2026](https://news.typo3.com/article/typo3-contribution-in-numbers-august-2026/index.md): See the full recap of TYPO3's August core contributions with 80 contributors, 148 reviews, bug fixes, features, and a big thank-you to our developers.
- [Notes From the Q&A on External Mediation and Support](https://news.typo3.com/article/notes-from-the-qa-on-external-mediation-and-support/index.md): The online meeting answered community questions about how the new, independent external mediation service will operate. If you were unable to attend the live webinar, the full video recording is now available.
- [What Changes, What Endures: Notes From CMS Connect 2026](https://news.typo3.com/article/what-changes-what-endures-notes-from-cms-connect-2026/index.md): On 4–5 August 2026, I traveled to Canada to attend and speak at CMS Connect 26, an international industry conference run by Janus Boye.
- [TYPO3 Association Board Meeting Protocol (19 August 2026)](https://news.typo3.com/article/typo3-association-board-meeting-protocol-19-august-2026/index.md): The TYPO3 Association Board reviewed ongoing governance and compliance work, including the Conflict of Interest Policy and preparations for the Cyber Resilience Act. The meeting also covered new community structures and potential partnerships.
- [TYPO3-EXT-SA-2026-027: SQL Injection in extension "Forms Export" (frp_form_answers)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-027/index.md): It has been discovered that the extension "Forms Export" (frp_form_answers) is vulnerable to SQL Injection.
- [TYPO3-EXT-SA-2026-026: Broken Access Control in extension "Events 2" (events2)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-026/index.md): It has been discovered that the extension "Events 2" (events2) is susceptible to two instances of Broken Access Control.
- [TYPO3-EXT-SA-2026-025: Multiple Vulnerabilities in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-025/index.md): It has been discovered that the extension "Apache Solr for TYPO3 - Enterprise Search" (solr) is vulnerable to Broken Access Control, Insecure Deserialization and Information Disclosure.
- [TYPO3-EXT-SA-2026-024: Multiple vulnerabilities in extension "femanager" (femanager)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-024/index.md): It has been discovered that the extension "femanager" (femanager) is vulnerable to Broken Access Control and Information Disclosure.
- [TYPO3-EXT-SA-2026-023: Multiple vulnerabilities in extension "Event management and registration" (sf_event_mgt)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-023/index.md): It has been discovered that the extension "Event management and registration" (sf_event_mgt) is vulnerable to Broken Access Control and Server-Side Template Injection (SSTI).
- [TYPO3-EXT-SA-2026-022: Server-Side Template Injection (SSTI) in extension "powermail" (powermail)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-022/index.md): It has been discovered that the extension "powermail" (powermail) is vulnerable to Server-Side Template Injection (SSTI).
- [TYPO3-EXT-SA-2026-021: Broken Access Control in extension "Forum" (pforum)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-021/index.md): It has been discovered that the extension "Forum" (pforum) is susceptible to Broken Access Control.
- [TYPO3-EXT-SA-2026-020: Broken Access Control in extension "Industry Directory" (yellowpages2)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-020/index.md): It has been discovered that the extension "Industry Directory" (yellowpages2) is susceptible to Broken Access Control.
- [TYPO3-EXT-SA-2026-019: Broken Access Control in extension "Club Directory" (clubdirectory)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-019/index.md): It has been discovered that the extension "Club Directory" (clubdirectory) is susceptible to Broken Access Control.
- [TYPO3-EXT-SA-2026-018: Broken Access Control in extension "Telephone Directory" (telephonedirectory)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-018/index.md): It has been discovered that the extension "Telephone Directory" (telephonedirectory) is susceptible to Broken Access Control.
- [TYPO3-EXT-SA-2026-017: Path Traversal in extension "Mask" (mask)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-017/index.md): It has been discovered that the extension "Mask" (mask) is vulnerable to Path Traversal.
- [TYPO3-EXT-SA-2026-016: Information Disclosure in extension "Modules" (modules)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-016/index.md): It has been discovered that the extension "Modules" (modules) is vulnerable to Information Disclosure.
