TapClicks Status

Resolved: This issue has been resolved - if you have any questions about your scheduled reports, please reach out to [email protected].

Monitoring: The vast majority of impacted scheduled reports have been resent. We are still monitoring and will provide an update later today.

Identified: Impacted scheduled reports are now being resent for all instances whose data load has completed. We will provide another update in the morning.

Thank you for your patience.

Identified: The failed data loads have all been restarted and we are monitoring. Once they complete, we will be able to start resending impacted scheduled reports.

Identified: Approximately 25% of our data load processes failed this morning due to an infrastructure configuration change. We have resolved the issue and are currently re-running the failed data loads.

We are also evaluating the impact on scheduled reports and will resend any affected reports as soon as the data loads complete.

We apologize for the inconvenience and appreciate your patience.

Resolved: Ongoing communication about this issue will be covered under the incident "Worldwide PHP Security Event: How TapClicks Is Protecting You"

Identified: We are continuing to improve the infrastructure to mitigate the global security vulnerability.

Identified: Our engineering teams remain on active standby as we prepare for the official upstream PHP security release, scheduled for 10:00 AM Eastern (14:00 UTC) today.

Upon release, we anticipate a deployment, verification, and testing window of approximately two hours before bringing core application services back online. To ensure environment stability, platform access and data processing queues will be restored gradually as service checks complete.

We appreciate your patience and will provide our next status update around 10:30 AM Eastern, as new information becomes available.

Identified: Our teams are working around the clock to prepare for the release of the official PHP security patch and monitor any developments. We will provide more updates as they become available.

Identified: On October 20, the PHP security team issued advance notice of two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), rated 9.2 out of 10 for severity (Remote Code Execution). Upstream maintainers have scheduled an emergency security release for today, October 21, at 14:00 UTC / 10:00 AM EDT.

Given the severity of these vulnerabilities and public discussions surrounding leaked exploit details prior to the official patch release, we made the deliberate decision to take the TapClicks platform temporarily offline until the vendor fix can be applied. This proactive isolation is consistent with guidance from leading cybersecurity advisories, including CERT-EU Advisory 2026-018.

What's Affected: The core TapClicks application is currently unavailable. Data processing queues and daily data loads will automatically resume processing sequentially once platform service is restored.

Next Steps: We will deploy the security patch as soon as possible upon release by the PHP security team, complete environment integrity checks, and restore full service. We will post our next update by 7:30 AM Eastern, or sooner as new information becomes available.

We apologize for the disruption to your workday and appreciate your understanding as we prioritize platform security. For urgent inquiries, please contact our support team at [email protected].

Resolved: TapClicks is fully back online. Thank you for your patience while we proactively took the platform offline during the worldwide PHP security event.

What happened: On October 20, the PHP security team gave advance notice that a critical security update would be released on October 21. PHP is the open-source language behind roughly 70% of the world’s websites, so companies and government organizations across the globe faced the same situation. This was not a TapClicks event.

What we did: Our security team began preparing as soon as the advance notice was issued. Rather than wait for the patch, we took the platform offline this morning as a precaution, before any issue was observed on our platform. Our team worked around the clock, applied and verified the official patch as soon as it was released, and restored the platform only once it was confirmed secure.

Your data: No customer data has been affected, and no customer data has been extracted from the platform. Your data sources, configurations and scheduled reports are intact and running. No action is needed on your part.

We recognize that the downtime was disruptive, but we would make the same decision again. Protecting you comes before everything else we do. If you have any trouble accessing your instance, please contact [email protected].

Further reading

• Wall Street Journal - https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-up-to-70-of-the-worlds-websites-at-risk-fd0902ea?mod=e2tw
• Forbes - https://www.forbes.com/sites/daveywinder/2026/10/21/critical-php-security-warning-issued-apply-emergency-patch-today/
• BBC - https://www.bbc.com/news/articles/cmly0lg3w5x2o

Monitoring: Summary - A critical security issue in PHP, the open-source language behind roughly 70% of the world’s websites, was disclosed on October 20. It affects software companies and websites worldwide, not TapClicks specifically. As a precaution, TapClicks took its core services offline, before any issue was observed on our platform.

