Security update: Temporary restriction on GovCMS origin access
Update - PaaS Customers you will need to submit a Service Desk ticket to inform GovCMS of your update plans ASAP. If we haven’t heard from you, from 9:30 AEDT, GovCMS will need to exercise step in rights and update on your behalf.
Oct 22, 2026 - 07:44 AEDT
Update - SaaS bulk deployments are underway – at this stage, we are anticipating the platform will be available for contented editing from 1030 AM AEDT. Stay tuned for more updates over the next couple of hours.
Oct 22, 2026 - 06:26 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 21, 2026 - 19:00 AEDT
Scheduled - Who this affects: GovCMS SaaS & PaaS Community

Advice:
GovCMS have been actively monitoring development and coordinating technical resources to ensure readiness to assess and the PHP vulnerability announced today. Despite a significant amount of work done today by GovCMS to implement further protections we cannot guarantee 100% safety therefore we are heeding advice from cyber.gov.au and other sources to disconnect the platform from the internet.

We are taking urgent protective action to mitigate the critical PHP vulnerabilities by temporarily disabling direct access to the GovCMS origin environment. This restriction helps protect customer websites while we address the vulnerabilities. Access will be restored once the threat has been resolved and it is safe to do so.

Sites will serve web content to the public though Akamai overnight though some sites and lesser visited pages may degrade if not cached. You will be unable to login to your websites overnight.

We will be assessing the CVE when it drops at 1am AEDT Thursday 22 October 2026. We are aiming to be back up and available for content publishing mode by 9am. We will communicate status at 7am if we believe we will not achieve a 9am restoration. If we can bring the platform back online earlier than 9am, we will.

We understand this may disrupt your work and appreciate your patience
Oct 21, 2026 19:00 - Oct 22, 2026 09:00 AEDT
GovCMS Lagoon update 11.3.8.6 (22 October 2026)
Update - Production and non-production deployments have just kicked off.

SaaS Deployment planned schedule:
- Production environments completed by 10:30AM (AEDT) Thursday 22 October 2026.
- Non-Production environments completed by 10:00AM (AEDT) Friday 23 October 2026.
Oct 22, 2026 - 06:04 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 22, 2026 - 04:35 AEDT
Scheduled - GovCMS is currently updating the Lagoon base image to 11.3.8.6 to the platform now. And will be kicking off deployments ASAP.

The deployment block remains in place on all SaaS websites and shield remains enabled on all non-production SaaS websites.

SaaS Deployment planned schedule:
- Production and Non-Production deployments commence from 4:30AM (AEDT) Thursday 22 October 2026
- Production environments completed by 9:30AM (AEDT) Thursday 22 October 2026.
- Non-Production environments completed by 10:00AM (AEDT) Friday 23 October 2026.

GovCMS Lagoon update 11.3.8.6 (22 October 2026)
GovCMS is currently updating the Lagoon base image to 11.3.8.6 to the platform now. And will be kicking off deployments ASAP.
The deployment block remains in place on all SaaS websites and shield remains enabled on all non-production SaaS websites.
SaaS Deployment planned schedule:
- Production and Non-Production deployments commence from 4:30AM (AEDT) Thursday 22 October 2026
- Production environments completed by 9:30AM (AEDT) Thursday 22 October 2026.
- Non-Production environments completed by 10:00AM (AEDT) Friday 23 October 2026.
PaaS Actions:
If you are using the GovCMS images, redeploy ASAP to pick up the latest changes. Otherwise update your lagoon images immediately.
Oct 22, 2026 04:35 - Oct 26, 2026 08:35 AEDT

About This Site

GovCMS: Content management and website hosting for the Australian government. Managed by the Department of Finance with service delivery partners Salsa Digital and amazee.io

