We're working through an issue affecting platform availability. Some apps may see intermittent errors or downtime while this work is underway. Updates to follow

Update timeline

1. investigating Oct 26, 2026, 04:54 PM UTC

   We've identified an issue affecting platform availability and will be making a series of infrastructure changes to resolve it. Some disruption is expected while that work is underway, including pages failing to load, workflows timing out, and brief periods where your app is unreachable. Behavior may improve and then recur as changes are made. No action is needed on your side. We'll post updates here as we make progress. If you see something not covered above, reach out to support with your app name and what you're seeing. We know this will be disruptive and we apologize in advance for the impact.

2. investigating Oct 26, 2026, 04:54 PM UTC

   We've identified an issue affecting platform availability and will be making a series of infrastructure changes to resolve it. Some disruption is expected while that work is underway, including pages failing to load, workflows timing out, and brief periods where your app is unreachable. Behavior may improve and then recur as changes are made. No action is needed on your side. We'll post updates here as we make progress. If you see something not covered above, reach out to support with your app name and what you're seeing. We know this will be disruptive and we apologize in advance for the impact.

3. identified Oct 26, 2026, 06:59 PM UTC

   We are responding to an active security incident. We detected unauthorized access to parts of Bubble’s systems. Our investigation is ongoing. What we know so far We’ve confirmed the attacker accessed third-party tokens and credentials (such as API keys used in API Connector / plugins) belonging to a subset of Bubble users. We are contacting affected users directly. Our investigation is still underway, and this scope may change as we learn more. What you may notice As part of containment, we may temporarily take parts of our infrastructure offline. This may affect both the Bubble editor and live Bubble apps. These interruptions are deliberate steps to protect your data. What you should do We recommend reviewing activity on third-party accounts connected to your Bubble apps for unusual usage. We’ll tell you when to rotate credentials so the new ones stay protected. Beware of phishing Official messages about this incident will come only from [bubble.io](http://bubble.io) and will be posted at [status.bubble.io](http://status.bubble.io). We will never ask for your password or credentials by email. Next update We’ll post our next update by 6 PM ET, or sooner if we learn something important. If you have questions in the interim, please reach out to [[email protected]](mailto:[email protected])

4. identified Oct 26, 2026, 06:59 PM UTC

   We are responding to an active security incident. We detected unauthorized access to parts of Bubble’s systems. Our investigation is ongoing. What we know so far We’ve confirmed the attacker accessed third-party tokens and credentials (such as API keys used in API Connector / plugins) belonging to a subset of Bubble users. We are contacting affected users directly. Our investigation is still underway, and this scope may change as we learn more. What you may notice As part of containment, we may temporarily take parts of our infrastructure offline. This may affect both the Bubble editor and live Bubble apps. These interruptions are deliberate steps to protect your data. What you should do We recommend reviewing activity on third-party accounts connected to your Bubble apps for unusual usage. We’ll tell you when to rotate credentials so the new ones stay protected. Beware of phishing Official messages about this incident will come only from bubble.io: http://bubble.io and will be posted at status.bubble.io: http://status.bubble.io. We will never ask for your password or credentials by email. Next update We’ll post our next update by 6 PM ET, or sooner if we learn something important. If you have questions in the interim, please reach out to [email protected]: mailto:[email protected]

5. identified Oct 26, 2026, 10:04 PM UTC

   Containment We believe the attacker has been contained and is no longer active in our systems. Since our last update, we have seen no evidence of further access. Forensic work is ongoing to confirm the full extent of what was accessed. Service status Parts of Bubble, including the editor and live apps, remain affected by the measures we took to contain the attack. We’re actively bringing systems back online, and we’ll share progress as it happens. Impacted functionality includes file access, some plugins, and some users being able to access their editors. Next update By 8:00 PM ET, or sooner if services are restored. Questions: [[email protected]](mailto:[email protected]).

6. identified Oct 26, 2026, 10:04 PM UTC

   Containment We believe the attacker has been contained and is no longer active in our systems. Since our last update, we have seen no evidence of further access. Forensic work is ongoing to confirm the full extent of what was accessed. Service status Parts of Bubble, including the editor and live apps, remain affected by the measures we took to contain the attack. We’re actively bringing systems back online, and we’ll share progress as it happens. Impacted functionality includes file access, some plugins, and some users being able to access their editors. Next update By 8:00 PM ET, or sooner if services are restored. Questions: [email protected]: mailto:[email protected].

