Some users experienced dropped connections during the deployment of security patches to the Cloud platform. The patches were being applied to address an urgent PHP vulnerability highlighted by the National Cyber Security Centre (NCSC).
The patches were deployed using a rolling update behind an NGINX load balancer. As servers were taken out of service for patching, connections routed to those servers were drained. In some cases, this process interrupted active user connections, requiring users to reconnect.
The vulnerability required an urgent response, so the deployment took place outside the standard maintenance window. This meant the disruption was more noticeable to users than it would typically be during planned maintenance.
The decision to proceed outside the usual window was made to reduce the time that the platform remained exposed to the vulnerability and to protect customer data.
The security patches were deployed across the platform. Users affected by interrupted connections were able to reconnect once their sessions were re-established.