HubSpot posted a single update on 22 October 2026 about a PHP security vulnerability disclosed elsewhere, open for 1h 54m. HubSpot's own text says the vulnerability does not touch its platform, so this was a disclosure notice rather than a fault on your side or theirs.
Started
01:38 UTC
Duration
Lasted 1h 54m
Source
IsDown
Next time
HubSpot is degraded. Is your product working?
An incident on their side does not always mean an outage on yours, and the only way to know is to already be watching your own endpoints. Set that up in under a minute and you will be notified the next time your own site is affected. And there will be a next time.
50 monitors for your own websites. No card.
What happened?
HubSpot's status page logged one entry for this day, starting at 01:38 UTC and closing after 1h 54m. There is only one update on the incident, filed at 01:38 UTC, and no components are listed as affected. The text reads: "HubSpot is aware of the recently disclosed PHP security vulnerability. PHP isn't part of HubSpot's infrastructure, and we are not aware of any impact to our platform or customers. We will continue to watch the situation and provide an update if our assessment changes." That single filing is the entire record for the day. No follow-up update was published confirming impact, confirming resolution, or saying anything beyond the original note. No user reports were filed during the window, which lines up with a notice that describes no customer-facing effect. Over the past 90 days HubSpot has logged 12 incidents with a median duration of 1 hour 46 minutes, and this one sits close to that pattern in length even though its content is different, a vulnerability watch rather than a reported fault. Across all time HubSpot has filed 327 incidents, averaging 4.2 a month, so a status page entry from HubSpot is a routine occurrence rather than a rare event. Nothing in this entry describes degraded service, downtime, or a fix being applied. It reads as HubSpot publicly tracking an external security disclosure and stating, in its own words, that it does not believe its platform was exposed.
Learning
This entry is a reminder that not every status page post means something broke. HubSpot's own wording says PHP is not part of its infrastructure and that it saw no impact to its platform or customers, so there is no fault here to trace back to a layer, network, application or otherwise. Our 30 day monitoring recorded 5 incidents with a median duration of 1h 54m, a figure that happens to match this entry's length, but that reflects monitoring activity generally rather than confirmation that this specific day caused any disruption. When a vendor files a watch-and-see note like this, the right response is to read it rather than act on it, since there is nothing in it to fix. The lesson for running a product on HubSpot is less about this incident and more about habit: treat vendor disclosures on their merits, and don't assume a status page entry equals downtime. Your monitoring covers your half, UptimeRobot now watches the provider's half too, so next time you know which side broke without guessing.
