Service Update: We’ve temporarily taken the Goodbudget website offline. Global advisories (inc. the U.S. National Security Agency) flagged critical PHP vulnerabilities. While no GB data was compromised, we’ve proactively isolated our servers to protect your info while security patches roll out.
Your Mobile App Works Offline: You can keep adding transactions & tracking Envelopes on iPhone & Android while offline.
Local device data is 100% safe.
Back-ups across devices & bank connections (if using) are paused for now.
Once servers are restored, back-ups and sync will resume.
The Goodbudget website and login are currently unavailable while our engineering team applies and verifies the patches. We’re working quickly to bring full service back safely. Thank you for your patience!
@Diane_Aquino - Thanks for your post. While we don’t have an official ETA on when we can reinstate the Goodbudget systems, we’re working to bring everything back up to speed as soon as possible. We appreciate your patience!
You have our email addresses, yet you did not email us — I had to do a web search to find out what was going on.
That’s a pretty serious lapse in customer communication.
That said, I understand that the PHP security issues are a “100 year storm” sort of event, so I appreciate that your tech team has pulled out all the stops to protect our data.
Now: that-said said, I really feel like you owe us at least a ballpark estimate of how long the site will be down. We pay you for your application, and we depend on your application working for our household and business budgets.
Can you not give us any idea at all — will it be days? Will it be weeks? Longer?!?
Update: At the moment, we have a version of the web app in our internal QA environment that we believe patches the PHP vulnerability, and we are currently testing it for functionality and security. We’ve also pulled in additional teammates to help us get the fix done safely.
We understand that this is a significant disruption, and that you needed more info sooner about what’s happening. We pulled down the service we usually use to send emails yesterday for the same reason, and we’re testing a patch for that now as well. We’ll post on this thread again in the next few hours.
Update: After applying the security patches to our internal QA environment, our testing caught some issues with core web functionality on the patched version. So we are working on fixing and re-testing that functionality on a patched version. Thank you for your patience.
Update: We have a new version of the web app in our internal QA environment that we believe fixes the issues that surfaced in our earlier round of testing. We’re testing this new version currently. We thank you again for your patience!
I’m glad you are hard at work patching the servers and testing. Keep up the good work with that!
A bit of feedback on the email… The email did not make it clear that you took the servers offline 24+ hours ago. I just received the email, and my initial thought was that you had been running unprotected for 24+ hours and had almost certainly been hacked and just didn’t know it yet.
In the follow up email when you come back online, you might offer a clearer timeline so people who are aware of the PHP issue, but not aware of your response, don’t think your response was catastrophically late.
Update: We’ve worked through the bulk of the issues identified in our release candidate but have a couple more that still need resolution. We continue to work on fixing and re-testing that functionality. We hope to have all functionality restored tomorrow. Thank you for your patience!
Will the imports from the past couple days still show up once you are back online? Payday happened while you were down and a lot of activity occurs. Support your decision but timing sucks for me lol.
Thank the team for working hard to keep things running. GB is still the best budget app out there.
Update: We’ve made good progress, and are re-enabling functionality in our QA environment for testing. We’ll provide the next update by noon Pacific. Thanks for your continued patience!
Thanks for your patience as we’ve worked to ensure that we could bring the Goodbudget website back online safely in light of the critical vulnerability advisories issued by global cybersecurity agencies Wednesday.
Wednesday morning, as soon as we were aware of the advisories, we applied security upgrades where we could and disabled what we could not immediately patch.
As of Friday, 10:45 am Pacific Time, we’ve completed our patching of remaining services and reenabled all services including device-to-device back-ups and website access. For those of you taking advantage of automatic bank feeds, your bank connections will resume automatic downloads.
We apologize for the interruption in service and have appreciated your patience!
Im having a problem with my scheduled transactions that should have occurred during the outage. Shows in pending transactions for OCT 23 but it didn’t complete the transaction and when I tap on it I get a message at the bottom.
I went on to the website and was able to hit the button next to the schedule transaction to complete today’s missing transaction. Seems to be working fine now.
