GovCMS Status

All Systems Operational

About This Site

GovCMS: Content management and website hosting for the Australian government. Managed by the Department of Finance with service delivery partners Salsa Digital and amazee.io

Uptime over the past 90 days. View historical uptime.

GovCMS Hosting and Infrastructure Operational

Hosting Infrastructure (Amazon EKS) Operational

Akamai CDN cache Operational

AWS Compute (Sydney) Operational

AWS S3 Storage (Sydney) Operational

AWS LoadBalancer (Sydney) Operational

GovCMS E-mail relay (AWS Simple Email Service) Operational

HTTPS Redirect Service Operational

GovCMS Projects Operational

Individual websites Operational

GovCMS Sites Dashboard Operational

GovCMS Sites Logging System (OpenSearch) Operational

GovCMS GitLab Operational

Deployment Infrastructure Operational

Lagoon API Operational

Akamai API Operational

Lagoon tasks Operational

GovCMS Service Desk (Freshdesk) Operational

Freshdesk email notifications Operational

Freshdesk search Operational

Freshdesk incoming emails Operational

Freshdesk outgoing emails Operational

Other Operational

Pygmy Operational

Docker Desktop Operational

Operational

Degraded Performance

Partial Outage

Major Outage

Maintenance

Scheduled Maintenance

Emergency Maintenance - Addressing CVE-2026-98432 Oct `30`, `2026` `23:00` - Oct `31`, `2026` `06:00` AEDT

We are aware of the recently disclosed Linux kernel vulnerability CVE-2026-98432 and will perform emergency maintenance to apply the updates required.

The work will take place during regular maintenance hours. During the maintenance, your sites may experience minor disruption to service
Posted on Oct 30, 2026 - 15:56 AEDT

Notice of upcoming GovCMS lagoon update 11.4.0.1 Nov `3`, `2026` `06:00` - Nov `7`, `2026` `10:00` AEDT

Advice
We would like to inform you the upcoming GovCMS Drupal 11 (D11) lagoon release and deployment. This is a lagoon only deployment. There is no need for a SaaS deployment block, nor will there be any post deployment actions eg configuration export. PaaS deployments schedules are not impacted.

SaaS deployment schedule:
- Deployment to commence from 6:00am AEDT Tuesday 3 November 2026 and will be conducted throughout the daytime.
- Production branches completed by 10:00am AEDT Wednesday 4 November 2026
- Non-Production branches completed by 10:00am AEDT Thursday 5 November 2026

If you have any concerns, raise a ticket at https://www.govcms.support
Posted on Oct 30, 2026 - 16:47 AEDT

Regular Weekly Maintenance - GovCMS Nov `3`, `2026` `23:00` - Nov `4`, `2026` `06:00` AEDT

We are conducting regular maintenance on our systems. The maintenance will last for 7 hours.
Posted on Oct 27, 2026 - 07:00 AEDT

Past Incidents

Oct `30`, `2026`

No incidents reported today.

Oct `29`, `2026`

No incidents reported.

Oct `28`, `2026`

FYI: Notice of upcoming GovCMS D11 release 4.6.0

Completed - The scheduled maintenance has been completed.
Oct 28, 10:40 AEDT

Update - Deployment of GovCMS D11 release 4.6.0 is complete for production sites and is now commencing on non-production sites. The deployment block has now been lifted.
Oct 27, 13:39 AEDT

In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 27, 06:00 AEDT

Scheduled - Advice
GovCMS will release the Drupal 11 (D11) distribution on Monday 26 October 2026. It addresses recent security advisories issued by Drupal.org. GovCMS assessed the MODERATELY CRITICAL risk as they applied to D11 distribution, subsequently the security residual risk remained MODERATELY CRITICAL. The D11 distribution will continue to be supported after this update.

Thank you to everyone who reviewed their preview environment/s. This is the corresponding release to production that includes the Drupal Core 11.4.* and PHP 8.4.* updates.

