Read the official Contao announcements.
TYPOlight 2.6.3 is available
by Leo Feyer
TYPOlight version 2.6.3 is available. The maintenance release includes a hardened Input class that detects even more malicious XSS code (e.g. in BBCode comments) as well as an important Safe Mode Hack fix (thanks to Peter Koch for tracking this one down), so it is highly recommended to update.
In the new release, all private core methods have been declared protected, so they can be overwritten in custom extensions. That also includes all core modules (news, calendar, newsletter, etc.).
The new release includes some template modifications that were announced in the forum.
Find out what else has been done
You can check out all tickets belonging to the new version here.
Download this release from github.com.