- [TYPO3-EXT-SA-2026-015: Multiple Vulnerabilities in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-015/index.md): It has been discovered that the extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy) is vulnerable to Insufficient Session Expiration and Cleartext Transmission of Sensitive Information.
- [TYPO3-EXT-SA-2026-014: Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)](https://news.typo3.com/security/advisory/typo3-ext-sa-2026-014/index.md): It has been discovered that the extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail) is vulnerable to Remote Code Execution.
- [How to Choose the Right TYPO3 Agency for Your Project](https://news.typo3.com/article/how-to-choose-the-right-typo3-agency-for-your-project/index.md): Discover key criteria for choosing the right TYPO3 agency. Learn how to evaluate official certifications and partnership status and make use of official TYPO3 matchmaking tools.
- [TYPO3 Association Board Meeting Protocol (6 August 2026)](https://news.typo3.com/article/typo3-association-board-meeting-protocol-6-august-2026/index.md): Main topics were a review of a decision paper regarding conflict of interests, the proposal of a TYPO3 Enterprise Committee and the constitution of a working group for by-law changes decided by the recent General Assembly.
- [Content Blocks: Q2/2026 Report and the GUI for TYPO3 v14](https://news.typo3.com/article/content-blocks-q2/2026-report-and-the-gui-for-typo3-v14/index.md): The Content Blocks GUI now runs on TYPO3 v13 and v14 from a single codebase, the JSON Schema received a round of improvements, and one of the team took part in the TYPO3 Dialogue Days in Düsseldorf, Germany.
- [TYPO3 University Days 2026: Universities and Agencies Meet in Erfurt, Germany](https://news.typo3.com/article/typo3-university-days-2026-universities-and-agencies-meet-in-erfurt-germany/index.md): Have you heard of the TYPO3 University Days? TYPO3 enthusiasts from the university sector will be meeting up on 15-16 September, 2026 at the University of Erfurt. Sessions are held in German.
- [TYPO3 Association Board Meeting Protocol (22 July 2026)](https://news.typo3.com/article/typo3-association-board-meeting-protocol-22-july-2026/index.md): The board discussed a proposed Enterprise Committee, updates from the Governance Working Group and the compliance officer. Further topics were membership exclusions, trade mark violations and the optimization of internal processes.
- [Generative Engine Optimization for TYPO3 | GEO Guide](https://news.typo3.com/article/generative-engine-optimization-for-typo3-geo-guide/index.md): Generative Engine Optimization for TYPO3 explained: Chunking, structured data, multilingual setup for citable AI answers. Our practical guide to GEO for content creators.
- [The Future of TYPO3: Adapting for Digital Sovereignty in an Ever-Changing World](https://news.typo3.com/article/the-future-of-typo3-adapting-for-digital-sovereignty-in-an-ever-changing-world/index.md): TYPO3 is facing major changes across the IT sector and the web. In this opinion piece, TYPO3 Association Vice President Jana Höffner explains why the Association, the TYPO3 Company, and the community must embrace change as an opportunity to strengthen TYPO3’s future.
- [TYPO3 14.3.6 and 13.4.34 security releases published](https://news.typo3.com/article/typo3-1436-and-13434-security-releases-published/index.md): The versions 14.3.6 and 13.4.34 of the TYPO3 Enterprise Content Management System have just been released.
- [TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool](https://news.typo3.com/security/advisory/typo3-core-sa-2026-021/index.md): It has been discovered that TYPO3 CMS is susceptible to broken access control.
- [New Community Support Contact for Code of Conduct Incidents](https://news.typo3.com/article/new-community-support-contact-for-code-of-conduct-incidents/index.md): From 1 September 2026, TYPO3 community members can choose between the Ombudsperson Committee and a new independent service from Inmedio for confidential support with Code of Conduct incidents. Join the community Q&A on 26 August to learn more.