SaaS Deployment schedule plan:
- Production and Non-Production deployments commence from 6:00AM (AEDT) Tuesday 27 October 2026.
- Production environments completed by 3:00PM (AEDT) Tuesday 27 October 2026.
- Non-Production environments completed by 10:00am (AEDT) Wednesday 28 October 2026.
- PaaS deployments schedules are not impacted.

Subscribe to the GovCMS Status Page https://communications.finance.gov.au/link/id/zzzz6adeec5dbe9a6165Pzzzz6abc64fd96aa8976/page.html to get real-time deployment updates.

Core Update:
Update drupal/core from 11.3.19 to 11.4.10
- https://www.drupal.org/project/drupal/releases/11.4.10

Modules updated:

Update drupal/symfony_mailer module from 1.6.2 to 2.0.2
- https://www.drupal.org/project/symfony_mailer/releases/2.0.2
Update drupal/pathauto module from 1.14.0 to 1.15.0
- https://www.drupal.org/project/pathauto/releases/8.x-1.15
Update drupal/events_log_track module from 4.0.2 to 5.0.0
- https://www.drupal.org/project/events_log_track/releases/5.0.0
Update drupal/modifiers module from 1.6.0 to 1.8.0
- https://www.drupal.org/project/modifiers/releases/8.x-1.8
Update drupal/search_api_solr module from 4.3.10 to 4.4.0
- https://www.drupal.org/project/search_api_solr/releases/4.4.0
Update drupal/entity_class_formatter module from 2.0.1 to 2.0.2
- https://www.drupal.org/project/entity_class_formatter/releases/2.0.2
Update drupal/encrypt module from 3.2.0 to 3.3.0
- https://www.drupal.org/project/encrypt/releases/8.x-3.3
Update drupal/entity_reference_display module from 2.0.5 to 2.0.6
- https://www.drupal.org/project/entity_reference_display/releases/2.0.6
Update drupal/ctools module from 4.1.0 to 4.1.1
- https://www.drupal.org/project/ctools/releases/4.1.1
Update drupal/paragraphs module from 1.21.0 to 1.23.0
- https://www.drupal.org/project/paragraphs/releases/8.x-1.23
Update drupal/dynamic_entity_reference module from 3.2.2 to 3.2.3
- https://www.drupal.org/project/dynamic_entity_reference/releases/3.2.3
Update drupal/recaptcha module from 3.4.0 to 3.5.0
- https://www.drupal.org/project/recaptcha/releases/8.x-3.5
Update drupal/focal_point module from 2.1.2 to 2.1.3
- https://www.drupal.org/project/focal_point/releases/2.1.3
Update drupal/linked_field module from 1.7.0 to 1.8.0
- https://www.drupal.org/project/linked_field/releases/8.x-1.8
Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200
- https://www.drupal.org/sa-contrib-2026-200

What modules are added /removed in the distribution?

- drupal/jsonapi_extras module has been added to GOVCMSD11
- admin_toolbar_links_access_filter module has been removed from GOVCMSD11

Note: After upgrading to GovCMS 4.6.0, importing outdated symfony_mailer configuration will restore settings that the module’s update hook removed, and will cause regressions in the email feature.

Theme update reminders:

The following two themes have current Drupal Security Advisories. The theme is your responsibility; you will need to ensure it is updated prior to the deadlines:

Gin Admin Theme:
This Moderately Critical Advisory was published on 14 October 2026.
The deadline for this Moderately Critical advisory is 14 November 2026.
For more information: Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219
- https://www.drupal.org/sa-contrib-2026-219

Bootstrap Theme
This Moderately Critical Advisory was published on 21 October 2026.
The deadline for this Moderately Critical advisory is 21 November 2026.
For more information: Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236
- https://www.drupal.org/sa-contrib-2026-236

SaaS actions
All D11 SaaS customers will need to check their website after the deployment to ensure there aren’t any issues.

