Security Advisory Oct 27, 26, Umbraco Builders Day Announced, Umbraco Spark 2027 Tickets & CFP Open and much more...

Sign Up | View Online | Previous Editions

UMB.FYI 2026-10-28

Umbraco HQ

Security Advisory, Oct 27, 2026: Security Patches for Umbraco CMS, Umbraco Forms, and Umbraco AI now available (15 minute read)

Anders Nis Herforth Larsen reports that ten vulnerabilities across Umbraco CMS, Umbraco Forms, and Umbraco AI (two high, seven moderate, one low) were fixed; patches released (CMS 13.16.3/17.7.2/18.2.2, Forms 13.9.12/17.6.2/18.2.2, AI components updated). Upgrade recommended; interim mitigations provided.

[ ] [ #security ] [ #umbracocms ] [ #umbracoforms ]

US Partner Summit 2026: Award Winners Recap (4 minute read)

Lasse Fredslund celebrates the Umbraco US Partner Summit 2026—a community evening of dinner, drinks, and trivia—and highlights award winners: Proworks (Mold Inspection Sciences) for AI-driven publishing and 80% traffic growth; Scandia (OAS Federal Credit Union) for data-layer rebuild and 37% conversion; Adage Technologies (Adrienne Arsht Center) for a Cloud migration boosting speed and accessibility.

[ ] [ #awards ] [ #partners ]

Umbraco is .NET, not PHP (3 minute read)

Mats Persson explains that recent critical PHP vulnerabilities (CVSS 9.2) do not affect Umbraco because it runs on .NET/ASP.NET Core, not PHP; organizations should still patch any PHP-based sites or tools they run alongside Umbraco, keep Umbraco/.NET updated, and embrace open disclosure and community cooperation for security.

[ ] [ #security ]

---

Join 700+ professionals getting the latest news, events and media from the Umbraco community delivered straight to their inbox

---

[Breaking change]: Forms Security will be replaced by CMS user group permissions in Umbraco Forms 20 (4 minute read)

Rick Butterfield explains that Umbraco Forms 20 replaces its separate "Forms Security" with standard CMS user-group permissions. Permissions move to the CMS user group Permissions tab, become additive (no deny/fallback), remove per-user and start-folder settings, and migrate existing setups to group grants. Several APIs, storage tables, and config settings are removed or reshaped.

[ ] [ #authorization ] [ #umbracoforms ]

Community

Introducing Engage Healthcheck: what state is my Engage database in? (3 minute read)

Corné Hoskam announces Engage Healthcheck, an open-source, read-only tool that identifies which Umbraco Engage version a database matches, detects Engage Forms/Commerce, checks schema-alignment completion, and reports mismatches. Released as v0.1.0 on GitHub (Umbraco.Community.Engage.Healthcheck), it’s experimental—use as a second opinion and open issues for unrecognized databases.

[ #migrations ] [ #umbracoengage ]

Umbraco testing examples now also for Umbraco 18 (2 minute read)

Dennis updated the testing reference repository for Umbraco 18: end-to-end tests migrated from .NET to TypeScript (Playwright/node) due to client-generation and tooling issues; Published Content property changes (IPublishedContent → IPublishedElement) mirrored in FakePublishedElement/FakePublishedContent without breaking tests; integration-index updates planned.

[ #testing ] [ #typescript ]

Articulate 7 and 8 are out for Umbraco 17 and 18 (3 minute read)

Shannon Thompson announces Articulate 7.0.0 (Umbraco 17) and 8.0.0 (Umbraco 18) on NuGet, built from a single codebase with compatibility layers. Key updates: Giscus comments, a Markdown editor using OAuth/PKCE, TipTap replacing TinyMCE, rebuilt backoffice, BlogML improvements, and performance/security fixes.

[ #markdown ]

Umbraco Spark 2027 is open: call for speakers, tickets and a new home for our news (2 minute read)

Cat Todd announces Umbraco Spark 2027 on Friday 19 March 2027 at We The Curious, Bristol: call for speakers open (submit by 8 Jan 2027) with 15/30/45-minute talks, free ticket and local accommodation for speakers; Early Bird tickets £100+VAT until 11 Dec 2026; Package Jam on 18 March.

[ #umbracospark ]

Umbraco UK Conference (5 minute read)

Owain Williams recounts a productive London trip for the Umbraco UK Partner Summit and Conference: engaging talks (including product updates and Automate), strong partner enthusiasm (Aaron, Jacob, Gemma), social events, whisky, Biscoff doughnuts, networking games, and an eventful train journey home after board games and friends.

[ ] [ #ukconf ]

Automatic log cleanup for Umbraco (4 minute read)

Søren Kottal describes Unlog, an Umbraco package that prunes file-based Serilog logs by retention rules (e.g., Information 14 days, Warning 30, All 90), preserving recent and error entries while freeing space. It runs as a background job, requires the UmbracoFile sink, and is available on the Umbraco Marketplace.