- [Review the Proposed Rules for TYPO3 Units and the Unit Cooperation Panel](https://news.typo3.com/article/review-the-proposed-rules-for-typo3-units-and-the-unit-cooperation-panel/index.md): Proposed Rules for TYPO3 Units and a TYPO3 Unit Cooperation Panel are now available for community review. Questions and feedback are welcome. Read the proposals, consult the accompanying FAQs, and submit questions and feedback by 6 September 2026.
- [Visual Editor Community Budget: From Innovation to Production-Ready](https://news.typo3.com/article/visual-editor-community-budget-from-innovation-to-production-ready/index.md): The TYPO3 Community Budget project enhanced the Visual Editor extension's accessibility, reliability, and suitability for multilingual editorial work. With the funded work complete, Visual Editor is now production-ready while maintaining its path to TYPO3 Core.
- [Vote Now! Budget Ideas for Round Three 2026 Have Been Published](https://news.typo3.com/article/vote-now-budget-2026-ideas-for-round-three-have-been-published/index.md): The call for community budget ideas for the third round of 2026 was successful: Four community and two team ideas have made it to the poll. These ideas can now be discussed and TYPO3 Association members can cast their vote.
- [TYPO3 vs. WordPress: Why Native Features Matter More Than Plugins](https://news.typo3.com/article/typo3-wordpress-na-summit/index.md): TYPO3 vs. WordPress isn't just a feature comparison. Our recap from the TYPO3 North American Summit explores why native multilingual support, workflows, permissions, and governance can reduce plugin complexity and improve long-term scalability.
- [This Month in TYPO3: July, 2026](https://news.typo3.com/article/this-month-in-typo3-july-2026/index.md): July was governance month. The Association board redistributed its portfolios after the 2026 election, Jana Höffner stepped in as Vice President, and two days of Dialogue Days in Düsseldorf put shared priorities on the table in the open.
- [TYPO3 Contribution in Numbers: July 2026](https://news.typo3.com/article/typo3-contribution-in-numbers-july-2026/index.md): See the full recap of TYPO3's July core contributions with 61 contributors, 146 reviews, bug fixes, features, and a big thank-you to our developers.
- [Extbase Documentation Overhaul Complete](https://news.typo3.com/article/extbase-documentation-overhaul-complete/index.md): Anja Leichsenring reports on the final chapters delivered in this community-funded rewrite of the Extbase documentation.
- [State of the TYPO3 Market 2026 – Let us help you …](https://news.typo3.com/article/state-of-the-typo3-market-2026-let-us-help-you/index.md): In the past few years, the digital sphere has undergone some drastic changes – with new developments, the rise of AI and a rather hard economical situation, selling solutions like TYPO3 requires new approaches and faces new challenges.
- [Best Practices in Action: A Productive On-Location Sprint](https://news.typo3.com/article/best-practices-in-action-a-productive-on-location-sprint/index.md): Anna Reiter gives a first-hand account of the Best Practices Team's on-location sprint in Bonn, Germany: three days of focused coding, shared screens, and a memorable hunt for lunch.
- [Ten Quotes That Captured the Spirit of the UN Open Source Week](https://news.typo3.com/article/ten-quotes-that-captured-the-spirit-of-the-un-open-source-week/index.md): What does digital sovereignty really mean? At the UN Open Source Week in New York, one panel tackled that question through a series of memorable insights on collaboration, security, sustainability, and public investment.
- [Beyond Burnouts and Buyouts](https://news.typo3.com/article/beyond-burnouts-and-buyouts/index.md): Discover how the TYPO3 Summit 2026 tackled open-source burnout. Learn why TYPO3’s "third-way" business model offers a sustainable future for digital agencies.
- [CMS World Premiere: Side-by-Side Multilingual Frontend Editing](https://news.typo3.com/article/cms-world-premiere-side-by-side-multilingual-frontend-editing/index.md): In this report, Matthias Vogel updates us on Visual Editor's progress, presenting version 1.8.0's new side-by-side multilingual editing.