Uptime over the past 90 days. View historical uptime.
GovCMS Hosting and Infrastructure Operational
Hosting Infrastructure (Amazon EKS) Operational
Akamai CDN cache Operational
AWS Compute (Sydney) Operational
AWS S3 Storage (Sydney) Operational
AWS LoadBalancer (Sydney) Operational
GovCMS E-mail relay (AWS Simple Email Service) Operational
HTTPS Redirect Service Operational
GovCMS Projects Under Maintenance
Individual websites Under Maintenance
GovCMS Sites Dashboard Operational
GovCMS Sites Logging System (OpenSearch) Operational
GovCMS GitLab Operational
Deployment Infrastructure Operational
Lagoon API Operational
Akamai API Operational
Lagoon tasks Operational
GovCMS Service Desk (Freshdesk) Operational
Freshdesk email notifications Operational
Freshdesk search Operational
Freshdesk incoming emails Operational
Freshdesk outgoing emails Operational
Other Operational
Pygmy Operational
Docker Desktop Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance
Major outage
Partial outage
No downtime recorded on this day.
No data exists for this day.
had a major outage.
had a partial outage.

No incidents or maintenance related to this downtime.

Scheduled Maintenance

FYI: Notice of upcoming GovCMS D11 release 4.6.0 Oct 27, 2026 06:00 - Oct 31, 2026 10:00 AEDT

Advice
We would like to inform you of the tentative dates for the upcoming GovCMS Drupal 11 (D11) release and deployment

The final release date is subject to change, as it will be determined by the testing outcomes. The date will be confirmed when the distribution is released and the release notes are expected to be sent on Monday 26 October 2026.

Thank you to everyone that has completed testing. The official preview period ended on 7 October 2026. The preview environments will be available for you to continue reviewing next week. In parallel we will completing our final regression testing on the release.

As a reminder, a SaaS deployment block is in place ONLY while we update the production branches. During this time, you will still be able to develop and deploy to non-production feature branches. We are wanting to give you as much lead time as possible, should you need to adjust your timeframes. PaaS deployments schedules are not impacted.

Deployment schedule:
- Deployment to commence from 6am Tuesday 27 October 2026 and will be conducted throughout the daytime.
- Production branches completed by 10am Wednesday 28 October 2026
- Non-Production branches completed by 10am Thursday 29 October 2026
Posted on Oct 09, 2026 - 10:16 AEDT

Regular Weekly Maintenance - GovCMS Oct 27, 2026 23:00 - Oct 28, 2026 06:00 AEDT

We are conducting regular maintenance on our systems. The maintenance will last for 7 hours.
Posted on Oct 20, 2026 - 07:00 AEDT

Oct 22, 2026

GovCMS Lagoon update 11.3.8.5
Completed - Closing this maintenance notice for 11.3.4.5, as it has now been superseded by 11.4.3.6 update: https://status.govcms.support/incidents/pb6s5yxqfvp0
Oct 22, 06:06 AEDT
Update - Production deployments are completed. Non-production deployments are still in progress.
Deployment block remains in place.

We will be assessing the CVE when it drops at 1am AEDT Thursday 22 October 2026, and are planning for the next lagoon update early Thursday morning. We will keep you posted.
Oct 21, 19:20 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 21, 15:40 AEDT
Scheduled - GovCMS is currently updating the Lagoon base image to 11.3.8.5 to the platform now. A deployment block has been placed on all SaaS websites.

GovCMS is aware of the current PHP Public Service Announcement. We are actively monitoring development and coordinating technical resources to ensure readiness to assess and address these vulnerabilities.
We will enable shield on all non-production SaaS websites from COB AEDT today.

Please refer to the technical release notes sent today at 2:53PM AEDT for more detailed information, if you didn’t’ receive it please email govcms@finance.gov.au.
Oct 21, 15:37 AEDT

Oct 21, 2026

Regular Weekly Maintenance - GovCMS
Completed - The scheduled maintenance has been completed.
Oct 21, 06:00 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 20, 23:00 AEDT
Scheduled - We are conducting regular maintenance on our systems. The maintenance will last for 7 hours.
Oct 13, 07:00 AEDT

Oct 20, 2026

Oct 19, 2026

Cluster maintenance
Completed - The scheduled maintenance has been completed.
Oct 19, 08:30 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 19, 06:30 AEDT
Scheduled - We will be performing cluster maintenance, there will be a brief disruption of a few minutes to the Lagoon API and dashboard during this time. No disruption to running sites.
Oct 14, 09:25 AEDT

Oct 18, 2026

No incidents reported.

