Resolved after 9 hours 55 minutes, affecting Campaign & Fundraising Pages and Supporter Pages, on October 21, 2026.
The PHP vulnerability we reported earlier has been fully addressed. We have updated to the latest patched version, and all functionality, including file uploads, has been restored. Throughout this incident, the donation experience and transaction flows were not affected. Campaigns, donations, and account information remained protected.
Affected components
Update timeline
- investigating Oct 21, 2026, 02:46 PM UTC
We are actively investigating inconsistent errors when updating campaigns and uploading images. This does not affect donation processing or the donor experience.
- identified Oct 21, 2026, 03:58 PM UTC
A broad, internet-wide critical vulnerability has been identified in PHP, which is used on GoFundMe. As a precautionary measure, we have limited some functionality to protect our customers and their supporters. Updating to the latest version is our first priority and resuming normal operations directly behind. This impact is focused on file uploads to our platform, and the donation experience and transaction flows are not affected. We will update this page as we have them. More information about the large scale vulnerability can be found here https://www.php2shell.com/
- resolved Oct 22, 2026, 12:55 AM UTC
The PHP vulnerability we reported earlier has been fully addressed. We have updated to the latest patched version, and all functionality, including file uploads, has been restored. Throughout this incident, the donation experience and transaction flows were not affected. Campaigns, donations, and account information remained protected.
Your product runs on more than Classy
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services