Kia ora Silverstripe Cloud customer,
As you’ll have seen from earlier updates, yesterday and overnight the Silverstripe Team has been monitoring two critical vulnerabilities recently identified in PHP, the underlying technology used by Silverstripe CMS, and by a large share of websites worldwide.
Here’s where we’re at currently:
- PHP released patches at 3am NZDT.
- We made these available at 3:15am.
- We’re now prioritising the necessary updates.
Your immediate protection status
Environments covered by Silverstripe’s WAF service have protection against known exploitation patterns associated with these vulnerabilities. This provides an additional layer of defence, but patching is still required.
Coverage varies by environment. Publicly accessible UAT, staging and test environments without a WAF require urgent attention. We strongly recommend enabling the Dashboard IP whitelist on these environments while arranging the update.
Next steps for your site
For our Professional Services Customers / Retainers / Code Care / CXP:
If your site is supported by Silverstripe Professional Services, our teams are already assessing your application and co-ordinating the deployment with the Silverstripe Cloud team.
This work is covered under your existing arrangement at no additional cost. We will confirm your scheduled update window shortly, and reach out if any specific action is needed from your team.
For our Cloud Customers with internal developers or working with External Agencies
Silverstripe Cloud team has made the security patches available. Because your application is maintained by your own developers or an external agency, they will need to perform compatibility checks and run a full deployment (typically ~one hour). Please forward this notice to your development agency as soon as possible, and let us know who will co-ordinate with us so we can connect our technical teams.
FAQ
Answers to questions you may have:
Are you protected?
- Environments covered by Silverstripe’s WAF service have protection against known exploitation patterns.
- Coverage must be confirmed for each environment, including UAT and staging.
- Affected environments still require patching.
- For publicly accessible non-production environments without a WAF, we strongly recommend enabling the Dashboard IP whitelist while arranging the update.
Who patches PHP?
- The Silverstripe Cloud makes the patched PHP packages available.
- A full deployment is required to apply them to each affected environment.
- Your Silverstripe squad or external development team co-ordinates testing and deployment, with Operations support where needed.
- Older PHP versions may require additional application compatibility work or an upgrade.
Are you compromised?
- A vulnerability is not evidence of compromise.
Is there a cost?
- Cloud infrastructure security updates are distinct from separately scoped PS application work, which may be charged at standard rates.
- For those clients on CXP, Code Care, Retainers or ongoing professional services there is no additional cost.
Can you wait?
We strongly recommend immediate patching.
How long will it take?
While the patches themselves are minor, a full deployment is required. We would recommend allowing approximately one hour once activities are underway.
If you have any other immediate questions, or need guidance on co-ordinating with your team, please let us know. Thank you for continued patience while we safeguard your site's stability and security. Protecting our customers remains our highest priority: we got you.
Kind regards,
Silverstripe team