❗ IMPORTANT NOTICE 1: deployments during maintenance window

During the scheduled maintenance window, ALL D11 SaaS deployments will be blocked while we deploy to the D11 master/production environments. While the production block is on, you will still be able to develop and deploy to non-production feature branches.

❗ IMPORTANT NOTICE 2: update local environments

Ensure you update your local environments to the latest release. Not rebasing your codebase results in mismatched database configuration causing errors in forklifts and deployments.

❗ IMPORTANT NOTICE 3: for customers with configuration management enabled

The latest configuration from your production database has been created for you in GitLab in a branch called action-required/latest-config-export. You need to review and test the changes in the merge request. Once you are satisfied, please check the “Delete source branch” box and click “Merge”.

This must be done before any new commits. Not rebasing your codebase could result in your new database configuration reverting to an older version when you next deploy, potentially causing issues for your website.

All subsequent commits will be blocked in the CI pipeline until this merge request branch is deleted.

If no merge request is lodged after a release, then no configuration has changed and no further action is required.

PaaS actions
Update your codebase to ensure you are running the latest platform base images and packages, and stay aligned to GovCMS best practice:

GovCMS distribution

- latest files released on 26 October 2026
- available from GitHub release tag 4.6.0

GovCMS lagoon

- latest files released on 26 October 2026
- available from GitHub release tag 11.4.0

GovCMS scaffold

- latest files released on 15 September 2026
- available from GitHub release tag 4.1.0

GovCMS scaffold-tooling

- latest files released on 20 October 2026
- available from GitHub release tag 6.0.11

More information about how to update this can be found in the Knowledge Base.

In the pipeline

Configuration Management

As mentioned previously, prior to the next scheduled release and update 4.6.0, GovCMS will be implementing a scheduled monthly stale configuration cleanup exercise. For more information see Configuration management - Overview

Campfire

We are holding our first Campfire on Wednesday 28 October 1-2pm AEDT. GovCMS backlog discussion as the first topic. We’ll focus on where module requests have “requires more community feedback/interest”, giving community members an opportunity to discuss needs, share use cases and help shape potential future enhancements.
If you’ve submitted a module request, we’d encourage you to bring it to the campfire and be part of the discussion.
Oct 9, 10:16 AEDT

Regular Weekly Maintenance - GovCMS

Completed - The scheduled maintenance has been completed.
Oct 28, 06:00 AEDT

In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 27, 23:00 AEDT

Scheduled - We are conducting regular maintenance on our systems. The maintenance will last for 7 hours.
Oct 20, 07:00 AEDT

Oct `27`, `2026`

Oct `26`, `2026`

No incidents reported.

Oct `25`, `2026`

No incidents reported.

Oct `24`, `2026`

No incidents reported.

Oct `23`, `2026`

Security update: Temporary restriction on GovCMS origin access

Completed - That’s a wrap for the maintenance period of temporarily restricting access to GovCMS origin. At this time, our investigations have not identified any evidence of unauthorised access to or compromise of the GovCMS platform including customer data. We are continuing to assess our systems and applications to determine whether any exposure has occurred and whether further remediation measures are necessary.
Oct 23, 17:42 AEDT

Update - SaaS non-production deployments are now completed - we are completing a few final checks. Within in the next hour you will be able to continue your content editing and publishing.

PaaS Customers, if you have patched your secondary environments, we will be using the same logic to bring origin back online for you so you can continue your content editing.
Oct 23, 11:17 AEDT

Update - All SaaS Deployments are now completed, the deployment block has been lifted. You also now have access to origin and are able to continue your content editing and publishing.

Non production environments are still blocked at origin until non-production deployments are completed.

PaaS Customers, please continue to keep us in the loop. Where you completed your updates we have lifted the content editing block for you as well.

Stay tuned for more updates over the next couple of hours.
Oct 22, 12:58 AEDT

Update - SaaS Deployments are two-thirds of the way through. The sites where the deployment has completed, we have lifted the content editing block. For the remaining sites, at this stage we are anticipating the bulk deployments to be completed at 1230 PM AEDT.

