Resolved
All customer-facing services have been restored, and no further service impacts are being observed. This incident is now resolved.
Our teams will continue to undertake comprehensive assurance checks and validation activities across our environment as part of our ongoing response to the critical PHP framework vulnerabilities. These activities do not affect the availability of customer-facing services.
Posted Oct 23, 2026 - 11:20 AEDT
Monitoring
As part of our ongoing response to the critical PHP framework vulnerabilities, all customer-facing services have now been restored.
Services have been fully restored for schools and their communities. We are continuing to monitor services while our teams finalise remediation of the remaining non-customer-facing systems.
We will provide a further update once this work has been completed.
Posted Oct 22, 2026 - 15:10 AEDT
Update
As part of our ongoing response to the critical PHP framework vulnerabilities, we are continuing to restore services as patching and verification are completed. Case lodgement through the Help Centre widget remains temporarily unavailable during this work.
Outbound messaging services have now been restored, and any messages that were previously aborted can now be resent successfully.
Our current priority is restoring access to the Sentral for Parents app and Parent Portal. Our teams continue to work urgently, and we will provide a further update as restoration work progresses.
Posted Oct 22, 2026 - 12:47 AEDT
Update
As part of our ongoing response, we are temporarily limiting access to some services and taking non-essential services offline while security patches are applied and verified.
This is now impacting access to the Sentral for Parents and Sentral for Teachers apps, along with other non-essential services. These services will remain unavailable until the required patching and verification have been completed.
Our security and cloud operations teams continue to work urgently to restore services safely. We will provide a further update as work progresses.
Posted Oct 22, 2026 - 11:45 AEDT
Identified
Our security and cloud operations teams have been working overnight to address the critical PHP2Shell vulnerability that has just been disclosed.
We have implemented compensating controls to mitigate potential attacks on affected services which may cause disruption to your services from some network connections. Affected systems are being patched and we will remove the compensating controls once verification of the patch has been completed.
Posted Oct 22, 2026 - 11:14 AEDT
This incident affected: Core Sentral Services (SMS and Email Services, Data Sync - Sentral Enrolments, Data Sync - NSWDOE SAIS, Data Sync - VICDOE Eduhub, Data Sync - Other, Login and User authentication, Sentral Finance), Mobile Applications (Sentral for Parents, Sentral for Teachers), AUPRD02 (Sentral application), AUPRD04 (Sentral application), AUDEV03 (Sentral application), AUPRD01 (Sentral application), AUPRD08 (Sentral application), AUPRD07 (Sentral application), AUPRD06 (Sentral application), AUPRD05 (Sentral application), AUPRD10 (Sentral application), AUPRD11 (Sentral application), SGPRD01 (Sentral application), HKPRD01 (Sentral application, TAP Integration service), Support Services (Help Centre, Case lodgement), AUPRD03 (Sentral application), AUPRD09 (Sentral application), and AUSTAG01, AUSTAG02, AUSTAG03, AUSTAG04, AUSTAG05, AUSTAG06.