Update - Application access is coming back online for all customers. Some environments, including our APAC region and HIPAA-compliant environments, may take longer to be fully accessible.

If you have any issues in accessing your instance, please reach out to [email protected]

No customer data has been affected, and no customer data has been extracted from the platform. Your data sources, configurations and scheduled reports are intact and will run once services are restored. No action is needed on your part.

Once all environments are operational, we will share another update.

Further reading: WallStreet Journal Article - "AI Just Found a Bug That Puts Up to 70% of the World’s Websites at Risk": https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-up-to-70-of-the-worlds-websites-at-risk-fd0902ea?mod=e2tw

Monitoring: Summary - A critical security issue in PHP, the open-source language behind roughly 70% of the world’s websites, was disclosed on October 20. It affects software companies and websites worldwide, not TapClicks specifically. As a precaution, TapClicks took its core services offline, before any issue was observed on our platform.

Update - Our engineering team continues to apply the patch across our production environments. Application access remains unavailable while this work continues and we are nearing completion. The team is developing a plan for rolling access restoration and as the details are finalized, we will share.

No customer data has been affected, and no customer data has been extracted from the platform. Your data sources, configurations and scheduled reports are intact and will run once services are restored. No action is needed on your part.

Next update by 12:30 PM Eastern, or sooner as information becomes available.

Further reading: WallStreet Journal Article - "AI Just Found a Bug That Puts Up to 70% of the World’s Websites at Risk": https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-up-to-70-of-the-worlds-websites-at-risk-fd0902ea?mod=e2tw

Monitoring: Summary - A critical security issue in PHP, the open-source language behind roughly 70% of the world’s websites, was disclosed on October 20. It affects software companies and websites worldwide, not TapClicks specifically. As a precaution, TapClicks took its core services offline, before any issue was observed on our platform.

Update - The official TapClicks patch to fill the security vulnerabilities has been released and verified, and our engineering team is continuing to apply it across our production environments. Application access remains unavailable while this work is underway. We still plan to begin restoring access in stages by approximately 12:00 PM Eastern. No customer data has been affected, and no customer data has been extracted from the platform. Your data sources, configurations and scheduled reports are intact and will run once services are restored. No action is needed on your part.

Next update by 12:00 PM Eastern, or sooner as information becomes available.

Further reading: WallStreet Journal Article - "AI Just Found a Bug That Puts Up to 70% of the World’s Websites at Risk": https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-up-to-70-of-the-worlds-websites-at-risk-fd0902ea?mod=e2tw

Monitoring: Our team is continuing to apply the verified PHP security patch across our production environments. Application access remains unavailable while this work is underway. Our timeline is unchanged: we plan to begin restoring access in stages within the next hour and half. Your data sources, configurations and scheduled reports remain intact and will run once services are restored, and no action is needed on your part. Next update by 11:30 AM Eastern, or sooner as information becomes available.

Monitoring: The official PHP security patch has been released and our team has verified it. We are now in the process of applying it to our production environments. We plan to begin restoring application access in stages within the next two hours.

No customer data has been affected and no customer data has been extracted from the platform. Your data sources, configurations and scheduled reports are intact and will run once services are restored. No action is needed on your part.

Next update by 11:00 AM Eastern, or sooner as information becomes available.

Investigating: A critical security issue in PHP, the open-source language behind roughly 70% of the world's websites, was disclosed on October 20. It affects software companies and websites worldwide, not TapClicks specifically. The EU's cyber agency (CERT-EU) and the Australian Cyber Security Centre have issued advisories, and Cloudflare has reported early attack attempts across the internet. The official patch is scheduled for release today, October 21, at 10:00 AM Eastern.

