{ "site": "https://pwn.watch", "generatedAt": "2026-10-22T16:23:59.585Z", "tag": { "id": "hosting", "label": "Cloud & hosting", "isStack": true, "url": "https://pwn.watch/t/hosting", "feed": "https://pwn.watch/t/hosting/feed.xml" }, "counts": { "incidents": 12, "live": 4, "notFullyPatched": 4, "patched": 8 }, "incidents": [ { "slug": "railway-env-var-security-disclosure", "title": "Railway discloses unauthorized access to customer environment variables", "url": "https://pwn.watch/i/railway-env-var-security-disclosure", "json": "https://pwn.watch/i/railway-env-var-security-disclosure.json", "status": "live", "severity": "high", "patchStatus": "partial", "product": "Railway (hosted platform)", "tags": [ "hosting", "railway" ], "cveIds": [], "affectedVersions": [ "Customer projects with secrets stored as Railway environment variables (scope still under investigation; Railway says initial analysis suggests a subset of users)" ], "fixedVersions": [], "startedAt": "2026-10-21", "closedAt": null, "updatedAt": "2026-10-22T16:32:37+02:00", "summary": "On Oct 21 2026 Railway reported anomalous activity on systems storing customer environment variables. An unauthorized third party may have accessed encrypted env vars and, for some, obtained decrypted contents (API keys, DB/registry credentials). Railway says it believes this is part of a series of attacks on platform companies aimed at compromising AI inference providers, and asked upstream providers to revoke keys. Builds were paused platform-wide for ~a day; on Oct 22 they were restored for Enterprise and Pro, with Hobby/Free/Trial still pending. All users are told to rotate secrets while scoping continues.", "xPost": null }, { "slug": "ovhcloud-cli-github-infostealer", "title": "OVHcloud CLI releases backdoored on GitHub", "url": "https://pwn.watch/i/ovhcloud-cli-github-infostealer", "json": "https://pwn.watch/i/ovhcloud-cli-github-infostealer.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "OVHcloud CLI (GitHub releases)", "tags": [ "hosting", "github", "ovhcloud", "supply-chain" ], "cveIds": [], "affectedVersions": [ "Five backdoored releases during the Oct 2026 window (see OVHcloud advisory)" ], "fixedVersions": [ "Clean releases after incident; reinstall from verified source" ], "startedAt": "2026-10-19", "closedAt": "2026-10-20", "updatedAt": "2026-10-20", "summary": "In mid-October 2026 OVHcloud said attackers hijacked a developer GitHub account and planted an information stealer in five releases of its open-source CLI. Users who installed those releases should treat workstations as compromised and rotate credentials.", "xPost": null }, { "slug": "zeabur-october-2026-breach-shutdown", "title": "Zeabur breach exposes 3.2M env-var records; company to shut down", "url": "https://pwn.watch/i/zeabur-october-2026-breach-shutdown", "json": "https://pwn.watch/i/zeabur-october-2026-breach-shutdown.json", "status": "live", "severity": "critical", "patchStatus": "partial", "product": "Zeabur (PaaS)", "tags": [ "hosting", "zeabur", "data-breach" ], "cveIds": [], "affectedVersions": [ "Platform-wide (accounts with stored env vars)" ], "fixedVersions": [], "startedAt": "2026-10-14", "closedAt": null, "updatedAt": "2026-10-22T18:15:27+02:00", "summary": "Zeabur disclosed an October 14–15 2026 security incident in which an attacker used leaked internal credentials stored in plaintext to access shared clusters in 9 regions, root into 101 Zeabur-managed GCP dedicated servers, and read the platform database, exposing ~3.22 million environment-variable records across 321,810 accounts. Zeabur is winding down: from December 1 2026 shared-cluster services pause and dedicated servers stop renewing, and on December 31 all services stop and service data is deleted. Refund and incident-claim requests close November 30. Users must rotate every secret stored on Zeabur and migrate off.", "xPost": null }, { "slug": "godaddy-mass-certificate-revocation-oct-2026", "title": "GoDaddy mass-revokes 404,607 TLS certificates over CP/CPS profile mismatch", "url": "https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026", "json": "https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026.json", "status": "live", "severity": "medium", "patchStatus": "partial", "product": "GoDaddy / Starfield TLS certificates (DV, OV, EV)", "tags": [ "hosting", "godaddy", "tls" ], "cveIds": [], "affectedVersions": [ "404,607 certificates from Starfield R1/G2 and GoDaddy R1 intermediates (396,055 of them DV from Starfield R1 and G2)" ], "fixedVersions": [ "Re-issued certificates from the GoDaddy SSL dashboard (customer must install them)" ], "startedAt": "2026-10-14", "closedAt": null, "updatedAt": "2026-10-22T14:58:57+02:00", "summary": "GoDaddy (Starfield) found that 404,607 TLS certificates carried policy information (policy OIDs, CPS URI) that didn't match its own published CP/CPS, which under the CA/Browser Forum Baseline Requirements means they must be revoked within five days. GoDaddy missed the Oct 18 deadline and says the certificates were revoked on Oct 21 2026. Nothing was hacked and no keys leaked, but sites still serving a revoked certificate can show browser warnings or become unreachable until the re-issued certificate is installed.", "xPost": null }, { "slug": "pingcap-tidb-cloud-breach", "title": "PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken", "url": "https://pwn.watch/i/pingcap-tidb-cloud-breach", "json": "https://pwn.watch/i/pingcap-tidb-cloud-breach.json", "status": "live", "severity": "high", "patchStatus": "partial", "product": "PingCAP TiDB Cloud (hosted database platform)", "tags": [ "hosting", "pingcap", "tidb", "data-breach" ], "cveIds": [], "affectedVersions": [ "TiDB Cloud customers (customer-specific impact still being determined)" ], "fixedVersions": [], "startedAt": "2026-09-09", "closedAt": null, "updatedAt": "2026-10-22T11:20:00+02:00", "summary": "PingCAP confirmed that between Sep 9 and Oct 7 2026 an unauthorized party used stolen service-account credentials to access internal systems, copy data and obtain source code. Exported records included TiDB Cloud user names/emails, org/project associations, SQL-editor text, billing/contract data and an encrypted API-key table. Extortion group FulcrumSec claims 10.6 TB and 115k plaintext API keys; those figures are unverified and PingCAP disputes the API-key claim. No evidence data stored in TiDB was affected.", "xPost": null }, { "slug": "webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940", "title": "WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability", "url": "https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940", "json": "https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "WebPros cPanel & WHM and WP2 (WordPress Squared)", "tags": [ "wordpress", "hosting", "cpanel", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-41940" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-04-30", "closedAt": "2026-04-30", "updatedAt": "2026-04-30", "summary": "WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. Added to CISA KEV on 2026-04-30.", "xPost": null }, { "slug": "cwp-control-web-panel-cve-2025-48703", "title": "CWP Control Web Panel: Control Web Panel OS Command Injection Vulnerability", "url": "https://pwn.watch/i/cwp-control-web-panel-cve-2025-48703", "json": "https://pwn.watch/i/cwp-control-web-panel-cve-2025-48703.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "CWP Control Web Panel", "tags": [ "hosting", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-48703" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-11-04", "closedAt": "2025-11-04", "updatedAt": "2025-11-04", "summary": "CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known. Added to CISA KEV on 2025-11-04.", "xPost": null }, { "slug": "ingressnightmare-ingress-nginx-cve-2025-1974", "title": "IngressNightmare: unauthenticated RCE in Kubernetes ingress-nginx admission controller (CVE-2025-1974)", "url": "https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974", "json": "https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Kubernetes ingress-nginx controller", "tags": [ "hosting", "kubernetes", "nginx", "ingress-nginx", "rce" ], "cveIds": [ "CVE-2025-1974" ], "affectedVersions": [ "< 1.11.0", "1.11.0-1.11.4", "1.12.0" ], "fixedVersions": [ "1.11.5", "1.12.1" ], "startedAt": "2025-03-24", "closedAt": "2025-03-24", "updatedAt": "2025-03-24", "summary": "Wiz found that the ingress-nginx admission webhook could be made to load attacker config and run code, giving access to all cluster secrets the controller can read. CVSS 9.8. Fixed in controller v1.12.1 and v1.11.5; otherwise disable the validating webhook.", "xPost": null }, { "slug": "oracle-cloud-classic-login-breach-march-2025", "title": "Oracle Cloud login servers breached: ~6M SSO/LDAP records offered for sale", "url": "https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025", "json": "https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "product": "Oracle