Oct 17, 2026

No incidents reported.

Oct 16, 2026

Notice of upcoming GovCMS hotfix 4.5.1.2
Completed - The scheduled maintenance has been completed.
Oct 16, 09:52 AEDT
Update - Deployment of GovCMS hotfix 4.5.1.2 is complete for production sites and is now commencing on non-production sites. The deployment block has now been lifted.
Oct 15, 21:45 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 15, 12:00 AEDT
Scheduled - Advice:
GovCMS will release the Drupal 11 (D11) distribution on Thursday 15 October 2026. It addresses recent security advisories issued by Drupal.org. GovCMS assessed the CRITICAL risk as they applied to D11 distribution, subsequently the security residual risk remained CRITICAL. The D11 distribution will continue to be supported after this update.

In preparation for this release, shield was enabled on all non-production environments from COB Wednesday 14 October 2026. The shield credentials have been randomly generated for each non-production environment. To retrieve the details, login to the Dashboard, and you’ll find the credentials stored in `BASIC_AUTH_USERNAME` and `BASIC_AUTH_PASSWORD` environment variables for each environment.

SaaS Deployment schedule:
- Production and Non-Production deployments commence from 12:00PM (AEST) Thursday 15 October 2026
- Production environments completed by 7:00PM (AEST) Thursday 15 October 2026.
- Non-Production environments completed by COB (AEST) Friday 16 October 2026.
- PaaS deployments schedules are not impacted.

Core Update:
Update Drupal Core from 11.3.17 to 11.3.19
- https://www.drupal.org/project/drupal/releases/11.3.19
- https://www.drupal.org/sa-core-2026-014
- https://www.drupal.org/sa-core-2026-015
- https://www.drupal.org/sa-core-2026-016

What modules are added /removed in the distribution?
- No modules were added/removed from the distribution

Website using Gin Admin Theme
Please be aware there is also a DSA regarding the Gin admin theme. The theme is your responsibility please ensure it updated within 30 days: https://www.drupal.org/sa-contrib-2026-219
 
PaaS Actions:
The Critical Drupal Security Advisory will need be assessed and addressed as it pertains to your websites. Given the nature of the security announcement, this exploit with the help of AI, could develop within hours or days to highly critical changing the SLA requirements for patching. As a result, GovCMS will patch the distribution inline with highly critical SLA (within 48hrs) and we urge you to do the same.

If you are not in a position to do a release and deployment immediately, we recommend uninstalling the field UI module in the meantime.

Update your codebase to ensure you are running the latest platform base images and packages, and stay aligned to GovCMS best practice:
- GovCMS distribution (15 October 2026) > https://github.com/govCMS/GovCMS/releases/tag/4.5.1.2
- GovCMS lagoon (15 October 2026) > https://github.com/govCMS/lagoon/releases/tag/11.3.8.4
- GovCMS scaffold (15 September 2026) > https://github.com/govCMS/scaffold/releases/tag/4.1.0
- GovCMS scaffold-tooling (17 September 2026) > https://github.com/govCMS/scaffold-tooling/releases/tag/6.0.10

If you have any concerns, raise a ticket at https://www.govcms.support
Oct 13, 15:19 AEDT

Oct 15, 2026

Oct 14, 2026

Gitlab upgrade
Completed - The scheduled maintenance has been completed.
Oct 14, 06:00 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 13, 23:00 AEDT
Scheduled - We will be undergoing scheduled maintenance during this time.
Oct 13, 20:41 AEDT
Regular Weekly Maintenance - GovCMS
Completed - The scheduled maintenance has been completed.
Oct 14, 06:00 AEDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 13, 23:00 AEDT
Scheduled - We are conducting regular maintenance on our systems. The maintenance will last for 7 hours.
Oct 6, 07:00 AEDT

Oct 13, 2026

Oct 12, 2026

No incidents reported.

Oct 11, 2026

No incidents reported.

Oct 10, 2026

No incidents reported.

Oct 9, 2026

No incidents reported.

Oct 8, 2026

No incidents reported.

Incident History Powered by Atlassian Statuspage