Another security release for CiviCRM

In a fairly unusual move, CiviCRM has released its second security update (versions 6.16.5, 6.17.1, and 6.10.10 ESR) in two days.

A core team member explains:

This is quite unusual; but tldr -- it's very similar to another highly critical advisory from earlier today. So if we didn't fix it quickly, the odds are that someone else would recognize it soon.

If you were really on the ball and upgraded yesterday afternoon (versions 6.16.4, 6.17.0, and 6.10.9 ESR), you’ll want to upgrade again for this one. I’m re-doing some upgrades myself today.

Why this is a good thing:

First, let’s acknowledge that two security updates in two days is inconvenient. Nobody likes inconvenience.

But it’s also great to know that the CiviCRM security team is catching these things and pushing out the fixes.

Security and convenience will always be trade-offs.
In this case, I recommend trading in favor of security.

Any questions about this, pelase let me hear from you!

All the best,
Allen