Regular Weekly Maintenance - GovCMS
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Nov 03, 2026 - 23:00 AEDT
Scheduled - We are conducting regular maintenance on our systems. The maintenance will last for 7 hours.
Nov 3, 2026 23:00 - Nov 4, 2026 06:00 AEDT
Investigating issue that may be affecting deployments
Update - Investigations are still underway. GitLab has been taken offline for a deeper dive. We will let you know when it’s back up and running.
Nov 03, 2026 - 22:10 AEDT
Update - Investigations are still underway. GitLab has been taken offline for a deeper dive. We will let you know when it’s back up and running.
Nov 03, 2026 - 21:38 AEDT
Update - SSH is unavailable.
- PaaS customers will not be able to SSH into your projects.
- SaaS customers are not impacted.

We are continuing to investigate the issue.
Nov 03, 2026 - 18:49 AEDT
Investigating - We’re currently investigating an infrastructure issue that may be affecting deployments.
Bulk deployments to non-production environments has been paused.
Nov 03, 2026 - 15:19 AEDT
Notice of upcoming GovCMS lagoon update 11.4.0.1
Update - Deployments of Lagoon 11.4.0.1 are complete for production sites and are now commencing on non-prod sites.
The deployment block has been lifted.
Nov 03, 2026 - 11:13 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Nov 03, 2026 - 06:00 AEDT
Scheduled - Advice
We would like to inform you the upcoming GovCMS Drupal 11 (D11) lagoon release and deployment. This is a lagoon only deployment. There is no need for a SaaS deployment block, nor will there be any post deployment actions eg configuration export. PaaS deployments schedules are not impacted.

SaaS deployment schedule:
- Deployment to commence from 6:00am AEDT Tuesday 3 November 2026 and will be conducted throughout the daytime.
- Production branches completed by 10:00am AEDT Wednesday 4 November 2026
- Non-Production branches completed by 10:00am AEDT Thursday 5 November 2026

PaaS Actions
Please ensure you address https://www.drupal.org/sa-contrib-2026-286 if required. The SLA for this one is Thursday 5 November 2026.
- If you are using the default scaffold and have scaffold-tooling in composer.json, then run composer update govcms/scaffold-tooling
- If you include stage_file_proxy in composer.json yourself then run composer update drupal/stage_file_proxy
- If you don't use stage file proxy, then don't worry no action required

If you have any concerns, raise a ticket at https://www.govcms.support
Nov 3, 2026 06:00 - Nov 7, 2026 10:00 AEDT

About This Site

GovCMS: Content management and website hosting for the Australian government. Managed by the Department of Finance with service delivery partners Salsa Digital and amazee.io

Uptime over the past 90 days. View historical uptime.
GovCMS Hosting and Infrastructure Under Maintenance
Hosting Infrastructure (Amazon EKS) Under Maintenance
Akamai CDN cache Operational
AWS Compute (Sydney) Operational
AWS S3 Storage (Sydney) Operational
AWS LoadBalancer (Sydney) Operational
GovCMS E-mail relay (AWS Simple Email Service) Operational
HTTPS Redirect Service Operational
GovCMS Projects Under Maintenance
Individual websites Under Maintenance
GovCMS Sites Dashboard Operational
GovCMS Sites Logging System (OpenSearch) Operational
GovCMS GitLab Operational
Deployment Infrastructure Under Maintenance
Lagoon API Under Maintenance
Akamai API Operational
Lagoon tasks Operational
GovCMS Service Desk (Freshdesk) Operational
Freshdesk email notifications Operational
Freshdesk search Operational
Freshdesk incoming emails Operational
Freshdesk outgoing emails Operational
Other Operational
Pygmy Operational
Docker Desktop Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance
Major outage
Partial outage
No downtime recorded on this day.
No data exists for this day.
had a major outage.
had a partial outage.

No incidents or maintenance related to this downtime.

Scheduled Maintenance

Regular Weekly Maintenance - GovCMS Nov 10, 2026 23:00 - Nov 11, 2026 06:00 AEDT

We are conducting regular maintenance on our systems. The maintenance will last for 7 hours.
Posted on Nov 03, 2026 - 07:00 AEDT

Nov 4, 2026

No incidents reported today.

