CMS security updates