Silverstripe CMS, PHP and jQuery stack breach guide
Published 4 Nov 2026 · Updated 2026-11-04
If your website runs Silverstripe CMS 5, apply the latest 5.x patch release now and plan the move to CMS 6, because some 2026 security fixes were made only in CMS 6. Also check the jQuery version your theme loads: versions before 3.5.0 are affected by CVE-2020-11023, which CISA lists as exploited in the wild. Keep PHP on a supported, patched release.
Who this is for: Australian professional-services firms, councils and organisations running a Silverstripe CMS website built by an agency. Written by our collective of Melbourne web and app developers; facts checked against NVD, the CISA KEV catalog and vendor advisories on 2026-11-04. Free to use and share.
Book a free stack check Already breached? First steps
Supported versions
Silverstripe CMS
Silverstripe CMS 6 is the current major. CMS 5 releases are on a shrinking support window (full support, then partial support for high-severity fixes only); check the official support timeline for your exact minor version. Some 2026 fixes were made only in CMS 6.
Source: Silverstripe CMS official lifecycle (checked 2026-11-04).
PHP
| Branch | Active support | Security support until |
|---|---|---|
| 8.1 and older | — | End of life |
| 8.2 | 2024-12-31 | 2026-12-31 |
| 8.3 | 2025-12-31 | 2027-12-31 |
| 8.4 | 2026-12-31 | 2028-12-31 |
| 8.5 | 2027-12-31 | 2029-12-31 |
Source: PHP official lifecycle (checked 2026-11-04).
jQuery
jQuery 3.5.0 (April 2020) fixed the two widely flagged XSS issues below. Many older CMS themes still load jQuery 1.x, 2.x or 3.0 to 3.4 from a CDN; the version is visible in the script URL.
Source: jQuery official lifecycle (checked 2026-11-04).
Old jQuery: CVE-2020-11022 and CVE-2020-11023
What the issue is
jQuery versions before 3.5.0 can run attacker-supplied script when untrusted HTML is passed to methods such as .html(), .append() and similar DOM manipulation helpers, even after the HTML has been sanitised. These are tracked as CVE-2020-11022 and CVE-2020-11023, and both are fixed in jQuery 3.5.0.
Why it matters
CISA lists CVE-2020-11023 in its Known Exploited Vulnerabilities catalog, so it has been used in real attacks. Cross-site scripting on a site with logins or enquiry forms can steal sessions, change content or capture what visitors type.
How to fix it
- Find which jQuery your theme and modules load (view source, or run jQuery.fn.jquery in the browser console).
- Upgrade to the current jQuery 3.x release (3.5.0 or later at minimum); use jQuery Migrate temporarily to surface code that needs changes.
- Remove duplicate or bundled old copies loaded by themes or modules.
- Avoid passing untrusted HTML into jQuery DOM methods; use .text() for user content.
- Test forms, menus and admin screens after upgrading.
Sources: NVD: CVE-2020-11023 · NVD: CVE-2020-11022 · CISA KEV catalog · OWASP XSS Prevention Cheat Sheet
Missing HTTP Strict Transport Security (HSTS)
What the issue is
HSTS is a response header (Strict-Transport-Security) that tells browsers to only ever connect to your site over HTTPS. Without it, a visitor's first request can go over plain HTTP before being redirected.
Why it matters
That first unencrypted request can be intercepted on public Wi-Fi or a compromised network and redirected to a fake page or stripped of HTTPS, exposing logins and form submissions.
How to fix it
- Confirm every page and subdomain works over HTTPS with a valid certificate.
- Add Strict-Transport-Security: max-age=300 at the web server or CDN and check nothing breaks.
- Increase max-age to at least 31536000 (one year) and add includeSubDomains once all subdomains are on HTTPS.
- Optionally add preload and submit the domain to the browser preload list once you are confident.
- Keep the HTTP-to-HTTPS redirect in place.
Sources: MDN: Strict-Transport-Security · OWASP HSTS Cheat Sheet
Key high and critical CVEs for this stack
These are recent high or critical vulnerabilities. "KEV" means CISA lists it as known to be exploited in the wild.
| CVE | Component | Affected | Fixed in | CVSS | KEV |
|---|---|---|---|---|---|
| CVE-2026-55186 | Silverstripe CMS: CMS 5 password-reset flow can issue a session before the MFA challenge is completed (needs access to the user's mailbox) | CMS 5 with silverstripe-mfa before 6.0.0 | CMS 6 / silverstripe-mfa 6.0.0 | 4.2 (CVSS 3.1, GitHub) | Not listed |
| CVE-2026-54717 | Silverstripe CMS: Stored XSS in CMS breadcrumbs (page list view) | Before 6.2.1 | 6.2.1 | 5.4 (CVSS 3.1, GitHub) | Not listed |
| CVE-2026-109618 | PHP: Out-of-memory handling memory corruption leading to unauthenticated remote code execution | 5.x/7.3 up to 8.2.34, 8.3.0–8.3.35, 8.4.0–8.4.26, 8.5.0–8.5.11 (7.3.0+ per NVD) | 8.2.35, 8.3.36, 8.4.27, 8.5.12 | 9.2 (CVSS 4.0, PHP) | Yes (added 2026-10-26) |
| CVE-2026-109619 | PHP: Stale internal request state leading to unauthenticated remote code execution | 5.4.0 up to 8.2.34, 8.3.0–8.3.35, 8.4.0–8.4.26, 8.5.0–8.5.11 | 8.2.35, 8.3.36, 8.4.27, 8.5.12 | 9.2 (CVSS 4.0, PHP) | Yes (added 2026-10-26) |
| CVE-2024-4577 | PHP: PHP-CGI argument injection on Windows (Apache + PHP-CGI, certain code pages) | 8.1 before 8.1.29, 8.2 before 8.2.20, 8.3 before 8.3.8 | 8.1.29, 8.2.20, 8.3.8 | 9.8 (CVSS 3.1, PHP) | Yes (added 2024-06-12) |
| CVE-2020-11023 | jQuery: XSS when HTML containing <option> elements from untrusted sources is passed to DOM manipulation methods | 1.0.3 up to (not including) 3.5.0 | 3.5.0 | 6.1 (CVSS 3.1, NVD) | Yes (added 2025-01-23) |
| CVE-2020-11022 | jQuery: XSS when untrusted HTML, even after sanitising, is passed to .html(), .append() and similar | 1.2 up to (not including) 3.5.0 | 3.5.0 | 6.1 (CVSS 3.1, NVD) | Not listed |
How attacks on this stack typically work
- Cross-site scripting through outdated front-end libraries or unescaped CMS content can be used to steal sessions or show fake forms.