7. identified Oct 27, 2026, 12:12 AM UTC

   We're continuing to work on restoring functionality. We are working on a more substantial update, and will post it (or another interim check-in) by 9 pm ET.

8. identified Oct 27, 2026, 12:12 AM UTC

   We're continuing to work on restoring functionality. We are working on a more substantial update, and will post it (or another interim check-in) by 9 pm ET.

9. identified Oct 27, 2026, 12:38 AM UTC

   Some Bubble functionality remains affected by security measures we introduced in response to a security incident. **Containment** We believe the attacker has been contained and is no longer active in our systems. Since our last update, we have seen no evidence of further access. **Security impact of the attack** Forensic work is ongoing to confirm the full extent of what was accessed. What we can report so far: • At this time, we do not have evidence that the attacker accessed private data of apps hosted on Bubble, or any credentials stored inside non-public Bubble applications. • The attacker was able to access metadata about Bubble plugins. This includes private API keys stored inside those plugins (often used by the plugin developer for testing that plugin). We have emailed the affected plugin developers to let them know that they should rotate potentially-exposed private keys. • The attacker downloaded application data from apps that were set as publicly viewable (see Settings -> General -> "Define who can see and modify the app editor" in the Editor). Apps with this setting were already open to the public, so the attacker did not access any non-public data, but we recommend confirming that this setting is set to "Private app" on your app unless your intention is for the editor in your app to be open to the public. **Service status** Parts of Bubble, including the editor and live apps, remain affected by the measures we took to contain the attack. We’re actively bringing systems back online. We've restored full service for some apps; other apps have impacted functionality including file access, some plugins, and some users being able to access their editors. Our next update will be by 9:30 pm ET

10. identified Oct 27, 2026, 12:38 AM UTC

    Some Bubble functionality remains affected by security measures we introduced in response to a security incident. Containment We believe the attacker has been contained and is no longer active in our systems. Since our last update, we have seen no evidence of further access. Security impact of the attack Forensic work is ongoing to confirm the full extent of what was accessed. What we can report so far: • At this time, we do not have evidence that the attacker accessed private data of apps hosted on Bubble, or any credentials stored inside non-public Bubble applications. • The attacker was able to access metadata about Bubble plugins. This includes private API keys stored inside those plugins (often used by the plugin developer for testing that plugin). We have emailed the affected plugin developers to let them know that they should rotate potentially-exposed private keys. • The attacker downloaded application data from apps that were set as publicly viewable (see Settings -> General -> "Define who can see and modify the app editor" in the Editor). Apps with this setting were already open to the public, so the attacker did not access any non-public data, but we recommend confirming that this setting is set to "Private app" on your app unless your intention is for the editor in your app to be open to the public. Service status Parts of Bubble, including the editor and live apps, remain affected by the measures we took to contain the attack. We’re actively bringing systems back online. We've restored full service for some apps; other apps have impacted functionality including file access, some plugins, and some users being able to access their editors. Our next update will be by 9:30 pm ET

11. monitoring Oct 27, 2026, 01:57 AM UTC

    Service to the majority of our customers is now fully restored. If you continue to see issues with your application and have not been contacted by us, please reach out to [[email protected]](mailto:[email protected]). We are continuing to monitor for any further issues, as well as continuing our forensic investigation, and will update this page and email impacted customers as needed. We will continue to provide transparency into what happened as we investigate: we don't expect any further substantial updates til later this week.

12. monitoring Oct 27, 2026, 01:57 AM UTC

    Service to the majority of our customers is now fully restored. If you continue to see issues with your application and have not been contacted by us, please reach out to [email protected]: mailto:[email protected]. We are still bringing our AI Agent features back online, but all user apps should be editable manually, and we expect the Agent to be available again later this evening. We are continuing to monitor for any further issues, as well as continuing our forensic investigation, and will update this page and email impacted customers as needed. We will continue to provide transparency into what happened as we investigate: we don't expect any further substantial updates til later this week.