Nov 3, 2026

Unresolved incidents: Regular Weekly Maintenance - GovCMS, Investigating issue that may be affecting deployments, Notice of upcoming GovCMS lagoon update 11.4.0.1.

Nov 2, 2026

No incidents reported.

Nov 1, 2026

No incidents reported.

Oct 31, 2026

Emergency Maintenance - Addressing CVE-2026-98432
Completed - The scheduled maintenance has been completed.
Oct 31, 06:00 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 30, 23:00 AEDT
Scheduled - We are aware of the recently disclosed Linux kernel vulnerability CVE-2026-98432 and will perform emergency maintenance to apply the updates required.

The work will take place during regular maintenance hours. During the maintenance, your sites may experience minor disruption to service
Oct 30, 15:56 AEDT

Oct 30, 2026

Oct 29, 2026

No incidents reported.

Oct 28, 2026

FYI: Notice of upcoming GovCMS D11 release 4.6.0
Completed - The scheduled maintenance has been completed.
Oct 28, 10:40 AEDT
Update - Deployment of GovCMS D11 release 4.6.0 is complete for production sites and is now commencing on non-production sites. The deployment block has now been lifted.
Oct 27, 13:39 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 27, 06:00 AEDT
Scheduled - Advice
GovCMS will release the Drupal 11 (D11) distribution on Monday 26 October 2026. It addresses recent security advisories issued by Drupal.org. GovCMS assessed the MODERATELY CRITICAL risk as they applied to D11 distribution, subsequently the security residual risk remained MODERATELY CRITICAL. The D11 distribution will continue to be supported after this update.

Thank you to everyone who reviewed their preview environment/s. This is the corresponding release to production that includes the Drupal Core 11.4.* and PHP 8.4.* updates.

SaaS Deployment schedule plan:
- Production and Non-Production deployments commence from 6:00AM (AEDT) Tuesday 27 October 2026.
- Production environments completed by 3:00PM (AEDT) Tuesday 27 October 2026.
- Non-Production environments completed by 10:00am (AEDT) Wednesday 28 October 2026.
- PaaS deployments schedules are not impacted.

Subscribe to the GovCMS Status Page https://communications.finance.gov.au/link/id/zzzz6adeec5dbe9a6165Pzzzz6abc64fd96aa8976/page.html to get real-time deployment updates.

Core Update:
Update drupal/core from 11.3.19 to 11.4.10
- https://www.drupal.org/project/drupal/releases/11.4.10

Modules updated:

Update drupal/symfony_mailer module from 1.6.2 to 2.0.2
- https://www.drupal.org/project/symfony_mailer/releases/2.0.2
Update drupal/pathauto module from 1.14.0 to 1.15.0
- https://www.drupal.org/project/pathauto/releases/8.x-1.15
Update drupal/events_log_track module from 4.0.2 to 5.0.0
- https://www.drupal.org/project/events_log_track/releases/5.0.0
Update drupal/modifiers module from 1.6.0 to 1.8.0
- https://www.drupal.org/project/modifiers/releases/8.x-1.8
Update drupal/search_api_solr module from 4.3.10 to 4.4.0
- https://www.drupal.org/project/search_api_solr/releases/4.4.0
Update drupal/entity_class_formatter module from 2.0.1 to 2.0.2
- https://www.drupal.org/project/entity_class_formatter/releases/2.0.2
Update drupal/encrypt module from 3.2.0 to 3.3.0
- https://www.drupal.org/project/encrypt/releases/8.x-3.3
Update drupal/entity_reference_display module from 2.0.5 to 2.0.6
- https://www.drupal.org/project/entity_reference_display/releases/2.0.6
Update drupal/ctools module from 4.1.0 to 4.1.1
- https://www.drupal.org/project/ctools/releases/4.1.1
Update drupal/paragraphs module from 1.21.0 to 1.23.0
- https://www.drupal.org/project/paragraphs/releases/8.x-1.23
Update drupal/dynamic_entity_reference module from 3.2.2 to 3.2.3
- https://www.drupal.org/project/dynamic_entity_reference/releases/3.2.3
Update drupal/recaptcha module from 3.4.0 to 3.5.0
- https://www.drupal.org/project/recaptcha/releases/8.x-3.5
Update drupal/focal_point module from 2.1.2 to 2.1.3
- https://www.drupal.org/project/focal_point/releases/2.1.3
Update drupal/linked_field module from 1.7.0 to 1.8.0
- https://www.drupal.org/project/linked_field/releases/8.x-1.8
Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200
- https://www.drupal.org/sa-contrib-2026-200

