pwn.watch: Cloud & hosting incident updates https://pwn.watch/s/hosting Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 12:59:41 GMT [high] Railway discloses unauthorized access to customer environment variables: Builds restored for Enterprise (by ~06:12 UTC) and Pro (06:29 UTC); Hobby, then Free/Trial to follow. Deploys still queued/slow as of 08:44 UTC. https://pwn.watch/i/railway-env-var-security-disclosure railway-env-var-security-disclosure:2026-10-22:Builds restored for Enterprise (by ~06:12 UTC) and Pro (06:29 UTC); Hobby, then Free/Trial to follow. Deploys still queued/slow as of 08:44 UTC. Thu, 22 Oct 2026 00:00:00 GMT high Source: https://status.railway.com/ Status: live, partial [high] Railway discloses unauthorized access to customer environment variables: Railway publishes per-service remediation guides (AWS, GCP, GitHub, Stripe, OpenAI, Anthropic, Grok, OpenRouter, Postgres/MySQL/Redis/MongoDB credential rotation). https://pwn.watch/i/railway-env-var-security-disclosure railway-env-var-security-disclosure:2026-10-22:Railway publishes per-service remediation guides (AWS, GCP, GitHub, Stripe, OpenAI, Anthropic, Grok, OpenRouter, Postgres/MySQL/Redis/MongoDB credential rotation). Thu, 22 Oct 2026 00:00:00 GMT high Source: https://blog.railway.com/ Status: live, partial [high] Railway discloses unauthorized access to customer environment variables: CEO: builds ramping up overnight; full post-mortem promised. https://pwn.watch/i/railway-env-var-security-disclosure railway-env-var-security-disclosure:2026-10-22:CEO: builds ramping up overnight; full post-mortem promised. Thu, 22 Oct 2026 00:00:00 GMT high Source: https://x.com/JustJake/status/2113126674103722181 Status: live, partial [high] Railway discloses unauthorized access to customer environment variables: Railway rotated all Railway bucket credentials and invalidated Railway API tokens; researcher Taylor Monahan says the attackers also drained crypto wallets whose private keys were stored on Railway, starting at least two hours before disclosure. https://pwn.watch/i/railway-env-var-security-disclosure railway-env-var-security-disclosure:2026-10-22:Railway rotated all Railway bucket credentials and invalidated Railway API tokens; researcher Taylor Monahan says the attackers also drained crypto wallets whose private keys were stored on Railway, starting at least two hours before disclosure. Thu, 22 Oct 2026 00:00:00 GMT high Source: https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html Status: live, partial [high] Railway discloses unauthorized access to customer environment variables: Public security disclosure; deployments paused; users told to rotate all env vars and registry credentials. https://pwn.watch/i/railway-env-var-security-disclosure railway-env-var-security-disclosure:2026-10-21:Public security disclosure; deployments paused; users told to rotate all env vars and registry credentials. Wed, 21 Oct 2026 00:00:00 GMT high Status: live, partial [high] Railway discloses unauthorized access to customer environment variables: Status page: investigating issues; builds paused (07:24 UTC), then dashboard/API/CLI unavailable (11:33 UTC). https://pwn.watch/i/railway-env-var-security-disclosure railway-env-var-security-disclosure:2026-10-21:Status page: investigating issues; builds paused (07:24 UTC), then dashboard/API/CLI unavailable (11:33 UTC). Wed, 21 Oct 2026 00:00:00 GMT high Source: https://status.railway.com/ Status: live, partial [high] Railway discloses unauthorized access to customer environment variables: OAuth sessions invalidated as part of mitigation; users signed out (20:30 UTC). https://pwn.watch/i/railway-env-var-security-disclosure railway-env-var-security-disclosure:2026-10-21:OAuth sessions invalidated as part of mitigation; users signed out (20:30 UTC). Wed, 21 Oct 2026 00:00:00 GMT high Source: https://status.railway.com/ Status: live, partial [high] Railway discloses unauthorized access to customer environment variables: Railway posts 'urgent notice' on X; CEO says servers were compromised and urges key rotation (21:51-22:04 UTC). https://pwn.watch/i/railway-env-var-security-disclosure railway-env-var-security-disclosure:2026-10-21:Railway posts 'urgent notice' on X; CEO says servers were compromised and urges key rotation (21:51-22:04 UTC). Wed, 21 Oct 2026 00:00:00 GMT high Source: https://x.com/Railway/status/2113025284148715845 Status: live, partial [high] Railway discloses unauthorized access to customer environment variables: Railway detects anomalous activity; investigates. https://pwn.watch/i/railway-env-var-security-disclosure railway-env-var-security-disclosure:2026-10-21 morning:Railway detects anomalous activity; investigates. Wed, 21 Oct 2026 00:00:00 GMT high Status: live, partial [medium] GoDaddy mass-revokes 404,607 TLS certificates over CP/CPS profile mismatch: GoDaddy's customer notice says the incorrectly issued certificates were revoked; affected sites must install the re-issued certificate. https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026 godaddy-mass-certificate-revocation-oct-2026:2026-10-21:GoDaddy's customer notice says the incorrectly issued certificates were revoked; affected sites must install the re-issued certificate. Wed, 21 Oct 2026 00:00:00 GMT medium Source: https://www.godaddy.com/help/what-is-the-cpcps-certificate-profile-bug-43095 Status: live, partial [high] PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken: PingCAP Japan adds support-ticket information to the list of exposed data. https://pwn.watch/i/pingcap-tidb-cloud-breach pingcap-tidb-cloud-breach:2026-10-21:PingCAP Japan adds support-ticket information to the list of exposed data. Wed, 21 Oct 2026 00:00:00 GMT high Source: https://pingcap.co.jp/trust-hub/security/security-update-october-2026/ Status: live, partial [high] PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken: FulcrumSec goes public with claims (10.6 TB, 180k orgs, 115k API keys) and a ~200 GB sample; Bitget says it held only public trade logs there. https://pwn.watch/i/pingcap-tidb-cloud-breach pingcap-tidb-cloud-breach:2026-10-20:FulcrumSec goes public with claims (10.6 TB, 180k orgs, 115k API keys) and a ~200 GB sample; Bitget says it held only public trade logs there. Tue, 20 Oct 2026 00:00:00 GMT high Source: https://cryptobriefing.com/bitget-no-user-data-tidb-cloud-breach/ Status: live, partial [medium] GoDaddy mass-revokes 404,607 TLS certificates over CP/CPS profile mismatch: 227,422 of 404,607 certificates revoked as of 05:29 UTC. https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026 godaddy-mass-certificate-revocation-oct-2026:2026-10-19:227,422 of 404,607 certificates revoked as of 05:29 UTC. Mon, 19 Oct 2026 00:00:00 GMT medium Source: https://bugzilla.mozilla.org/show_bug.cgi?id=2083191 Status: live, partial [high] PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken: PingCAP publishes incident report; Japan notice cites up to ~50,000 personal records. https://pwn.watch/i/pingcap-tidb-cloud-breach pingcap-tidb-cloud-breach:2026-10-19:PingCAP publishes incident report; Japan notice cites up to ~50,000 personal records. Mon, 19 Oct 2026 00:00:00 GMT high Source: https://pingcap.co.jp/trust-hub/security/security-update-october-2026/ Status: live, partial [medium] GoDaddy mass-revokes 404,607 TLS certificates over CP/CPS profile mismatch: Five-day revocation deadline (23:45 UTC) passes with 170,566 certificates revoked; GoDaddy files a delayed-revocation incident. https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026 godaddy-mass-certificate-revocation-oct-2026:2026-10-18:Five-day revocation deadline (23:45 UTC) passes with 170,566 certificates revoked; GoDaddy files a delayed-revocation incident. Sun, 18 Oct 2026 00:00:00 GMT medium Source: https://bugzilla.mozilla.org/show_bug.cgi?id=2083191 Status: live, partial [critical] Zeabur breach exposes 3.2M env-var records; company to shut down: Attacker reads ~53 production secrets and re-adds SSH keys after a key is disabled; last recorded activity at 21:05. https://pwn.watch/i/zeabur-october-2026-breach-shutdown zeabur-october-2026-breach-shutdown:2026-10-15:Attacker reads ~53 production secrets and re-adds SSH keys after a key is disabled; last recorded activity at 21:05. Thu, 15 Oct 2026 00:00:00 GMT critical Source: https://zeabur.com/blogs/october-2026-security-incident Status: live, partial [critical] Zeabur breach exposes 3.2M env-var records; company to shut down: Attacker starts using Zeabur internal AWS keys and shared-cluster admin tokens (stored in plaintext), reads secrets and env vars across 9 regions, and signs in as root to 101 GCP dedicated servers. https://pwn.watch/i/zeabur-october-2026-breach-shutdown zeabur-october-2026-breach-shutdown:2026-10-14:Attacker starts using Zeabur internal AWS keys and shared-cluster admin tokens (stored in plaintext), reads secrets and env vars across 9 regions, and signs in as root to 101 GCP dedicated servers. Wed, 14 Oct 2026 00:00:00 GMT critical Source: https://zeabur.com/blogs/october-2026-security-incident Status: live, partial [medium] GoDaddy mass-revokes 404,607 TLS certificates over CP/CPS profile mismatch: GoDaddy confirms a third-party report of CP/CPS discrepancies, suspends issuance, fixes its CP/CPS and starts contacting the 404,607 affected subscribers. https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026 godaddy-mass-certificate-revocation-oct-2026:2026-10-14:GoDaddy confirms a third-party report of CP/CPS discrepancies, suspends issuance, fixes its CP/CPS and starts contacting the 404,607 affected subscribers. Wed, 14 Oct 2026 00:00:00 GMT medium Source: https://bugzilla.mozilla.org/show_bug.cgi?id=2083191 Status: live, partial [high] PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken: All identified compromised credentials invalidated and access paths blocked; four vulnerabilities found by IR firm fixed. https://pwn.watch/i/pingcap-tidb-cloud-breach pingcap-tidb-cloud-breach:2026-10-14:All identified compromised credentials invalidated and access paths blocked; four vulnerabilities found by IR firm fixed. Wed, 14 Oct 2026 00:00:00 GMT high Source: https://www.pingcap.com/trust-hub/security/security-update-october-2026/ Status: live, partial [high] PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken: PingCAP detects the intrusion and starts disabling credentials. https://pwn.watch/i/pingcap-tidb-cloud-breach pingcap-tidb-cloud-breach:2026-10-07:PingCAP detects the intrusion and starts disabling credentials. Wed, 07 Oct 2026 00:00:00 GMT high Source: https://www.pingcap.com/trust-hub/security/security-update-october-2026/ Status: live, partial [high] PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken: Unauthorized access with stolen service-account credentials begins. https://pwn.watch/i/pingcap-tidb-cloud-breach pingcap-tidb-cloud-breach:2026-09-09:Unauthorized access with stolen service-account credentials begins. Wed, 09 Sep 2026 00:00:00 GMT high Source: https://www.pingcap.com/trust-hub/security/security-update-october-2026/ Status: live, partial [high] WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability: CISA added CVE-2026-41940 to the KEV catalog (due 2026-05-03). https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940 webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940:2026-04-30:CISA added CVE-2026-41940 to the KEV catalog (due 2026-05-03). Thu, 30 Apr 2026 00:00:00 GMT high Status: closed, patched