Cloud Classic (Gen 1) login/IDM servers", "tags": [ "hosting", "oracle", "oracle-cloud", "data-breach" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2025-03-21", "closedAt": "2025-04-08", "updatedAt": "2025-04-08", "summary": "A hacker using the name rose87168 claimed in March 2025 to have stolen about 6 million SSO and LDAP records from Oracle Cloud login servers. Oracle first denied an OCI breach, then told customers privately that two obsolete servers (reportedly Oracle Cloud Classic / Gen 1) were accessed, exposing usernames and hashed or encrypted passwords.", "xPost": null }, { "slug": "cyberpersons-cyberpanel-cve-2024-51567-51378", "title": "CyberPersons CyberPanel: 2 actively exploited vulnerabilities", "url": "https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378", "json": "https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "CyberPersons CyberPanel", "tags": [ "hosting", "cyberpanel", "cisa-kev", "ransomware", "auth-bypass" ], "cveIds": [ "CVE-2024-51567", "CVE-2024-51378" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-10-29", "closedAt": "2024-12-04", "updatedAt": "2024-12-04", "summary": "CVE-2024-51567: CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root. CVE-2024-51378: CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property. Added to the CISA KEV catalog on 2024-11-07, 2024-12-04. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "hugging-face-spaces-secrets-leak", "title": "Hugging Face Spaces secrets accessed without authorization", "url": "https://pwn.watch/i/hugging-face-spaces-secrets-leak", "json": "https://pwn.watch/i/hugging-face-spaces-secrets-leak.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "product": "Hugging Face Spaces", "tags": [ "ai", "hosting", "hugging-face", "secrets", "data-breach" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2024-05-31", "closedAt": "2024-05-31", "updatedAt": "2024-05-31", "summary": "Hugging Face detected unauthorized access to its Spaces platform, specifically Spaces secrets, and suspected a subset had been read. It revoked affected HF tokens, emailed impacted users, removed org tokens, moved Spaces secrets to a KMS, and told users to rotate keys and switch to fine-grained tokens.", "xPost": null }, { "slug": "cwp-control-web-panel-cve-2022-44877", "title": "CWP Control Web Panel: OS Command Injection (CVE-2022-44877)", "url": "https://pwn.watch/i/cwp-control-web-panel-cve-2022-44877", "json": "https://pwn.watch/i/cwp-control-web-panel-cve-2022-44877.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "CWP Control Web Panel", "tags": [ "hosting", "cwp", "cisa-kev", "rce" ], "cveIds": [ "CVE-2022-44877" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-01-17", "closedAt": "2023-01-17", "updatedAt": "2023-01-17", "summary": "CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter. Added to CISA KEV on 2023-01-17.", "xPost": null } ], "posts": [ { "authorName": "Rohan Paul", "handle": "rohanpaul_ai", "avatarUrl": "https://pbs.twimg.com/profile_images/1816185267037859840/Fd18CH0v_bigger.jpg", "text": "Developer platform Railway told every customer to rotate all secrets after an intruder decrypted some stored credentials.\n\nThose environment variables hold database passwords, cloud keys and model API keys, letting anyone holding them sign in as the owner.\n\nRailway said a subset https://t.co/69pffCmiFq", "date": "2026-10-22T14:19:29.000Z", "url": "https://x.com/rohanpaul_ai/status/2113274044955099629", "media": [], "incident": "railway-env-var-security-disclosure" }, { "authorName": "The Hacker News", "handle": "TheHackersNews", "avatarUrl": "https://pbs.twimg.com/profile_images/1597647879811657728/FLgHrLHy_bigger.jpg", "text": "🛑 Railway reports a security incident involving systems storing customer environment variables.\n\nAn unauthorized party may have accessed encrypted secrets and, in some cases, decrypted contents.\n\nRailway has invalidated API tokens and urges users to rotate credentials.\n\nDetails https://t.co/bsimFLmfPR", "date": "2026-10-22T11:24:18.000Z", "url": "https://x.com/TheHackersNews/status/2113229957040336907", "media": [], "incident": "railway-env-var-security-disclosure" }, { "authorName": "NeilXbt", "handle": "neil_xbt", "avatarUrl": "https://pbs.twimg.com/profile_images/2060131227756072962/s8DV8v8L_bigger.jpg", "text": "🚨BREAKING!