PaaS Customers, please continue to keep us in the loop. Where you have notified us of completion of your updates we are lifting the content editing block for you as well.

Stay tuned for more updates over the next couple of hours.
Oct 22, 10:53 AEDT

Update - PaaS Customers you will need to submit a Service Desk ticket to inform GovCMS of your update plans ASAP. If we haven’t heard from you, from 9:30 AEDT, GovCMS will need to exercise step in rights and update on your behalf.
Oct 22, 07:44 AEDT

Update - SaaS bulk deployments are underway – at this stage, we are anticipating the platform will be available for contented editing from 1030 AM AEDT. Stay tuned for more updates over the next couple of hours.
Oct 22, 06:26 AEDT

In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 21, 19:00 AEDT

Scheduled - Who this affects: GovCMS SaaS & PaaS Community

Advice:
GovCMS have been actively monitoring development and coordinating technical resources to ensure readiness to assess and the PHP vulnerability announced today. Despite a significant amount of work done today by GovCMS to implement further protections we cannot guarantee 100% safety therefore we are heeding advice from cyber.gov.au and other sources to disconnect the platform from the internet.

We are taking urgent protective action to mitigate the critical PHP vulnerabilities by temporarily disabling direct access to the GovCMS origin environment. This restriction helps protect customer websites while we address the vulnerabilities. Access will be restored once the threat has been resolved and it is safe to do so.

Sites will serve web content to the public though Akamai overnight though some sites and lesser visited pages may degrade if not cached. You will be unable to login to your websites overnight.

We will be assessing the CVE when it drops at 1am AEDT Thursday 22 October 2026. We are aiming to be back up and available for content publishing mode by 9am. We will communicate status at 7am if we believe we will not achieve a 9am restoration. If we can bring the platform back online earlier than 9am, we will.

We understand this may disrupt your work and appreciate your patience
Oct 21, 18:58 AEDT

GovCMS Lagoon update 11.3.8.6 (22 October 2026)

Completed - That’s a wrap for the maintenance period of the 11.3.8.6 Lagoon update. The restricted access to non-productions environment has been restored and we’ve rolled back the “force enabled shield on the non-production environments”.
Oct 23, 17:40 AEDT

Update - SaaS non-production deployments are now completed - we are completing a few final checks. Within in the next hour you will be able to continue your content editing and publishing.

We are also rolling back “force enabled shield on the non-production environments”. For agencies that have configured Drupal Shield with an IP allowlist, this will have more of an effect on you, as this rollback can take up to 5 hours to run.

PaaS Customers, if you have patched your secondary environments, we will be using the same logic to bring origin back online for you so you can continue your content editing.
Oct 23, 11:34 AEDT

Update - Production and non-production deployments have just kicked off.

SaaS Deployment planned schedule:
- Production environments completed by 10:30AM (AEDT) Thursday 22 October 2026.
- Non-Production environments completed by 10:00AM (AEDT) Friday 23 October 2026.
Oct 22, 06:04 AEDT

In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 22, 04:35 AEDT

Scheduled - GovCMS is currently updating the Lagoon base image to 11.3.8.6 to the platform now. And will be kicking off deployments ASAP.

The deployment block remains in place on all SaaS websites and shield remains enabled on all non-production SaaS websites.

SaaS Deployment planned schedule:
- Production and Non-Production deployments commence from 4:30AM (AEDT) Thursday 22 October 2026
- Production environments completed by 9:30AM (AEDT) Thursday 22 October 2026.
- Non-Production environments completed by 10:00AM (AEDT) Friday 23 October 2026.

