Security Maintenance – Infrastructure Component Update
- resolved
On October 21, 2026, a security vulnerability was publicly disclosed in a popular open-source software component used across the industry, including in parts of our web infrastructure. Upon disclosure, our engineering team promptly assessed the potential impact on Float's services, implemented interim protective measures, and deployed vendor-issued security updates across all affected systems. All updates were applied without service interruption. Our investigation has found no evidence that this vulnerability was exploited against Float or that any customer data was affected. We continue to monitor our environment as part of our standard security practices. No action is required from customers. If you have any questions, please contact our support team. Update — October 22, 2026: For reference, this incident addressed two related vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, collectively known as "PHP2Shell."