TapClicks is fully back online. Thank you for your patience while we proactively took the platform offline during the worldwide PHP security event.
What happened: On October 20, the PHP security team gave advance notice that a critical security update would be released on October 21. PHP is the open-source language behind roughly 70% of the world’s websites, so companies and government organizations across the globe faced the same situation. This was not a TapClicks event.
What we did: Our security team began preparing as soon as the advance notice was issued. Rather than wait for the patch, we took the platform offline this morning as a precaution, before any issue was observed on our platform. Our team worked around the clock, applied and verified the official patch as soon as it was released, and restored the platform only once it was confirmed secure.
Your data: No customer data has been affected, and no customer data has been extracted from the platform. Your data sources, configurations and scheduled reports are intact and running. No action is needed on your part.
We recognize that the downtime was disruptive, but we would make the same decision again. Protecting you comes before everything else we do. If you have any trouble accessing your instance, please contact support@tapclicks.com.
Summary - A critical security issue in PHP, the open-source language behind roughly 70% of the world’s websites, was disclosed on October 20. It affects software companies and websites worldwide, not TapClicks specifically. As a precaution, TapClicks took its core services offline, before any issue was observed on our platform.
Update - Application access is coming back online for all customers. Some environments, including our APAC region and HIPAA-compliant environments, may take longer to be fully accessible.
If you have any issues in accessing your instance, please reach out to support@tapclicks.com
No customer data has been affected, and no customer data has been extracted from the platform. Your data sources, configurations and scheduled reports are intact and will run once services are restored. No action is needed on your part.
Once all environments are operational, we will share another update.
Summary - A critical security issue in PHP, the open-source language behind roughly 70% of the world’s websites, was disclosed on October 20. It affects software companies and websites worldwide, not TapClicks specifically. As a precaution, TapClicks took its core services offline, before any issue was observed on our platform.
Update - Our engineering team continues to apply the patch across our production environments. Application access remains unavailable while this work continues and we are nearing completion. The team is developing a plan for rolling access restoration and as the details are finalized, we will share.
No customer data has been affected, and no customer data has been extracted from the platform. Your data sources, configurations and scheduled reports are intact and will run once services are restored. No action is needed on your part.
Next update by 12:30 PM Eastern, or sooner as information becomes available.
Summary - A critical security issue in PHP, the open-source language behind roughly 70% of the world’s websites, was disclosed on October 20. It affects software companies and websites worldwide, not TapClicks specifically. As a precaution, TapClicks took its core services offline, before any issue was observed on our platform.
Update - The official TapClicks patch to fill the security vulnerabilities has been released and verified, and our engineering team is continuing to apply it across our production environments. Application access remains unavailable while this work is underway. We still plan to begin restoring access in stages by approximately 12:00 PM Eastern. No customer data has been affected, and no customer data has been extracted from the platform. Your data sources, configurations and scheduled reports are intact and will run once services are restored. No action is needed on your part.
Next update by 12:00 PM Eastern, or sooner as information becomes available.
Our team is continuing to apply the verified PHP security patch across our production environments. Application access remains unavailable while this work is underway. Our timeline is unchanged: we plan to begin restoring access in stages within the next hour and half. Your data sources, configurations and scheduled reports remain intact and will run once services are restored, and no action is needed on your part. Next update by 11:30 AM Eastern, or sooner as information becomes available.
Posted Oct 21, 2026 - 15:00 UTC
Monitoring
The official PHP security patch has been released and our team has verified it. We are now in the process of applying it to our production environments. We plan to begin restoring application access in stages within the next two hours.
No customer data has been affected and no customer data has been extracted from the platform. Your data sources, configurations and scheduled reports are intact and will run once services are restored. No action is needed on your part.
Next update by 11:00 AM Eastern, or sooner as information becomes available.
Posted Oct 21, 2026 - 14:32 UTC
Investigating
A critical security issue in PHP, the open-source language behind roughly 70% of the world's websites, was disclosed on October 20. It affects software companies and websites worldwide, not TapClicks specifically. The EU's cyber agency (CERT-EU) and the Australian Cyber Security Centre have issued advisories, and Cloudflare has reported early attack attempts across the internet. The official patch is scheduled for release today, October 21, at 10:00 AM Eastern.
As a precaution, TapClicks took its core services offline this morning before the patch, and before any issue was observed on our platform. Our engineering team has been on standby since the disclosure and will apply the patch as soon as it is released, then verify and restore services in stages.
No customer data has been affected. Your data sources, configurations and scheduled reports are intact and will run once services are restored. No action is needed on your part.
Next update: 10:30 AM Eastern
Best Regards,
The TapClicks Engineering Team
Posted Oct 21, 2026 - 14:00 UTC
This incident affected: TapAnalytics/TapReports and TapOrders/TapWorkflow.