Float Incident History

1. resolvedOct 21 · 19:35 UTC

   On October 21, 2026, a security vulnerability was publicly disclosed in a popular open-source software component used across the industry, including in parts of our web infrastructure. Upon disclosure, our engineering team promptly assessed the potential impact on Float's services, implemented interim protective measures, and deployed vendor-issued security updates across all affected systems. All updates were applied without service interruption. Our investigation has found no evidence that this vulnerability was exploited against Float or that any customer data was affected. We continue to monitor our environment as part of our standard security practices. No action is required from customers. If you have any questions, please contact our support team. Update — October 22, 2026: For reference, this incident addressed two related vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, collectively known as "PHP2Shell."

Reported by Float on their status page.

1. resolvedOct 8 · 15:00 UTC

   Between approximately 14:30 and 15:00 UTC on 8 October 2026, some customers were unable to reach Float. We have identified the cause as a routine network configuration update, which resulted in unexpected, isolated availability issues. The problem has been fixed, and we are working with our vendor to ensure it does not happen again.

Reported by Float on their status page.