[ #logging ]

Events

Umbraco Community Hour - Virtual Meetup

2026-10-28 from 13:00 to 14:00 (Europe/Copenhagen) - Online

[ #virtual ]

UmbraCymru - October Meetup

2026-10-28 from 18:00 to 20:00 (Europe/London) - Aspire Systems, 12-14 Trade Street, Cardiff, CF10 5DT, Cardiff, GB

[ ]

Umbraco Scotland - Edinburgh

2026-10-28 from 18:30 to 20:30 (Europe/London) - Paterson's Land, The University of Edinburgh, Holyrood Rd, Edinburgh EH8 8AQ, UK, Edinburgh, GB

Manchester and North West Umbraco Meetup - Jonny Muir : Service Design – From Potato Peelers to Butterflies

2026-10-29 from 18:00 to 20:00 (Europe/London) - CTI Digital, South Central, 11 Peter Street, Manchester, M2 5QR, Manchester, GB

Umbraco Finland – Nubrik.app Demo – Daniel Horn

2026-11-03 from 14:00 to 15:00 (Europe/Helsinki) - Online

[ #virtual ]

Umbraco Sydney Meetup - V19 beta & .NET 11 launch!

2026-11-05 from 18:00 to 20:30 (Australia/Sydney) - Sydney, venue TBC

Packages

Aivie.Content

From keyword to published page, without leaving Umbraco.

[ #ai ] [ #seo ] [ #umbracoai ]

Limbo.Umbraco.Video 17.0.0

Package serving as a base for Limbo's video picker packages.

[ ]

SeoWebChecker.Umbraco

Comprehensive on-page search engine optimization (SEO) diagnostics, meta tag analyzer, and health checks for Umbraco websites by SEOWebChecker (https://seowebchecker.com/).

[ #seo ]

Simplepage.Umbraco.SafeMedia

Refuses unsafe SVG uploads before they are stored.

[ #media ] [ #security ]

FoundWell.Umbraco

Connects an Umbraco site to FoundWell (redirects, llms.txt and JSON-LD written by FoundWell) and adds AEO/GEO auditing, schema.org and /llms.txt to the backoffice.

[ #ai ] [ #seo ]

Wayfinder.Umbraco.Starter

Try Wayfinder on a fresh Umbraco site with no code: a home page, a sample service with a public and a staff queue, demo staff sign-in, and the MCP authoring endpoint wired up so you can design a service in conversation with an AI assistant.

[ #starterkits ] [ #umbracomcp ]

WarpSearch.Umbraco.Search

Use WarpSearch (https://warpsearch.io/) as the search provider for Umbraco Search.

[ #search ] [ #umbracosearch ]

Esatto.Umbraco.Backoffice.NavigationOrder

Drag the Umbraco backoffice sections and each section's tabs into the order you want.

[ #backoffice ]

DigitalWonderlab.ImageResizer

Reduce the size of all your images across your umbraco instance.

[ #media ] [ #performance ]

BlockCount

Configure minimum and maximum counts for individual block types in Umbraco Block List and Block Grid properties.

[ #propertyeditors ]

DotSee.SchemaMapper

Backoffice dashboard for configuring schema.org JSON-LD structured data output per Umbraco content type, without writing code.

[ #seo ]

HCS.UmbCustomHeader

Group Umbraco backoffice sections into dropdowns in the top navigation, configured from appsettings.json.

[ #backoffice ]

Umbraco.Community.PropertyAuditTool

Read-only backoffice audit for finding incomplete or matching content across document types, element types, pages and blocks, with permission-aware filtering, saved audits and pinned dashboard tiles.

[ #backoffice ]

TheBuilder.AIImageDisclosure

Read valid C2PA Content Credentials on new or replaced files, store generated or modified on Umbraco Image media, and support editor overrides without pixel guessing.

[ #ai ] [ #media ]

Umbraco.Community.Unlog

Per-level retention for Umbraco's Serilog file logs, including files left by previous Azure workers.

[ #logging ]

Umbraco.Community.AI.Search.Pinecone

A vector store for Umbraco AI Search that keeps its embeddings in a Pinecone serverless index instead of the CMS database.

[ #ai ] [ #search ] [ #umbracoai ]

Umbraco.Community.AI.Pinecone

An Umbraco AI embeddings provider that generates vectors with Pinecone's hosted embedding models, so Umbraco AI Search and anything else that needs embeddings can use Pinecone.

[ #ai ] [ #search ] [ #umbracoai ]

RedMorello.SurveyStudio.uSync

Adds uSync handlers for Survey Studio, so forms, templates, data lists, custom questions, themes, workflows, and tenants can be promoted between Umbraco environments the same way you already promote content types and data types.

[ #usync ]

RedMorello.SurveyStudio

Survey Studio adds a full survey builder to the Umbraco backoffice, built on SurveyJS - no separate SurveyJS license required.

[ #backoffice ]

Social

Modernising Social Work England's Umbraco platform: Azure and v10 to v17

[ #azure ] [ #upgrades ]

Umbraco Builders Day, a virtual hackathon, is on 13 November

[ ] [ #hackathons ] [ #virtual ]

Stop apologising for using AI

[ ] [ #ai ]

Save the date: Dutch Umbraco Alliance meetup on 26 November

Forum

UmbraDesktop v17.4.0 - Search, Quality of life and the arcade! (3 minute read)

Luuk Peters (Proud Nerds) announces UmbraDesktop updates: improved launcher search, workspace views shown alongside content (detachable), a one-time welcome wizard, progress indicators for uploads, an Arcade gaming service with persistent leaderboards, and an UmbraCoffee app with episode notifications; plus UI and settings tweaks.

[ #packages ]

Puzzle

Fix, initially pushed after the Codegarden hackathon (5)

[ Stuck? Get hints and the answer ]
---

Join 700+ professionals getting the latest news, events and media from the Umbraco community delivered straight to their inbox

---
UMB.FYI, Unit 128100, PO Box 4336, Manchester, M61 0BW