Minor incident

BlueConic: OAuth connection setup temporarily unavailable

Affected: Cluster EU 1, Cluster US 1, Sandbox US 1, Cluster APAC 1, Cluster CA 1, ADM instances, Cluster EU 2, Cluster US 2, Sandbox US 2, Cluster EU 3, Cluster US 3, Sandbox EU 1, Cluster US 4, Cluster EU 4, Sandbox CA 1, Cluster US 5, Sandbox EU 2, Cluster EU 6, Cluster EU 7, Cluster US 8, Cluster EU 8, Cluster EU 9, Cluster US 10, Cluster EU 10, Cluster US 11, Cluster EU 11, Cluster US 12, Cluster EU 12, Cluster US 14, Cluster US 16, Cluster US 17, Cluster US 18, Cluster US 19, Cluster US 20

Current status of BlueConic: Operational — live BlueConic status

Timeline

1. Oct 21, 2026, 17:13 UTC
   identified
   Following the PHP security vulnerability announced on October 20 (php2shell), we have taken our OAuth authentication service offline as a precaution while we wait for the patched packages for our infrastructure. Until the service is restored, you can’t add new OAuth-based connections or re-authorize existing ones. Existing connections continue to run normally. This service is separate from the systems that store and process customer data, and we have no indication BlueConic has been targeted. No action is required from customers. We’ll update this page once the patch is applied.
2. Oct 22, 2026, 07:48 UTC
   resolved
   We have applied the security patch for the recently announced PHP vulnerability and brought the OAuth authentication service back online. You can add new OAuth-based connections and re-authorize existing ones again. No action is required from customers. If your security team chose to wait before rotating credentials, it’s now safe to proceed.

Updates as published by BlueConic (original).