Resolved after 14 hours 34 minutes, affecting Cluster EU 1 and Cluster US 1 and 1 more, on October 21, 2026.
We have applied the security patch for the recently announced PHP vulnerability and brought the OAuth authentication service back online. You can add new OAuth-based connections and re-authorize existing ones again. No action is required from customers. If your security team chose to wait before rotating credentials, it’s now safe to proceed.
Affected components
Update timeline
- identified Oct 21, 2026, 05:13 PM UTC
Following the PHP security vulnerability announced on October 20 (php2shell), we have taken our OAuth authentication service offline as a precaution while we wait for the patched packages for our infrastructure. Until the service is restored, you can’t add new OAuth-based connections or re-authorize existing ones. Existing connections continue to run normally. This service is separate from the systems that store and process customer data, and we have no indication BlueConic has been targeted. No action is required from customers. We’ll update this page once the patch is applied.
- resolved Oct 22, 2026, 07:48 AM UTC
We have applied the security patch for the recently announced PHP vulnerability and brought the OAuth authentication service back online. You can add new OAuth-based connections and re-authorize existing ones again. No action is required from customers. If your security team chose to wait before rotating credentials, it’s now safe to proceed.
Your product runs on more than BlueConic
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services