The critical patch has now been deployed to all customer versions of Acorn and access has been restored to all users.
Posted Oct 22, 2026 - 02:43 AEDT
Identified
As a purely precautionary measure, we have temporarily taken down all Australian Government environments. Affected sites will be unavailable until further notice.
A critical security vulnerability has been identified in PHP, a widely used programming language that underpins a large share of the web, including our platform. This is a global issue affecting PHP-based applications across the industry and is not specific to our platform. We have chosen to take affected sites offline proactively while it is addressed. This is not in response to any known incident. No data has been lost, and all customer data remains intact.
Our engineering and security teams are tracking the fix and the updated packages from our hosting provider, and will apply them across the Acorn platform as a priority once they are available. We have reviewed our platform's security monitoring and found no signs that these vulnerabilities have been used against Acorn. We are continuing to monitor closely until the update is in place.
We sincerely apologise for any inconvenience this may cause and appreciate your patience while we prioritise the security of your platform. We will provide further updates here as the work progresses and once services have been restored.
Posted Oct 21, 2026 - 20:36 AEDT
This incident affected: AU-Gov-Cloud (Sydney) (Platform Availability & Performance).