# Northflank security incident: PaaS tells users to assume all environment variables were decrypted · pwn.watch > Northflank, a platform-as-a-service for deploying apps and databases, declared a security incident with a major outage across 7 platform components on Oct 30 2026. Its status page says a Wiz threat alert fired at 11:43 UTC, engineers reviewed it a minute later, and Northflank deployed an initial network policy patch at 12:02 UTC with more patches at 12:50 and 13:05 UTC, then requested Wiz CIRT support at 13:00 UTC. At 13:40 UTC it told users to rotate environment variables immediately, and at 13:58 UTC it said to "assume all environment variables have been decrypted" and to disable or rotate all keys. At 15:12 UTC it added that multiple users are confirming their AI keys have been used, and that secrets on workloads, secret groups and global secrets are all covered. Northflank has not yet said how the attacker got in or how many customers are affected. Page: https://pwn.watch/i/northflank-paas-security-incident-env-vars-oct-2026 · generated 2026-10-30T17:15:13.137Z ## Status - Severity: critical · status: live · patch: partial - Product: Northflank (PaaS) - Started: 2026-10-30 - Affected: Northflank platform (all environment variables stored on Northflank) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/northflank-paas-security-incident-env-vars-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/northflank-paas-security-incident-env-vars-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/northflank-paas-security-incident-env-vars-oct-2026.json - This file: https://pwn.watch/i/northflank-paas-security-incident-env-vars-oct-2026/llms.txt ## Updates (newest first) - 2026-10-30: 11:43 UTC: a Wiz threat alert fires; Northflank deploys a network policy patch at 12:02 UTC and more patches at 12:50 and 13:05 UTC, and asks Wiz CIRT for help at 13:00 UTC. (https://status.northflank.com/cmvv0rn5a092f14rutwccodpp) - 2026-10-30: 13:40 UTC: Northflank opens a security incident with a major outage and tells users to rotate environment variables immediately. (https://status.northflank.com/cmvv0rn5a092f14rutwccodpp) - 2026-10-30: 13:58 UTC: Northflank marks the incident identified and says to assume all environment variables have been decrypted and to disable or rotate all keys. (https://status.northflank.com/cmvv0rn5a092f14rutwccodpp) - 2026-10-30: 15:12 UTC: Northflank says all users should assume their environment variables are decrypted and start rotating immediately, covering secrets on workloads, secret groups and global secrets, and that multiple users are confirming their AI keys have been used. (https://status.northflank.com/cmvv0rn5a092f14rutwccodpp) ## Fix brief # Security brief: Northflank security incident: PaaS tells users to assume all environment variables were decrypted Source: https://pwn.watch/i/northflank-paas-security-incident-env-vars-oct-2026 · status: live · severity: critical · updated Oct 30, 2026, 15:58 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Northflank, a platform-as-a-service for deploying apps and databases, declared a security incident with a major outage across 7 platform components on Oct 30 2026. Its status page says a Wiz threat alert fired at 11:43 UTC, engineers reviewed it a minute later, and Northflank deployed an initial network policy patch at 12:02 UTC with more patches at 12:50 and 13:05 UTC, then requested Wiz CIRT support at 13:00 UTC. At 13:40 UTC it told users to rotate environment variables immediately, and at 13:58 UTC it said to "assume all environment variables have been decrypted" and to disable or rotate all keys. At 15:12 UTC it added that multiple users are confirming their AI keys have been used, and that secrets on workloads, secret groups and global secrets are all covered. Northflank has not yet said how the attacker got in or how many customers are affected. Severity detail: Northflank tells every customer to assume their environment variables were decrypted; cause and scope not yet disclosed - Product: Northflank (PaaS) ## Affected versions - Northflank platform (all environment variables stored on Northflank) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you run anything on Northflank, rotate every secret stored in its environment variables and secret groups now: database passwords, API keys, cloud credentials, OAuth secrets and signing keys. Disable keys you can't rotate right away, then review provider logs (cloud, database, payment, email) for use of the old credentials since Oct 30 2026. Watch the Northflank status page for the root cause and scope. ## Latest updates - Oct 30, 2026: 11:43 UTC: a Wiz threat alert fires; Northflank deploys a network policy patch at 12:02 UTC and more patches at 12:50 and 13:05 UTC, and asks Wiz CIRT for help at 13:00 UTC. - Oct 30, 2026: 13:40 UTC: Northflank opens a security incident with a major outage and tells users to rotate environment variables immediately. - Oct 30, 2026: 13:58 UTC: Northflank marks the incident identified and says to assume all environment variables have been decrypted and to disable or rotate all keys. - Oct 30, 2026: 15:12 UTC: Northflank says all users should assume their environment variables are decrypted and start rotating immediately, covering secrets on workloads, secret groups and global secrets, and that multiple users are confirming their AI keys have been used. ## Advisories - [Security incident (Northflank status page)](https://status.northflank.com/cmvv0rn5a092f14rutwccodpp) (Northflank) ## Write-ups & news - [Northflank PaaS – Security Incident](https://news.ycombinator.com/item?id=50304345) - [Northflank Breached](https://news.ycombinator.com/item?id=50305025) --- Machine-readable: https://pwn.watch/i/northflank-paas-security-incident-env-vars-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.