// tag
PaaS, managed databases and hosting control panels. Newest first.
› Railway (hosted platform)
On Oct 21 2026 Railway reported anomalous activity on systems storing customer environment variables. An unauthorized third party may have accessed encrypted env vars and, for some, obtained decrypted contents (API keys, DB/registry credentials). Railway says it believes this is part of a series of attacks on platform companies aimed at compromising AI inference providers, and asked upstream providers to revoke keys. Builds were paused platform-wide for ~a day; on Oct 22 they were restored for Enterprise and Pro, with Hobby/Free/Trial still pending. All users are told to rotate secrets while scoping continues.
› OVHcloud CLI (GitHub releases)
In mid-October 2026 OVHcloud said attackers hijacked a developer GitHub account and planted an information stealer in five releases of its open-source CLI. Users who installed those releases should treat workstations as compromised and rotate credentials.
› Zeabur (PaaS)
Zeabur disclosed an October 14–15 2026 security incident in which an attacker used leaked internal credentials stored in plaintext to access shared clusters in 9 regions, root into 101 Zeabur-managed GCP dedicated servers, and read the platform database, exposing ~3.22 million environment-variable records across 321,810 accounts. Zeabur is winding down: from December 1 2026 shared-cluster services pause and dedicated servers stop renewing, and on December 31 all services stop and service data is deleted. Refund and incident-claim requests close November 30. Users must rotate every secret stored on Zeabur and migrate off.
› GoDaddy / Starfield TLS certificates (DV, OV, EV)
GoDaddy (Starfield) found that 404,607 TLS certificates carried policy information (policy OIDs, CPS URI) that didn't match its own published CP/CPS, which under the CA/Browser Forum Baseline Requirements means they must be revoked within five days. GoDaddy missed the Oct 18 deadline and says the certificates were revoked on Oct 21 2026. Nothing was hacked and no keys leaked, but sites still serving a revoked certificate can show browser warnings or become unreachable until the re-issued certificate is installed.
› PingCAP TiDB Cloud (hosted database platform)
PingCAP confirmed that between Sep 9 and Oct 7 2026 an unauthorized party used stolen service-account credentials to access internal systems, copy data and obtain source code. Exported records included TiDB Cloud user names/emails, org/project associations, SQL-editor text, billing/contract data and an encrypted API-key table. Extortion group FulcrumSec claims 10.6 TB and 115k plaintext API keys; those figures are unverified and PingCAP disputes the API-key claim. No evidence data stored in TiDB was affected.
› WebPros cPanel & WHM and WP2 (WordPress Squared) patched
WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. Added to CISA KEV on 2026-04-30.
Developer platform Railway told every customer to rotate all secrets after an intruder decrypted some stored credentials. Those environment variables hold database passwords, cloud keys and model API keys, letting anyone holding them sign in as the owner. Railway said a subset t.co/69pffCmiFq
🛑 Railway reports a security incident involving systems storing customer environment variables. An unauthorized party may have accessed encrypted secrets and, in some cases, decrypted contents. Railway has invalidated API tokens and urges users to rotate credentials. Details t.co/bsimFLmfPR
🚨BREAKING! "An unauthorised third party may have accessed encrypted customer environment variables and, in some cases, obtained the decrypted contents." That's Railway describing its own breach. • The incident: Railway disclosed unauthorised access to the systems storing
We've begun the process of ramping builds up We'll continue this into the evening, overnight, and into the morning. Tomorrow we will include a full post mortem We once again want to apologize for any inconvenience t.co/UaD21DIwzA
🚨BREAKING: RAILWAY has just disclosed MAJOR security incident. Customer API keys, database passwords, and other sensitive credentials may have been EXPOSED TO HACKERS. Railway is urging ALL customers to rotate their credentials IMMEDIATELY. And in an extraordinary move, the t.co/CXu72n1lMX
🚨BREAKING: @Railway reports a security breach in which an unauthorized third party may have accessed customer environment variables, potentially exposing API keys and database credentials. Railway urges users to rotate credentials immediately as deployments remain paused. t.co/RSYPPmTOpf
+3 more on the incident pages above.
