Why Security Updates Matter So Much

As part of the (Extended) Long Term Support program, the TYPO3 Association regularly releases minor or security updates (patches). These fix functional bugs and close security vulnerabilities – the latter should always be applied promptly.

campaign

Tip: Join the official TYPO3 Announcement mailing list to stay informed about new security patches: lists.typo3.org/typo3-announce.

backup

Important: Minor updates are usually harmless, but so-called breaking changes are possible – this can, for example, cause extensions to malfunction. Always create a backup before every update.

This article covers exclusively maintenance or security updates. You can recognize these by the third part of the version number – for TYPO3 11.5.25, that would be the 25. If a higher version exists (26, 27, 28, …), you should update following this guide. For general information on updating TYPO3 to a new major version, see our update article.

What Are Breaking Changes?

Breaking changes occur when replacing or updating a module causes the overall system to stop working because that module's interface has changed. In TYPO3, this usually affects changes to the database structure (tables and fields) or to function parameters that serve as an interface for other modules.

TYPO3's developers strive to implement all breaking changes for a major release before the LTS version is published – ideally as early as the first zero version (e.g. "12.0"). In rare cases, for example when unavoidable to close a security vulnerability, breaking changes can still occur in LTS updates.

terminal

Finding the TYPO3 version in the backend (top left, in system information)

Do I Need a Security Update?

You can find your currently used TYPO3 version in the backend, top left. Your installation should have at least the latest respective security update applied. Currently, that is:

VersionStatus
TYPO3 14.3.6Free LTS until 2029-06-30
TYPO3 13.4.34 LTSFree LTS until 2027-10-31
TYPO3 12.4.48Only paid ELTS available
TYPO3 11.5.53Only paid ELTS available

As of 2026-06-18 · current figures are always available on the typo3.org roadmap.

Applying a TYPO3 Security Update Yourself

Depending on your installation type and server access, there are three different ways to apply a security update in TYPO3.

tips_and_updates

Tip – enable debugging: Applying an update can suddenly cause the backend and frontend to stop working. In live mode, you won't see an error message in that case. So before the update, enable debug mode in the backend under Settings → Configuration Presets and set config.contentObjectExceptionHandler = 0 in your TypoScript setup. Don't forget to revert both after the update.

1. Security Update with Composer

  1. Log in to the web server via SSH and navigate to the installation directory.
  2. Make a copy of the composer.lock file – as a fallback in case something goes wrong later.
  3. Run the following command:
    composer update "typo3/cms-*" --with-all-dependencies
  4. In the TYPO3 backend, check database consistency via the Maintenance module ("Analyze Database Structure").
  5. Then clear the TYPO3 and PHP cache (also in the Maintenance module).

If You Run Into Problems…

  • Log in to the Install Tool, run a DB check under Maintenance → Analyze Database Structure → Apply (back up the database first), and clear the cache under Maintenance → Flush TYPO3 PHP Cache.
  • If you can't access the Install Tool at all anymore, run the command php vendor/bin/typo3 cache:flush in the installation directory.

Fallback: If something stops working afterward, copy the old composer.lock back and run composer install.

2. Security Update via the Shell Level (Without Composer)

If your TYPO3 system wasn't installed via Composer, we recommend updating directly via your web server's shell level.

  1. Navigate to TYPO3's installation directory and use wget to download the latest minor update for your main release (here, version 12):
    wget --content-disposition get.typo3.org/12
  2. Extract the downloaded tar file (here, version 12.4.42):
    tar xzf typo3_src-12.4.42.tar.gz
  3. Update the symlink for the typo3_src subdirectory:
    rm typo3_src
    ln -s typo3_src-12.4.42 typo3_src
  4. Remove all other TYPO3 instances – only the new typo3_src-… directory should exist.

3. Security Update via the Install Tool

Without a Composer installation and without SSH access, the security update can also be applied directly through the TYPO3 backend. The following requirements must be met for this:

  • The TYPO3 system runs on a Unix derivative or macOS.
  • The typo3_src directory is a symbolic link writable by the web server.
  • The web server has write permissions on the webroot directory (usually "typo3").
  • The directory above the webroot is also writable.
  • The tar command is available and executable by the web server.
  • You have admin access with maintainer rights in the TYPO3 backend.

If the environment variable TYPO3_DISABLE_CORE_UPDATER=1 is set, this feature is disabled – this can be adjusted in the web server configuration.

  1. Log in as an administrator in the TYPO3 backend.
  2. In the Upgrade module, open "Update TYPO3 Core".
  3. Click "Check for core updates".
  4. If an update is available, click "Update now".
shield_lock

Prefer to leave the security update to us?

With a service agreement, we automatically install security updates for LTS versions – at no extra cost.

Request service agreement