GovCMS Lagoon update 11.3.8.6 (22 October 2026)
GovCMS is currently updating the Lagoon base image to 11.3.8.6 to the platform now. And will be kicking off deployments ASAP.
The deployment block remains in place on all SaaS websites and shield remains enabled on all non-production SaaS websites.
SaaS Deployment planned schedule:
- Production and Non-Production deployments commence from 4:30AM (AEDT) Thursday 22 October 2026
- Production environments completed by 9:30AM (AEDT) Thursday 22 October 2026.
- Non-Production environments completed by 10:00AM (AEDT) Friday 23 October 2026.
PaaS Actions:
If you are using the GovCMS images, redeploy ASAP to pick up the latest changes. Otherwise update your lagoon images immediately.
Oct 22, 04:31 AEDT

Gitlab upgrade

Completed - The scheduled maintenance has been completed.
Oct 23, 01:37 AEDT

In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 23, 00:37 AEDT

Scheduled - We will be undergoing scheduled maintenance during this time.
Oct 23, 00:36 AEDT

Oct `22`, `2026`

GovCMS Lagoon update 11.3.8.5

Completed - Closing this maintenance notice for 11.3.4.5, as it has now been superseded by 11.4.3.6 update: https://status.govcms.support/incidents/pb6s5yxqfvp0
Oct 22, 06:06 AEDT

Update - Production deployments are completed. Non-production deployments are still in progress.
Deployment block remains in place.

We will be assessing the CVE when it drops at 1am AEDT Thursday 22 October 2026, and are planning for the next lagoon update early Thursday morning. We will keep you posted.
Oct 21, 19:20 AEDT

In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 21, 15:40 AEDT

Scheduled - GovCMS is currently updating the Lagoon base image to 11.3.8.5 to the platform now. A deployment block has been placed on all SaaS websites.

GovCMS is aware of the current PHP Public Service Announcement. We are actively monitoring development and coordinating technical resources to ensure readiness to assess and address these vulnerabilities.
We will enable shield on all non-production SaaS websites from COB AEDT today.

Please refer to the technical release notes sent today at 2:53PM AEDT for more detailed information, if you didn’t’ receive it please email govcms@finance.gov.au.
Oct 21, 15:37 AEDT

Oct `21`, `2026`

Regular Weekly Maintenance - GovCMS

Completed - The scheduled maintenance has been completed.
Oct 21, 06:00 AEDT

In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 20, 23:00 AEDT

Scheduled - We are conducting regular maintenance on our systems. The maintenance will last for 7 hours.
Oct 13, 07:00 AEDT

Oct `20`, `2026`

Oct `19`, `2026`

Cluster maintenance

Completed - The scheduled maintenance has been completed.
Oct 19, 08:30 AEDT

In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 19, 06:30 AEDT

Scheduled - We will be performing cluster maintenance, there will be a brief disruption of a few minutes to the Lagoon API and dashboard during this time. No disruption to running sites.
Oct 14, 09:25 AEDT

Oct `18`, `2026`

No incidents reported.

Oct `17`, `2026`

No incidents reported.

Oct `16`, `2026`

Notice of upcoming GovCMS hotfix 4.5.1.2

Completed - The scheduled maintenance has been completed.
Oct 16, 09:52 AEDT

Update - Deployment of GovCMS hotfix 4.5.1.2 is complete for production sites and is now commencing on non-production sites. The deployment block has now been lifted.
Oct 15, 21:45 AEDT

In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 15, 12:00 AEDT

Scheduled - Advice:
GovCMS will release the Drupal 11 (D11) distribution on Thursday 15 October 2026. It addresses recent security advisories issued by Drupal.org. GovCMS assessed the CRITICAL risk as they applied to D11 distribution, subsequently the security residual risk remained CRITICAL. The D11 distribution will continue to be supported after this update.

In preparation for this release, shield was enabled on all non-production environments from COB Wednesday 14 October 2026. The shield credentials have been randomly generated for each non-production environment. To retrieve the details, login to the Dashboard, and you’ll find the credentials stored in `BASIC_AUTH_USERNAME` and `BASIC_AUTH_PASSWORD` environment variables for each environment.

