Seravo Status

Postmortem: # Notice of a cluster outage on September 21, 2026

On Monday, September 21, 2026, we suffered from a partial outage on our server cluster FI-Ellington. The problem began at 13:15 (UTC+3) and was completely resolved at 16:29. However, most of the sites remained to function until 14:20. Some sites were still needed to restart manually.

The problem was related to a database service overload, affecting most of the websites hosted in the FI-Ellington cluster. The repair operations were unfortunately time-taking. Once the database service was fixed, we still needed to restart some of the site instances manually.

To improve our processes for such possible issues in the future, we have implemented new tools to recover website instances faster. In addition, we have improved Seravo’s 24/7 monitoring in order to recognize issues of this type sooner.

We apologize for the downtime and inconvenience caused by this incident.

Seravo provides real-time updates on all disruptions at status.seravo.com. We highly recommend subscribing to incident notifications via email, for example.

Timeline (UTC+3)

• 13:15 The first site alerts, investigation was started
• 13:20 The issue was identified and limited to the database system
• 13:25 Issue was reported on status.seravo.com
• 13:50 Recovery measures
• 14:20 The most sites were recovered
• 14:20 Failed sites were identified and instance restarts initiated
• 16:29 All sites recovered

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we are monitoring the results.

Identified: We identified a networking issue in cluster fi-ellington. Our team is working on it to fix it. We apologise for any inconvenience.

Postmortem: ## DDoS attack at FI-Sestak

On Monday, June 21, 2026, Seravo's server cluster FI-Sestak became a target of a large-scale DDoS attack. DDoS stands for Distributed Denial of Service, a malicious cyberattack that floods a server with overwhelming internet traffic to make it unresponsive and stop working for real users.

‌

The attack started at 12:45 (UTC+3). During the attack most of the websites hosted in FI-Sestak experienced degraded service, but there was no other security threat to the sites. Visitors received connection timeouts or HTTP502 errors while trying to visit the sites. 

‌

At approximately 13:15, an incident occurred in another cluster, FI-Ellington, initially raising concerns that the incident might be related to the DDoS attack in FI-Sestak. No indication of a connection between the two incidents was found. However, the overlap temporarily diverted attention and delayed recovery of FI-Sestak.

‌

As a part of our response, we deployed new tooling to assist with mitigating an attack like this in the future. The tooling proved useful during the incident and will be retained in our toolkit for similar incidents in future.

‌

The attack ended at approximately 14:20, after which we continued to monitor the situation. The incident was marked as resolved on our end at 15:03.

‌

We apologize for the inconvenience caused by this attack.

‌

Seravo provides real-time updates on all disruptions at status.seravo.com. We highly recommend subscribing to incident notifications via email, for example.

Timeline (UTC+3)

• 12:45 DDoS starts
• 12:49 First signs of abnormal web traffic
• 12:55 First blocks deployed to mitigate the attack
• 13:15 A simultaneous, unrelated issue in another server cluster slows down investigation
• 13:45 New tooling deployed
• 14:08 New tooling proves effective
• 14:20 DDoS ends
• 15:03 Incident marked as resolved

Resolved: This incident has been resolved.

Identified: We identified a networking issue in cluster fi-sestak. Our team is working on it to fix it. We apologise for any inconvenience.