Web interace - Operational
API - Operational
Customer portals - Operational
Customer portals
Notice history
View current statusOct 2026
- Resolved · UTC
The security patch has been applied to all servers, and the temporary access restrictions put in place have been lifted.
- Identified · UTC
Until the patch has been released and applied, we're restricting access to JobStaq to IP addresses which have been used in the last 14 days by employees of active JobStaq accounts, to prevent attackers targeting the internet as a whole from being able to target JobStaq. As a result, customer portals will remain unavailable at this time (unless customers share IPs with employees), and in the event an employee connects from a new IP address (eg. via a VPN), they may be unable to access JobStaq.
We've applied all known configuration changes to address known exploits for the time being. There may continue to be disruption to some functionality, such as file uploads, as a result of these temporary changes until the full fix is available.
If you remain unable to access JobStaq, please contact support and provide a copy of the contents of the webpage at https://cloudflare.com/cdn-cgi/trace. We will be issuing compensation for any employees who are unable to use JobStaq during this incident.
The security release we are waiting on is scheduled to be auto-installed the moment it is available, after which we'll manually confirm it has applied correctly before reverting the temporary restrictions we enforced. We'd like to apologise in advance for any disruptions this may cause, however, believe the approach we've taken here to be the best path to balance both availability and security of our customers' data.
- Investigating · UTC
A critical security vulnerability in the programming language used for parts of JobStaq has been announced, with a planned release for 14:00 UTC on 2026-10-21 (https://news-web.php.net/php.announce/509). Before the security upgrade became available, details of exploits surfaced online (https://x.com/J4ck3LSyN/status/2112703096443097263), however, no details are yet to be shared about how to patch this (https://phpc.social/@Girgias/117476477429221001).
Out of an abundance of caution, we've taken public facing parts of JobStaq offline until we can reduce our attack surface. Background processing and automations (eg. automatic reminders & triggers) will continue as usual, and the app will continue to function offline.