As a precaution, TapClicks took its core services offline this morning before the patch, and before any issue was observed on our platform. Our engineering team has been on standby since the disclosure and will apply the patch as soon as it is released, then verify and restore services in stages.

No customer data has been affected. Your data sources, configurations and scheduled reports are intact and will run once services are restored. No action is needed on your part.

Next update: 10:30 AM Eastern

Best Regards,

The TapClicks Engineering Team

Resolved: Ongoing communication about this issue will be covered under the incident "Worldwide PHP Security Event: How TapClicks Is Protecting You"

Identified: We are continuing to improve the infrastructure to mitigate the global security vulnerability.

Identified: Our engineering teams remain on active standby as we prepare for the official upstream PHP security release, scheduled for 10:00 AM Eastern (14:00 UTC) today.

Upon release, we anticipate a deployment, verification, and testing window of approximately two hours before bringing core application services back online. To ensure environment stability, platform access and data processing queues will be restored gradually as service checks complete.

We appreciate your patience and will provide our next status update around 10:30 AM Eastern, as new information becomes available.

Identified: Our teams are working around the clock to prepare for the release of the official PHP security patch and monitor any developments. We will provide more updates as they become available.

Identified: On October 20, the PHP security team issued advance notice of two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), rated 9.2 out of 10 for severity (Remote Code Execution). Upstream maintainers have scheduled an emergency security release for today, October 21, at 14:00 UTC / 10:00 AM EDT.

Given the severity of these vulnerabilities and public discussions surrounding leaked exploit details prior to the official patch release, we made the deliberate decision to take the TapClicks platform temporarily offline until the vendor fix can be applied. This proactive isolation is consistent with guidance from leading cybersecurity advisories, including CERT-EU Advisory 2026-018.

What's Affected: The core TapClicks application is currently unavailable. Data processing queues and daily data loads will automatically resume processing sequentially once platform service is restored.

Next Steps: We will deploy the security patch as soon as possible upon release by the PHP security team, complete environment integrity checks, and restore full service. We will post our next update by 7:30 AM Eastern, or sooner as new information becomes available.

We apologize for the disruption to your workday and appreciate your understanding as we prioritize platform security. For urgent inquiries, please contact our support team at [email protected].

Resolved: TapClicks is fully back online. Thank you for your patience while we proactively took the platform offline during the worldwide PHP security event.

What happened: On October 20, the PHP security team gave advance notice that a critical security update would be released on October 21. PHP is the open-source language behind roughly 70% of the world’s websites, so companies and government organizations across the globe faced the same situation. This was not a TapClicks event.

What we did: Our security team began preparing as soon as the advance notice was issued. Rather than wait for the patch, we took the platform offline this morning as a precaution, before any issue was observed on our platform. Our team worked around the clock, applied and verified the official patch as soon as it was released, and restored the platform only once it was confirmed secure.

Your data: No customer data has been affected, and no customer data has been extracted from the platform. Your data sources, configurations and scheduled reports are intact and running. No action is needed on your part.

We recognize that the downtime was disruptive, but we would make the same decision again. Protecting you comes before everything else we do. If you have any trouble accessing your instance, please contact [email protected].

Further reading

• Wall Street Journal - https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-up-to-70-of-the-worlds-websites-at-risk-fd0902ea?mod=e2tw
• Forbes - https://www.forbes.com/sites/daveywinder/2026/10/21/critical-php-security-warning-issued-apply-emergency-patch-today/
• BBC - https://www.bbc.com/news/articles/cmly0lg3w5x2o

Monitoring: Summary - A critical security issue in PHP, the open-source language behind roughly 70% of the world’s websites, was disclosed on October 20. It affects software companies and websites worldwide, not TapClicks specifically. As a precaution, TapClicks took its core services offline, before any issue was observed on our platform.

Update - Application access is coming back online for all customers. Some environments, including our APAC region and HIPAA-compliant environments, may take longer to be fully accessible.