13. monitoring Oct 27, 2026, 03:47 AM UTC

    Service to the majority of our customers is now fully restored. If you continue to see issues with your application and have not been contacted by us, please reach out to [email protected]: mailto:[email protected]. We are continuing to monitor for any further issues, as well as continuing our forensic investigation, and will update this page and email impacted customers as needed. We will continue to provide transparency into what happened as we investigate: we don't expect any further substantial updates til later this week.

14. monitoring Oct 29, 2026, 02:17 PM UTC

    The platform-level activity is contained. However, we’re seeing continued malicious activity aimed at individual Bubble apps, and we’re working directly with owners of affected apps. This activity targets common app configuration issues, including: • API keys or other credentials not marked “Private” • Missing or misconfigured privacy rules • API Connector calls with incorrectly configured authentication • App editors set to publicly viewable that don’t need to be **What we recommend now:** 1. Run the [security dashboard](https://bubble.io/security-dashboard) on each of your apps and fix anything it flags. We may add new checks as we learn more. 2. Rotate any credentials that may have been exposed. 3. Set your app to “Private app” unless you intend for the editor to be public. We’re also continuing to review our own code and pushing security updates as needed. If you notice any unexpected behavior in your app, please [contact support](https://bubble.io/support) so we can check whether one of these changes caused it. We know this is extra work during an already disruptive week, and we appreciate you taking these steps to keep your apps secure.

15. monitoring Oct 29, 2026, 02:17 PM UTC

    The platform-level activity is contained. However, we’re seeing continued malicious activity aimed at individual Bubble apps, and we’re working directly with owners of affected apps. This activity targets common app configuration issues, including: • API keys or other credentials not marked “Private” • Missing or misconfigured privacy rules • API Connector calls with incorrectly configured authentication • App editors set to publicly viewable that don’t need to be What we recommend now: 1. Run the security dashboard: https://bubble.io/security-dashboard on each of your apps and fix anything it flags. We may add new checks as we learn more. 2. Rotate any credentials that may have been exposed. 3. Set your app to “Private app” unless you intend for the editor to be public. We’re also continuing to review our own code and pushing security updates as needed. If you notice any unexpected behavior in your app, please contact support: https://bubble.io/support so we can check whether one of these changes caused it. We know this is extra work during an already disruptive week, and we appreciate you taking these steps to keep your apps secure.

16. resolved Oct 31, 2026, 12:01 AM UTC

    We are marking this incident resolved because at this time, our systems are stable and we've completed our highest priority hardening work. We do still see an elevated level of attempts to target Bubble apps, and we suspect that this level of activity may be the new normal as AI makes it easier for threat actors to automate targeting campaigns. As always, we recommend that app owners review their applications' security by running our [security dashboard](https://bubble.io/security-dashboard) and fixing anything it flags on a regular cadence. We will be continuing to invest in both the security of our platform, and tooling to help you secure applications that you build, and plan to share more about how we're thinking about keeping your applications safe in this new, high risk environment.

17. resolved Oct 31, 2026, 12:01 AM UTC

    We are marking this incident resolved because at this time, our systems are stable and we've completed our highest priority hardening work. We do still see an elevated level of attempts to target Bubble apps, and we suspect that this level of activity may be the new normal as AI makes it easier for threat actors to automate targeting campaigns. As always, we recommend that app owners review their applications' security by running our security dashboard: https://bubble.io/security-dashboard and fixing anything it flags on a regular cadence. We will be continuing to invest in both the security of our platform, and tooling to help you secure applications that you build, and plan to share more about how we're thinking about keeping your applications safe in this new, high risk environment.

18. resolved Oct 31, 2026, 12:01 AM UTC

    We are marking this incident resolved because at this time, our systems are stable and we've completed our highest priority hardening work. We do still see an elevated level of attempts to target Bubble apps, and we suspect that this level of activity may be the new normal as AI makes it easier for threat actors to automate targeting campaigns. As always, we recommend that app owners review their applications' security by running our security dashboard: https://bubble.io/security-dashboard and fixing anything it flags on a regular cadence. We will be continuing to invest in both the security of our platform, and tooling to help you secure applications that you build, and plan to share more about how we're thinking about keeping your applications safe in this new, high risk environment.