// stack
Cloud & hosting
Security incidents affecting paaS, managed databases and hosting control panels. Newest first.
- incidents
- 5
- live
- 3
- patched
- 2
## 5 Cloud & hosting incidents in the last year
through Oct 22, 2026- highlivepartial fixsince Oct 21, 2026
Railway discloses unauthorized access to customer environment variables
› Railway (hosted platform)
On Oct 21 2026 Railway reported anomalous activity on systems storing customer environment variables. An unauthorized third party may have accessed encrypted env vars and, for some, obtained decrypted contents (API keys, DB/registry credentials). Railway says it believes this is part of a series of attacks on platform companies aimed at compromising AI inference providers, and asked upstream providers to revoke keys. Builds were paused platform-wide for ~a day; on Oct 22 they were restored for Enterprise and Pro, with Hobby/Free/Trial still pending. All users are told to rotate secrets while scoping continues.
- criticalclosedpatchedclosed Oct 20, 2026
OVHcloud CLI releases backdoored on GitHub
› OVHcloud CLI (GitHub releases)
In mid-October 2026 OVHcloud said attackers hijacked a developer GitHub account and planted an information stealer in five releases of its open-source CLI. Users who installed those releases should treat workstations as compromised and rotate credentials.
- criticallivepartial fixsince Oct 14, 2026
Zeabur breach exposes 3.2M env-var records; company to shut down
› Zeabur (PaaS)
Zeabur disclosed an October 14–15 2026 security incident in which an attacker used leaked internal credentials stored in plaintext to access shared clusters in 9 regions, root into 101 Zeabur-managed GCP dedicated servers, and read the platform database, exposing ~3.22 million environment-variable records across 321,810 accounts. Zeabur is winding down: from December 1 2026 shared-cluster services pause and dedicated servers stop renewing, and on December 31 all services stop and service data is deleted. Refund and incident-claim requests close November 30. Users must rotate every secret stored on Zeabur and migrate off.
show 2 older incidents2 older incidents
September 2026 1
April 2026 1
highWebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerabilitypatched
› WebPros cPanel & WHM and WP2 (WordPress Squared) patched
WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. Added to CISA KEV on 2026-04-30.
open incident →CVE-2026-41940