What modules are added /removed in the distribution?

- drupal/jsonapi_extras module has been added to GOVCMSD11
- admin_toolbar_links_access_filter module has been removed from GOVCMSD11

Note: After upgrading to GovCMS 4.6.0, importing outdated symfony_mailer configuration will restore settings that the module’s update hook removed, and will cause regressions in the email feature.

Theme update reminders:

The following two themes have current Drupal Security Advisories. The theme is your responsibility; you will need to ensure it is updated prior to the deadlines:

Gin Admin Theme:
This Moderately Critical Advisory was published on 14 October 2026.
The deadline for this Moderately Critical advisory is 14 November 2026.
For more information: Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219
- https://www.drupal.org/sa-contrib-2026-219

Bootstrap Theme
This Moderately Critical Advisory was published on 21 October 2026.
The deadline for this Moderately Critical advisory is 21 November 2026.
For more information: Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236
- https://www.drupal.org/sa-contrib-2026-236

SaaS actions
All D11 SaaS customers will need to check their website after the deployment to ensure there aren’t any issues.

❗ IMPORTANT NOTICE 1: deployments during maintenance window

During the scheduled maintenance window, ALL D11 SaaS deployments will be blocked while we deploy to the D11 master/production environments. While the production block is on, you will still be able to develop and deploy to non-production feature branches.

❗ IMPORTANT NOTICE 2: update local environments

Ensure you update your local environments to the latest release. Not rebasing your codebase results in mismatched database configuration causing errors in forklifts and deployments.

❗ IMPORTANT NOTICE 3: for customers with configuration management enabled

The latest configuration from your production database has been created for you in GitLab in a branch called action-required/latest-config-export. You need to review and test the changes in the merge request. Once you are satisfied, please check the “Delete source branch” box and click “Merge”.

This must be done before any new commits. Not rebasing your codebase could result in your new database configuration reverting to an older version when you next deploy, potentially causing issues for your website.

All subsequent commits will be blocked in the CI pipeline until this merge request branch is deleted.

If no merge request is lodged after a release, then no configuration has changed and no further action is required.

PaaS actions
Update your codebase to ensure you are running the latest platform base images and packages, and stay aligned to GovCMS best practice:

GovCMS distribution

- latest files released on 26 October 2026
- available from GitHub release tag 4.6.0

GovCMS lagoon

- latest files released on 26 October 2026
- available from GitHub release tag 11.4.0

GovCMS scaffold

- latest files released on 15 September 2026
- available from GitHub release tag 4.1.0

GovCMS scaffold-tooling

- latest files released on 20 October 2026
- available from GitHub release tag 6.0.11

More information about how to update this can be found in the Knowledge Base.

In the pipeline

Configuration Management

As mentioned previously, prior to the next scheduled release and update 4.6.0, GovCMS will be implementing a scheduled monthly stale configuration cleanup exercise. For more information see Configuration management - Overview

Campfire

We are holding our first Campfire on Wednesday 28 October 1-2pm AEDT. GovCMS backlog discussion as the first topic. We’ll focus on where module requests have “requires more community feedback/interest”, giving community members an opportunity to discuss needs, share use cases and help shape potential future enhancements.
If you’ve submitted a module request, we’d encourage you to bring it to the campfire and be part of the discussion.
Oct 9, 10:16 AEDT
Regular Weekly Maintenance - GovCMS
Completed - The scheduled maintenance has been completed.
Oct 28, 06:00 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 27, 23:00 AEDT
Scheduled - We are conducting regular maintenance on our systems. The maintenance will last for 7 hours.
Oct 20, 07:00 AEDT

Oct 27, 2026

Oct 26, 2026

No incidents reported.