SaaS Deployment schedule:
- Production and Non-Production deployments commence from 12:00PM (AEST) Thursday 15 October 2026
- Production environments completed by 7:00PM (AEST) Thursday 15 October 2026.
- Non-Production environments completed by COB (AEST) Friday 16 October 2026.
- PaaS deployments schedules are not impacted.

Core Update:
Update Drupal Core from 11.3.17 to 11.3.19
- https://www.drupal.org/project/drupal/releases/11.3.19
- https://www.drupal.org/sa-core-2026-014
- https://www.drupal.org/sa-core-2026-015
- https://www.drupal.org/sa-core-2026-016

What modules are added /removed in the distribution?
- No modules were added/removed from the distribution

Website using Gin Admin Theme
Please be aware there is also a DSA regarding the Gin admin theme. The theme is your responsibility please ensure it updated within 30 days: https://www.drupal.org/sa-contrib-2026-219

PaaS Actions:
The Critical Drupal Security Advisory will need be assessed and addressed as it pertains to your websites. Given the nature of the security announcement, this exploit with the help of AI, could develop within hours or days to highly critical changing the SLA requirements for patching. As a result, GovCMS will patch the distribution inline with highly critical SLA (within 48hrs) and we urge you to do the same.

If you are not in a position to do a release and deployment immediately, we recommend uninstalling the field UI module in the meantime.

Update your codebase to ensure you are running the latest platform base images and packages, and stay aligned to GovCMS best practice:
- GovCMS distribution (15 October 2026) > https://github.com/govCMS/GovCMS/releases/tag/4.5.1.2
- GovCMS lagoon (15 October 2026) > https://github.com/govCMS/lagoon/releases/tag/11.3.8.4
- GovCMS scaffold (15 September 2026) > https://github.com/govCMS/scaffold/releases/tag/4.1.0
- GovCMS scaffold-tooling (17 September 2026) > https://github.com/govCMS/scaffold-tooling/releases/tag/6.0.10

If you have any concerns, raise a ticket at https://www.govcms.support
Oct 13, 15:19 AEDT

All Systems Operational

About This Site

Related

Scheduled Maintenance

Emergency Maintenance - Addressing CVE-2026-98432 Oct 30, 2026 23:00 - Oct 31, 2026 06:00 AEDT

Notice of upcoming GovCMS lagoon update 11.4.0.1 Nov 3, 2026 06:00 - Nov 7, 2026 10:00 AEDT

Regular Weekly Maintenance - GovCMS Nov 3, 2026 23:00 - Nov 4, 2026 06:00 AEDT

Past Incidents

Oct 30, 2026

Oct 29, 2026

Oct 28, 2026

Oct 27, 2026

Oct 26, 2026

Oct 25, 2026

Oct 24, 2026

Oct 23, 2026

Oct 22, 2026

Oct 21, 2026

Oct 20, 2026

Oct 19, 2026

Oct 18, 2026

Oct 17, 2026

Oct 16, 2026

Emergency Maintenance - Addressing CVE-2026-98432 Oct `30`, `2026` `23:00` - Oct `31`, `2026` `06:00` AEDT

Notice of upcoming GovCMS lagoon update 11.4.0.1 Nov `3`, `2026` `06:00` - Nov `7`, `2026` `10:00` AEDT

Regular Weekly Maintenance - GovCMS Nov `3`, `2026` `23:00` - Nov `4`, `2026` `06:00` AEDT

Oct `30`, `2026`

Oct `29`, `2026`

Oct `28`, `2026`

Oct `27`, `2026`

Oct `26`, `2026`

Oct `25`, `2026`

Oct `24`, `2026`

Oct `23`, `2026`

Oct `22`, `2026`

Oct `21`, `2026`

Oct `20`, `2026`

Oct `19`, `2026`

Oct `18`, `2026`

Oct `17`, `2026`

Oct `16`, `2026`