{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Northflank security incident: PaaS tells users to assume all environment variables were decrypted · updates",
  "home_page_url": "https://pwn.watch/i/northflank-paas-security-incident-env-vars-oct-2026",
  "feed_url": "https://pwn.watch/i/northflank-paas-security-incident-env-vars-oct-2026/feed.json",
  "description": "Northflank, a platform-as-a-service for deploying apps and databases, declared a security incident with a major outage across 7 platform components on Oct 30 2026. Its status page says a Wiz threat alert fired at 11:43 UTC, engineers reviewed it a minute later, and Northflank deployed an initial network policy patch at 12:02 UTC with more patches at 12:50 and 13:05 UTC, then requested Wiz CIRT support at 13:00 UTC. At 13:40 UTC it told users to rotate environment variables immediately, and at 13:58 UTC it said to \"assume all environment variables have been decrypted\" and to disable or rotate all keys. At 15:12 UTC it added that multiple users are confirming their AI keys have been used, and that secrets on workloads, secret groups and global secrets are all covered. Northflank has not yet said how the attacker got in or how many customers are affected.",
  "language": "en",
  "_pwn": {
    "slug": "northflank-paas-security-incident-env-vars-oct-2026",
    "severity": "critical",
    "status": "live",
    "patchStatus": "partial",
    "rss": "https://pwn.watch/i/northflank-paas-security-incident-env-vars-oct-2026/feed.xml",
    "llms": "https://pwn.watch/i/northflank-paas-security-incident-env-vars-oct-2026/llms.txt",
    "json": "https://pwn.watch/i/northflank-paas-security-incident-env-vars-oct-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/northflank-paas-security-incident-env-vars-oct-2026#2026-10-30-01a5c8ce",
      "url": "https://pwn.watch/i/northflank-paas-security-incident-env-vars-oct-2026#2026-10-30-01a5c8ce",
      "title": "Northflank security incident: PaaS tells users to assume all environment variables were decrypted: 11:43 UTC: a Wiz threat alert fires; Northflank deploys a network policy patch at 12:02 UTC and more patches at 12:50 and 13:05 UTC, and asks Wiz CIRT for help at 13:00 UTC.",
      "content_text": "Northflank security incident: PaaS tells users to assume all environment variables were decrypted: 11:43 UTC: a Wiz threat alert fires; Northflank deploys a network policy patch at 12:02 UTC and more patches at 12:50 and 13:05 UTC, and asks Wiz CIRT for help at 13:00 UTC.\n\nSource: https://status.northflank.com/cmvv0rn5a092f14rutwccodpp",
      "date_published": "2026-10-30T00:00:00.000Z",
      "external_url": "https://status.northflank.com/cmvv0rn5a092f14rutwccodpp",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/northflank-paas-security-incident-env-vars-oct-2026#2026-10-30-94b7459c",
      "url": "https://pwn.watch/i/northflank-paas-security-incident-env-vars-oct-2026#2026-10-30-94b7459c",
      "title": "Northflank security incident: PaaS tells users to assume all environment variables were decrypted: 13:40 UTC: Northflank opens a security incident with a major outage and tells users to rotate environment variables immediately.",
      "content_text": "Northflank security incident: PaaS tells users to assume all environment variables were decrypted: 13:40 UTC: Northflank opens a security incident with a major outage and tells users to rotate environment variables immediately.\n\nSource: https://status.northflank.com/cmvv0rn5a092f14rutwccodpp",
      "date_published": "2026-10-30T00:00:00.000Z",
      "external_url": "https://status.northflank.com/cmvv0rn5a092f14rutwccodpp",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/northflank-paas-security-incident-env-vars-oct-2026#2026-10-30-e879a259",
      "url": "https://pwn.watch/i/northflank-paas-security-incident-env-vars-oct-2026#2026-10-30-e879a259",
      "title": "Northflank security incident: PaaS tells users to assume all environment variables were decrypted: 13:58 UTC: Northflank marks the incident identified and says to assume all environment variables have been decrypted and to disable or rotate all keys.",
      "content_text": "Northflank security incident: PaaS tells users to assume all environment variables were decrypted: 13:58 UTC: Northflank marks the incident identified and says to assume all environment variables have been decrypted and to disable or rotate all keys.\n\nSource: https://status.northflank.com/cmvv0rn5a092f14rutwccodpp",
      "date_published": "2026-10-30T00:00:00.000Z",
      "external_url": "https://status.northflank.com/cmvv0rn5a092f14rutwccodpp",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/northflank-paas-security-incident-env-vars-oct-2026#2026-10-30-dcea50b9",
      "url": "https://pwn.watch/i/northflank-paas-security-incident-env-vars-oct-2026#2026-10-30-dcea50b9",
      "title": "Northflank security incident: PaaS tells users to assume all environment variables were decrypted: 15:12 UTC: Northflank says all users should assume their environment variables are decrypted and start rotating immediately, covering secrets on workloads, secret groups and global secrets, and that multiple users are confirming their AI keys have been used.",
      "content_text": "Northflank security incident: PaaS tells users to assume all environment variables were decrypted: 15:12 UTC: Northflank says all users should assume their environment variables are decrypted and start rotating immediately, covering secrets on workloads, secret groups and global secrets, and that multiple users are confirming their AI keys have been used.\n\nSource: https://status.northflank.com/cmvv0rn5a092f14rutwccodpp",
      "date_published": "2026-10-30T00:00:00.000Z",
      "external_url": "https://status.northflank.com/cmvv0rn5a092f14rutwccodpp",
      "tags": [
        "critical"
      ]
    }
  ]
}