We have applied the security patch for the recently announced PHP vulnerability and brought the OAuth authentication service back online. You can add new OAuth-based connections and re-authorize existing ones again. No action is required from customers. If your security team chose to wait before rotating credentials, it’s now safe to proceed.

Following the PHP security vulnerability announced on October 20 (php2shell), we have taken our OAuth authentication service offline as a precaution while we wait for the patched packages for our infrastructure. Until the service is restored, you can’t add new OAuth-based connections or re-authorize existing ones. Existing connections continue to run normally. This service is separate from the systems that store and process customer data, and we have no indication BlueConic has been targeted. No action is required from customers. We’ll update this page once the patch is applied.