Oct 25, 2026

No incidents reported.

Oct 24, 2026

No incidents reported.

Oct 23, 2026

Security update: Temporary restriction on GovCMS origin access
Completed - That’s a wrap for the maintenance period of temporarily restricting access to GovCMS origin. At this time, our investigations have not identified any evidence of unauthorised access to or compromise of the GovCMS platform including customer data. We are continuing to assess our systems and applications to determine whether any exposure has occurred and whether further remediation measures are necessary.
Oct 23, 17:42 AEDT
Update - SaaS non-production deployments are now completed - we are completing a few final checks. Within in the next hour you will be able to continue your content editing and publishing.

PaaS Customers, if you have patched your secondary environments, we will be using the same logic to bring origin back online for you so you can continue your content editing.
Oct 23, 11:17 AEDT
Update - All SaaS Deployments are now completed, the deployment block has been lifted. You also now have access to origin and are able to continue your content editing and publishing.

Non production environments are still blocked at origin until non-production deployments are completed.

PaaS Customers, please continue to keep us in the loop. Where you completed your updates we have lifted the content editing block for you as well.

Stay tuned for more updates over the next couple of hours.
Oct 22, 12:58 AEDT
Update - SaaS Deployments are two-thirds of the way through. The sites where the deployment has completed, we have lifted the content editing block. For the remaining sites, at this stage we are anticipating the bulk deployments to be completed at 1230 PM AEDT.

PaaS Customers, please continue to keep us in the loop. Where you have notified us of completion of your updates we are lifting the content editing block for you as well.

Stay tuned for more updates over the next couple of hours.
Oct 22, 10:53 AEDT
Update - PaaS Customers you will need to submit a Service Desk ticket to inform GovCMS of your update plans ASAP. If we haven’t heard from you, from 9:30 AEDT, GovCMS will need to exercise step in rights and update on your behalf.
Oct 22, 07:44 AEDT
Update - SaaS bulk deployments are underway – at this stage, we are anticipating the platform will be available for contented editing from 1030 AM AEDT. Stay tuned for more updates over the next couple of hours.
Oct 22, 06:26 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 21, 19:00 AEDT
Scheduled - Who this affects: GovCMS SaaS & PaaS Community

Advice:
GovCMS have been actively monitoring development and coordinating technical resources to ensure readiness to assess and the PHP vulnerability announced today. Despite a significant amount of work done today by GovCMS to implement further protections we cannot guarantee 100% safety therefore we are heeding advice from cyber.gov.au and other sources to disconnect the platform from the internet.

We are taking urgent protective action to mitigate the critical PHP vulnerabilities by temporarily disabling direct access to the GovCMS origin environment. This restriction helps protect customer websites while we address the vulnerabilities. Access will be restored once the threat has been resolved and it is safe to do so.

Sites will serve web content to the public though Akamai overnight though some sites and lesser visited pages may degrade if not cached. You will be unable to login to your websites overnight.

We will be assessing the CVE when it drops at 1am AEDT Thursday 22 October 2026. We are aiming to be back up and available for content publishing mode by 9am. We will communicate status at 7am if we believe we will not achieve a 9am restoration. If we can bring the platform back online earlier than 9am, we will.

We understand this may disrupt your work and appreciate your patience
Oct 21, 18:58 AEDT
GovCMS Lagoon update 11.3.8.6 (22 October 2026)
Completed - That’s a wrap for the maintenance period of the 11.3.8.6 Lagoon update. The restricted access to non-productions environment has been restored and we’ve rolled back the “force enabled shield on the non-production environments”.
Oct 23, 17:40 AEDT
Update - SaaS non-production deployments are now completed - we are completing a few final checks. Within in the next hour you will be able to continue your content editing and publishing.

We are also rolling back “force enabled shield on the non-production environments”. For agencies that have configured Drupal Shield with an IP allowlist, this will have more of an effect on you, as this rollback can take up to 5 hours to run.