- Phished CMS editor credentials let attackers change pages or insert malicious scripts; MFA gaps make this easier.
- Unpatched PHP and framework releases are scanned for automatically.
- Enquiry forms on professional-services sites collect sensitive client details, so a compromise can quickly become a notifiable breach.
Patch and hardening steps
- Find your exact versions. Ask your agency for the installed silverstripe/framework and silverstripe/cms versions (composer.lock) and the PHP version. The jQuery version is usually visible in the theme's script URL.
- Back up first (files and database), and keep the backup off the server.
- Update Silverstripe CMS to at least: CMS 6 / silverstripe-mfa 6.0.0; 6.2.1. Move off any end-of-life branch.
- Update PHP to at least: 8.2.35, 8.3.36, 8.4.27, 8.5.12; 8.1.29, 8.2.20, 8.3.8. Move off any end-of-life branch.
- Update jQuery to at least: 3.5.0. Move off any end-of-life branch.
- Remove unused plugins, apps, themes and accounts, and turn on automatic updates for minor and security releases where available.
- Lock down admin: Enable multi-factor authentication for every CMS user, remove old agency and staff accounts, and restrict access to the /admin area where practical.
- Check for signs of compromise after patching a KEV-listed flaw: unknown admin users, unexpected new files on the server, changed checkout or header scripts.
- Follow a patching cadence. The ACSC's Essential Eight treats patching applications as a core mitigation.
What this means for your industry
Healthcare clinics, allied health, legal and accounting practices often run a CMS such as WordPress or Silverstripe for bookings and enquiry forms, which collect sensitive personal information. A compromise can become a notifiable data breach: see data breach help for Australian businesses. Industry-specific guides are coming.
Melbourne or Victorian public-sector supplier? See Melbourne and Victorian breach contacts. We will cover reported incidents involving these technologies in our Australian breach news.
Want a second pair of eyes on your stack?
Book a short call and one of our developers will talk through your versions and patch plan. No pressure, no scare tactics.
Frequently asked questions
Is jQuery 3.4.1 a real risk?
NVD lists all jQuery versions before 3.5.0 as affected by CVE-2020-11023 and CISA added it to the KEV catalog in January 2025. Whether your site is exploitable depends on how the theme uses jQuery with untrusted HTML, so treat it as 'may be affected' and upgrade. Source
How long is Silverstripe CMS 5 supported?
Silverstripe publishes a support timeline with full and partial support windows per minor version. Partial support covers high-severity security fixes only. Source
Are there CMS 5 issues fixed only in CMS 6?
Yes. For example, NVD says CVE-2026-55186 (MFA bypass via password reset) affects CMS 5 and is fixed in silverstripe-mfa 6.0.0. Source
I think our site was compromised. What first?
Contain it, keep logs, reset CMS passwords, report to the ACSC and assess whether the Notifiable Data Breaches scheme applies. Source
Related stack guides
- Drupal and PHP stack breach guide
- Adobe Commerce (Magento) and PHP stack breach guide
- Next.js, React and Node.js stack breach guide
- PHP + WordPress stack breach guide
- Shopify store security guide
- Webflow and hosted CMS security guide
- WordPress, PHP and Node.js stack breach guide
- WooCommerce, WordPress and PHP stack breach guide
- All stack security guides
Sources
- www.silverstripe.org/software/roadmap/
- nvd.nist.gov/vuln/detail/CVE-2026-55186
- github.com/silverstripe/silverstripe-mfa/commit/04a102b662ac2f555acc26f8d2e2d8dab3937a6a
- nvd.nist.gov/vuln/detail/CVE-2026-54717
- www.php.net/supported-versions.php
- nvd.nist.gov/vuln/detail/CVE-2026-109618
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618
- github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
- www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
- nvd.nist.gov/vuln/detail/CVE-2026-109619
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619
- github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- nvd.nist.gov/vuln/detail/CVE-2024-4577
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4577
- www.php.net/ChangeLog-8.php
- github.com/jquery/jquery/security
- nvd.nist.gov/vuln/detail/CVE-2020-11023
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11023
- github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6
- blog.jquery.com/2020/04/10/jquery-3-5-0-released/
- nvd.nist.gov/vuln/detail/CVE-2020-11022
- www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight
General information only, not legal or professional advice. Versions and CVEs change quickly; always confirm against the vendor before acting.