TYPO3 9.5.6 and 8.7.25 security releases published

We are announcing the release of the following TYPO3 updates:

• TYPO3 9.5.6 LTS
• TYPO3 8.7.25 LTS

All versions are security releases and contain important security fixes - read the corresponding Security Advisories here:

• TYPO3-CORE-SA-2019-009: Information Disclosure in Page Tree
• TYPO3-CORE-SA-2019-010: Information Disclosure in User Authentication
• TYPO3-CORE-SA-2019-011: Security Misconfiguration in User Session Handling
• TYPO3-CORE-SA-2019-012: Possible Arbitrary Code Execution in Image Processing
• TYPO3-CORE-SA-2019-013: Cross-Site Scripting in Fluid Engine
• TYPO3-PSA-2019-004: Cross-Site Scripting in jQuery before 3.4.0
• TYPO3-PSA-2019-005: Cross-Site Scripting in Bootstrap CSS toolkit before 3.4.1 and 4.3.0
• TYPO3-PSA-2019-006: Security Misconfiguration since TYPO3 9.4.0
• TYPO3-PSA-2019-007: By-passing protection of Phar Stream Wrapper Interceptor
• TYPO3-PSA-2019-008: By-passing protection of Phar Stream Wrapper Interceptor

Important note regarding security updates

Some security fixes can be considered as breaking changes in order to apply strong security defaults. Please read the security bulletins carefully - manual adjustments concerning backward compatibility are described there as well.

Important non-security related changes

TYPO3 v9.5.6 LTS contains some note-worthy changes that site administrators and extension authors should be aware of:

1. Enhanced options for language fallback of content renderings
   This feature allows to configure streamlined language fallbacks more diverse to allow proper fallback of language configurations for e.g. Swiss-German to German. New options within the Site Module and for the site configuration file are available.
2. Additional hook for generating slugs via Extensions
   This feature allows extension authors to modify generated URL Segments ("slug") for customizing stored URLs for pages/records depending on e.g. the current pagetree, or when a page is within a Storage Folder.
3. Streamlined FAL Search functionality
   A new FAL API allows to also search through files properly and their metadata, which has been incorporated within the FileList Backend module already.

Page is being generated functionality removed

Thanks to a combined effort of Benjamin Franzke, Helmut Hummel and Markus Klein, the infamous "Page is being generated" message functionality has been removed in both TYPO3 v9.5.6 and TYPO3 v8.7.25. Page-locking of concurrent requests creating the page has been heavily improved and simplified, which leads to a better experience for every website visitor and TYPO3 user. 

Further upgrade instructions

No database upgrades are required for this maintenance release.

TYPO3 can be installed in various ways. For example the traditional way by using the source package at get.typo3.org or the modern way by setting up a project using composer, to name just two. Further details can be found in the according release notes:

• https://get.typo3.org/release-notes/9.5.6
• https://get.typo3.org/release-notes/8.7.25