If you have any issues in accessing your instance, please reach out to [email protected]

No customer data has been affected, and no customer data has been extracted from the platform. Your data sources, configurations and scheduled reports are intact and will run once services are restored. No action is needed on your part.

Once all environments are operational, we will share another update.

Further reading: WallStreet Journal Article - "AI Just Found a Bug That Puts Up to 70% of the World’s Websites at Risk": https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-up-to-70-of-the-worlds-websites-at-risk-fd0902ea?mod=e2tw

Monitoring: Summary - A critical security issue in PHP, the open-source language behind roughly 70% of the world’s websites, was disclosed on October 20. It affects software companies and websites worldwide, not TapClicks specifically. As a precaution, TapClicks took its core services offline, before any issue was observed on our platform.

Update - Our engineering team continues to apply the patch across our production environments. Application access remains unavailable while this work continues and we are nearing completion. The team is developing a plan for rolling access restoration and as the details are finalized, we will share.

No customer data has been affected, and no customer data has been extracted from the platform. Your data sources, configurations and scheduled reports are intact and will run once services are restored. No action is needed on your part.

Next update by 12:30 PM Eastern, or sooner as information becomes available.

Further reading: WallStreet Journal Article - "AI Just Found a Bug That Puts Up to 70% of the World’s Websites at Risk": https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-up-to-70-of-the-worlds-websites-at-risk-fd0902ea?mod=e2tw

Monitoring: Summary - A critical security issue in PHP, the open-source language behind roughly 70% of the world’s websites, was disclosed on October 20. It affects software companies and websites worldwide, not TapClicks specifically. As a precaution, TapClicks took its core services offline, before any issue was observed on our platform.

Update - The official TapClicks patch to fill the security vulnerabilities has been released and verified, and our engineering team is continuing to apply it across our production environments. Application access remains unavailable while this work is underway. We still plan to begin restoring access in stages by approximately 12:00 PM Eastern. No customer data has been affected, and no customer data has been extracted from the platform. Your data sources, configurations and scheduled reports are intact and will run once services are restored. No action is needed on your part.

Next update by 12:00 PM Eastern, or sooner as information becomes available.

Further reading: WallStreet Journal Article - "AI Just Found a Bug That Puts Up to 70% of the World’s Websites at Risk": https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-up-to-70-of-the-worlds-websites-at-risk-fd0902ea?mod=e2tw

Monitoring: Our team is continuing to apply the verified PHP security patch across our production environments. Application access remains unavailable while this work is underway. Our timeline is unchanged: we plan to begin restoring access in stages within the next hour and half. Your data sources, configurations and scheduled reports remain intact and will run once services are restored, and no action is needed on your part. Next update by 11:30 AM Eastern, or sooner as information becomes available.

Monitoring: The official PHP security patch has been released and our team has verified it. We are now in the process of applying it to our production environments. We plan to begin restoring application access in stages within the next two hours.

No customer data has been affected and no customer data has been extracted from the platform. Your data sources, configurations and scheduled reports are intact and will run once services are restored. No action is needed on your part.

Next update by 11:00 AM Eastern, or sooner as information becomes available.

Investigating: A critical security issue in PHP, the open-source language behind roughly 70% of the world's websites, was disclosed on October 20. It affects software companies and websites worldwide, not TapClicks specifically. The EU's cyber agency (CERT-EU) and the Australian Cyber Security Centre have issued advisories, and Cloudflare has reported early attack attempts across the internet. The official patch is scheduled for release today, October 21, at 10:00 AM Eastern.

As a precaution, TapClicks took its core services offline this morning before the patch, and before any issue was observed on our platform. Our engineering team has been on standby since the disclosure and will apply the patch as soon as it is released, then verify and restore services in stages.

No customer data has been affected. Your data sources, configurations and scheduled reports are intact and will run once services are restored. No action is needed on your part.

Next update: 10:30 AM Eastern

Best Regards,

The TapClicks Engineering Team