diff --git a/en/08_Changelogs/6.3.0.md b/en/08_Changelogs/6.3.0.md
index 49e29aaa..f84af4a1 100644
--- a/en/08_Changelogs/6.3.0.md
+++ b/en/08_Changelogs/6.3.0.md
@@ -19,6 +19,37 @@ title: 6.3.0 (unreleased)
 
 </details>
 
+## Security considerations {#security-considerations}
+
+This release includes several security fixes. Review the vulnerability disclosures below for more detailed descriptions of each security fix. We highly encourage upgrading your project to include the latest security patches.
+
+We have provided a severity rating of each vulnerability below based on its CVSS score. The impact of each vulnerability could vary based on the specifics of each project. You can [read the severity rating definitions](/contributing/release_process/#severity-rating) in the Silverstripe CMS release process.
+
+- [CVE-2026-54721 Remote code execution via userforms email subject](https://www.silverstripe.org/download/security-releases/cve-2026-54721) Severity: High
+- [CVE-2026-54718 Remote code execution via advanced workflow email template](https://www.silverstripe.org/download/security-releases/cve-2026-54718) Severity: High
+- [CVE-2026-54717 XSS in breadcrumbs in page listview](https://www.silverstripe.org/download/security-releases/cve-2026-54717) Severity: Medium
+- [CVE-2026-54720 XSS attack through media embed](https://www.silverstripe.org/download/security-releases/cve-2026-54720) Severity: Medium
+- [CVE-2026-55779 ArchiveAdmin XSS](https://www.silverstripe.org/download/security-releases/cve-2026-55779) Severity: Medium
+
+The root-cause fix for both remote code execution vulnerabilities lives in the template parser, which now emits single-quoted PHP string literals for `<%t %>` translation blocks so that variables and expressions are no longer interpolated.
+
+The high severity fixes have also been released in patches for the CMS 5.4, 6.1, and 6.2 release lines. The medium severity fixes have been released in a patch for the CMS 6.2 release line. That difference follows our [release policy](/project_governance/release_policy/#partial-support): a release line in *partial support* only receives fixes for high and critical impact vulnerabilities, meaning those with a CVSS score of 7.0 or above, while a release line in *full support* receives fixes at any severity. The [Silverstripe CMS security patches June 2026](https://www.silverstripe.org/blog/silverstripe-cms-security-patches-june-2026) blog post lists the same distribution.
+
+### Action may be required for media embeds {#media-embed-sandboxing}
+
+The fix for [CVE-2026-54720](https://www.silverstripe.org/download/security-releases/cve-2026-54720) now strips event-handler and other unsafe attributes from a non-sandboxed `<iframe>` returned by an oEmbed provider. If stripping an attribute breaks a legitimate embed, you can exempt a fully trusted provider's domain from sandboxing with the [`EmbedShortcodeProvider.domains_excluded_from_sandboxing`](api:SilverStripe\View\Shortcodes\EmbedShortcodeProvider->domains_excluded_from_sandboxing) configuration property:
+
+```yml
+# app/_config/embed.yml
+SilverStripe\View\Shortcodes\EmbedShortcodeProvider:
+  domains_excluded_from_sandboxing:
+    - trusted-provider.com
+```
+
+The domain is matched by suffix, so the value above also matches subdomains such as `embed.trusted-provider.com` - and any other domain ending in the same string, including an unrelated `nottrusted-provider.com`. Give the full domain, so you don't match a domain you don't control.
+
+Embeds from an excluded domain render exactly as the provider sends them, and are no longer wrapped in a sandboxed iframe, so only add domains you fully trust. See [sandboxing oembed HTML](/developer_guides/forms/field_types/htmleditorfield/#sandboxing-oembed-html) for more about how sandboxing works.
+
 ## Features and enhancements
 
 ### Other new features and enhancements {#other-new}
@@ -27,7 +58,7 @@ No other new features or enhancements have been documented yet for this release.
 
 ### React class components converted to functional components {#react-functional-components}
 
-Form field components in the CMS have been converted from React class components to functional components. This is part of an ongoing modernisation effort — functional components are simpler, have better tooling support, and align with current React best practices.
+Form field components in the CMS have been converted from React class components to functional components. This is part of an ongoing modernisation effort - functional components are simpler, have better tooling support, and align with current React best practices.
 
 For most projects this change is invisible. However, if your project extends any of these components as an ES6 class (`extends TextField`), that pattern will no longer work because functional components cannot be subclassed.