PaaS Customers, if you have patched your secondary environments, we will be using the same logic to bring origin back online for you so you can continue your content editing.
Oct 23, 11:34 AEDT
Update - All SaaS Deployments are now completed, the deployment block has been lifted. You also now have access to origin and are able to continue your content editing and publishing.

Non production environments are still blocked at origin until non-production deployments are completed.

PaaS Customers, please continue to keep us in the loop. Where you completed your updates we have lifted the content editing block for you as well.

Stay tuned for more updates over the next couple of hours.
Oct 22, 12:59 AEDT
Update - Production and non-production deployments have just kicked off.

SaaS Deployment planned schedule:
- Production environments completed by 10:30AM (AEDT) Thursday 22 October 2026.
- Non-Production environments completed by 10:00AM (AEDT) Friday 23 October 2026.
Oct 22, 06:04 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 22, 04:35 AEDT
Scheduled - GovCMS is currently updating the Lagoon base image to 11.3.8.6 to the platform now. And will be kicking off deployments ASAP.

The deployment block remains in place on all SaaS websites and shield remains enabled on all non-production SaaS websites.

SaaS Deployment planned schedule:
- Production and Non-Production deployments commence from 4:30AM (AEDT) Thursday 22 October 2026
- Production environments completed by 9:30AM (AEDT) Thursday 22 October 2026.
- Non-Production environments completed by 10:00AM (AEDT) Friday 23 October 2026.

GovCMS Lagoon update 11.3.8.6 (22 October 2026)
GovCMS is currently updating the Lagoon base image to 11.3.8.6 to the platform now. And will be kicking off deployments ASAP.
The deployment block remains in place on all SaaS websites and shield remains enabled on all non-production SaaS websites.
SaaS Deployment planned schedule:
- Production and Non-Production deployments commence from 4:30AM (AEDT) Thursday 22 October 2026
- Production environments completed by 9:30AM (AEDT) Thursday 22 October 2026.
- Non-Production environments completed by 10:00AM (AEDT) Friday 23 October 2026.
PaaS Actions:
If you are using the GovCMS images, redeploy ASAP to pick up the latest changes. Otherwise update your lagoon images immediately.
Oct 22, 04:31 AEDT
Gitlab upgrade
Completed - The scheduled maintenance has been completed.
Oct 23, 01:37 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 23, 00:37 AEDT
Scheduled - We will be undergoing scheduled maintenance during this time.
Oct 23, 00:36 AEDT

Oct 22, 2026

GovCMS Lagoon update 11.3.8.5
Completed - Closing this maintenance notice for 11.3.4.5, as it has now been superseded by 11.4.3.6 update: https://status.govcms.support/incidents/pb6s5yxqfvp0
Oct 22, 06:06 AEDT
Update - Production deployments are completed. Non-production deployments are still in progress.
Deployment block remains in place.

We will be assessing the CVE when it drops at 1am AEDT Thursday 22 October 2026, and are planning for the next lagoon update early Thursday morning. We will keep you posted.
Oct 21, 19:20 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 21, 15:40 AEDT
Scheduled - GovCMS is currently updating the Lagoon base image to 11.3.8.5 to the platform now. A deployment block has been placed on all SaaS websites.

GovCMS is aware of the current PHP Public Service Announcement. We are actively monitoring development and coordinating technical resources to ensure readiness to assess and address these vulnerabilities.
We will enable shield on all non-production SaaS websites from COB AEDT today.

Please refer to the technical release notes sent today at 2:53PM AEDT for more detailed information, if you didn’t’ receive it please email govcms@finance.gov.au.
Oct 21, 15:37 AEDT

Oct 21, 2026

Regular Weekly Maintenance - GovCMS
Completed - The scheduled maintenance has been completed.
Oct 21, 06:00 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 20, 23:00 AEDT
Scheduled - We are conducting regular maintenance on our systems. The maintenance will last for 7 hours.
Oct 13, 07:00 AEDT
Incident History Powered by Atlassian Statuspage