Statamic 6 security depends on keeping up with releases

New releases often include security fixes, so a site that was fully up to date a month ago may not be today. Keeping up with updates is the best protection you have against known security flaws.

New vulnerabilities are found all the time, and that's one of the main reasons Statamic releases new versions so often. There were five updates in September alone.

Statamic is a well-maintained, secure content management system (CMS). Many vulnerabilities only matter with certain settings or features turned on, but you can't know which apply to you without checking. Updating removes the question.

How quickly fixes get exploited

When a security issue is found and fixed in open source software, the project usually publishes a security advisory: a public notice saying what the problem is, which versions are affected, how serious it is, and which release fixes it. Statamic publishes its advisories on GitHub, and that's the place to check first. Many are copied into public databases such as the GitHub Advisory Database and the Open Source Vulnerabilities database (OSV), but not straight away, and not always, so a tool that only checks those databases can miss some.

Security issues are graded low, moderate, high or critical. If your site has a high or critical vulnerability, get it patched sooner rather than later.

The gap between a vulnerability being made public and it being exploited has been getting shorter and shorter. In a Google Cloud blog post, How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends, the security firm Mandiant found that the average time from a fix coming out to the flaw being exploited fell from 63 days in 2018 and 2019 to five days in 2023.

Its latest report, M-Trends 2026: Data, Insights, and Strategies From the Frontlines, puts it at minus seven days, meaning attacks routinely start before a fix is even released.

The average time from a fix coming out to the flaw being exploited fell from 63 days in 2018 and 2019 to five days in 2023.

Artificial intelligence (AI) tools are speeding this up. Two researchers built a system that turns a published advisory into a working exploit in 10 to 15 minutes. It relies on the code and the fix being public, as they are for all open source software.

Why the newest release matters

Statamic usually publishes an advisory within a day of the release that fixes it, sometimes within hours.

Once an advisory is public, anyone can compare the code before and after the fix. A release with no known issues last week can have a published vulnerability today. It's never been more important to keep business software maintained, and the newest release is the only one with every published fix.

How do I check what version of Statamic I'm on?

There are two ways to check.

1. In the Control Panel (CP), open Tools > Updates.

2. On the server, run php please --version in the site's folder.

Checking for yourself

Statamic's security advisories list every advisory Statamic has published and the releases it affects, so you can compare them with the release your site is on.

Being on an out-of-date version isn't the same as being hacked. Many advisories need a specific feature or combination of settings before anyone can exploit them.

What to do next

If you're not sure where your site stands, install Sentinel. It's a free Statamic addon that checks Statamic and the packages your site depends on for updates and known vulnerabilities, then emails you a status report as often as you want. It stays current as new advisories come out.

Sentinel tells you what needs doing. It doesn't do it for you. If you'd rather hand that part over, my monthly website maintenance covers Statamic updates, the packages your site depends on, and a report after each update showing what changed.

Still on Statamic 5? Its security fixes stop in December 2026, so start there.