CiviCRM released a security update yesterday for 6.15.3 and 6.10 ESR, addressing a longer-than-usual list (16) vulnerabilities, including stored XSS, SQL injection, unauthorized file access, and an RCE issue.
I expect we may continue seeing more of these security releases in the short run. AI is making security vulnerabilities easier to find, easier to test, and more visible. That is ultimately good for open source security, but it also means projects and site maintainers are playing catch-up right now.
For Civicopilot-hosted sites, I complete the upgrades within 24 hours of the release. On this one due to severity, I stayed up late last night to finish them off because security releases become the highest priority when there is one.
Want to make this more managed? I wrote about a way to make this more manageable awhile back, which is the “double step” plan laid out here. Or, just have a CiviCRM partner handle this automatically for you.
The bottom line:
In this environment of bots and increased attacks, it’s essential to keeping your CiviCRM secure and having a plan to do this each time one comes out.