\n\n\"An unauthorised third party may have accessed encrypted customer environment variables and, in some cases, obtained the decrypted contents.\" \n\nThat's Railway describing its own breach.\n\n• The incident: Railway disclosed unauthorised access to the systems storing", "date": "2026-10-22T05:41:53.000Z", "url": "https://x.com/neil_xbt/status/2113143785802625282", "media": [], "incident": "railway-env-var-security-disclosure" }, { "authorName": "Jake", "handle": "JustJake", "avatarUrl": "https://pbs.twimg.com/profile_images/1875304774314401792/sFwtBtJt_bigger.jpg", "text": "We've begun the process of ramping builds up\n\nWe'll continue this into the evening, overnight, and into the morning. Tomorrow we will include a full post mortem\n\nWe once again want to apologize for any inconvenience https://t.co/UaD21DIwzA", "date": "2026-10-22T04:33:53.000Z", "url": "https://x.com/JustJake/status/2113126674103722181", "media": [], "incident": "railway-env-var-security-disclosure" }, { "authorName": "Mark Gadala-Maria", "handle": "markgadala", "avatarUrl": "https://pbs.twimg.com/profile_images/1904279027013001216/STf4Q5To_bigger.jpg", "text": "🚨BREAKING: RAILWAY has just disclosed MAJOR security incident.\n\nCustomer API keys, database passwords, and other sensitive credentials may have been EXPOSED TO HACKERS.\n\nRailway is urging ALL customers to rotate their credentials IMMEDIATELY.\n\nAnd in an extraordinary move, the https://t.co/CXu72n1lMX", "date": "2026-10-22T00:00:31.000Z", "url": "https://x.com/markgadala/status/2113057879167058072", "media": [], "incident": "railway-env-var-security-disclosure" }, { "authorName": "Crypto Briefing", "handle": "Crypto_Briefing", "avatarUrl": "https://pbs.twimg.com/profile_images/1346106979605995520/BcuRRkze_bigger.jpg", "text": "🚨BREAKING: @Railway reports a security breach in which an unauthorized third party may have accessed customer environment variables, potentially exposing API keys and database credentials.\n\nRailway urges users to rotate credentials immediately as deployments remain paused. https://t.co/RSYPPmTOpf", "date": "2026-10-21T22:40:24.000Z", "url": "https://x.com/Crypto_Briefing/status/2113037715709255981", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HVMEcvoXsAEK3Rq.jpg" } ], "incident": "railway-env-var-security-disclosure" }, { "authorName": "Jake", "handle": "JustJake", "avatarUrl": "https://pbs.twimg.com/profile_images/1875304774314401792/sFwtBtJt_bigger.jpg", "text": "Today, we were alerted of malicious activity that compromised Railway's servers\n\nWe are sharing this with you broadly and swiftly. We recommend folks rotate their keys out of an abundance of caution. https://t.co/b4MRzBh2Wb", "date": "2026-10-21T22:04:18.000Z", "url": "https://x.com/JustJake/status/2113028631463436786", "media": [], "incident": "railway-env-var-security-disclosure" }, { "authorName": "Railway", "handle": "Railway", "avatarUrl": "https://pbs.twimg.com/profile_images/2060407291996692484/ave6xJl9_bigger.jpg", "text": "An urgent notice from the Railway team\n\nhttps://t.co/niUAhTAQJM", "date": "2026-10-21T21:51:00.000Z", "url": "https://x.com/Railway/status/2113025284148715845", "media": [], "incident": "railway-env-var-security-disclosure" }, { "authorName": "International Cyber Digest", "handle": "IntCyberDigest", "avatarUrl": "https://pbs.twimg.com/profile_images/1831435438562615296/imkSFey2_bigger.jpg", "text": "‼️ GoDaddy is revoking 404,607 TLS certificates after a third party flagged that they didn't match its published certificate rules. https://t.co/SoNFcuNmJj", "date": "2026-10-21T20:03:00.000Z", "url": "https://x.com/IntCyberDigest/status/2112998104030982490", "media": [], "incident": "godaddy-mass-certificate-revocation-oct-2026" } ], "changes": [ { "incident": "railway-env-var-security-disclosure", "incidentTitle": "Railway discloses unauthorized access to customer environment variables", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Builds restored for Enterprise (by ~06:12 UTC) and Pro (06:29 UTC); Hobby, then Free/Trial to follow. Deploys still queued/slow as of 08:44 UTC.", "body": null, "sourceUrl": "https://status.railway.com/", "url": "https://pwn.watch/i/railway-env-var-security-disclosure" }, { "incident": "railway-env-var-security-disclosure", "incidentTitle": "Railway discloses unauthorized access to customer environment variables", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Railway publishes per-service remediation guides (AWS, GCP, GitHub, Stripe, OpenAI, Anthropic, Grok, OpenRouter, Postgres/MySQL/Redis/MongoDB credential rotation).", "body": null, "sourceUrl": "https://blog.railway.com/", "url": "https://pwn.watch/i/railway-env-var-security-disclosure" }, { "incident": "railway-env-var-security-disclosure", "incidentTitle": "Railway discloses unauthorized access to customer environment variables", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "CEO: builds ramping up overnight; full post-mortem promised.", "body": null, "sourceUrl": "https://x.com/JustJake/status/2113126674103722181", "url": "https://pwn.watch/i/railway-env-var-security-disclosure" }, { "incident": "railway-env-var-security-disclosure", "incidentTitle": "Railway discloses unauthorized access to customer environment variables", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Railway rotated all Railway bucket credentials and invalidated Railway API tokens; researcher Taylor Monahan says the attackers also drained crypto wallets whose private keys were stored on Railway, starting at least two hours before disclosure.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html", "url": "https://pwn.watch/i/railway-env-var-security-disclosure" }, { "incident": "railway-env-var-security-disclosure", "incidentTitle": "Railway discloses unauthorized access to customer environment variables", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "Public security disclosure; deployments paused; users told to rotate all env vars and registry credentials.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/railway-env-var-security-disclosure" }, { "incident": "railway-env-var-security-disclosure", "incidentTitle": "Railway discloses unauthorized access to customer environment variables", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "Status page: investigating issues; builds paused (07:24 UTC), then dashboard/API/CLI unavailable (11:33 UTC).", "body": null, "sourceUrl": "https://status.railway.com/", "url": "https://pwn.watch/i/railway-env-var-security-disclosure" }, { "incident": "railway-env-var-security-disclosure", "incidentTitle": "Railway discloses unauthorized access to customer environment variables", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "OAuth sessions invalidated as part of mitigation; users signed out (20:30 UTC).", "body": null, "sourceUrl": "https://status.railway.com/", "url": "https://pwn.watch/i/railway-env-var-security-disclosure" }, { "incident": "railway-env-var-security-disclosure", "incidentTitle": "Railway discloses unauthorized access to customer environment variables", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "Railway posts 'urgent notice' on X; CEO says servers were compromised and urges key rotation (21:51-22:04 UTC).", "body": null, "sourceUrl": "https://x.com/Railway/status/2113025284148715845", "url": "https://pwn.watch/i/railway-env-var-security-disclosure" }, { "incident": "railway-env-var-security-disclosure", "incidentTitle": "Railway discloses unauthorized access to customer environment variables", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-21 morning", "title": "Railway detects anomalous activity; investigates.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/railway-env-var-security-disclosure" }, { "incident": "godaddy-mass-certificate-revocation-oct-2026", "incidentTitle": "GoDaddy mass-revokes 404,607 TLS certificates over CP/CPS profile mismatch", "severity": "medium", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "GoDaddy's customer notice says the incorrectly issued certificates were revoked; affected sites must install the re-issued certificate.", "body": null, "sourceUrl": "https://www.godaddy.com/help/what-is-the-cpcps-certificate-profile-bug-43095", "url": "https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026" }, { "incident": "pingcap-tidb-cloud-breach", "incidentTitle": "PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "PingCAP Japan adds support-ticket information to the list of exposed data.", "body": null, "sourceUrl": "https://pingcap.co.jp/trust-hub/security/security-update-october-2026/", "url": "https://pwn.watch/i/pingcap-tidb-cloud-breach" }, { "incident": "pingcap-tidb-cloud-breach", "incidentTitle": "PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-20", "title": "FulcrumSec goes public with claims (10.6 TB, 180k orgs, 115k API keys) and a ~200 GB sample; Bitget says it held only public trade logs there.", "body": null, "sourceUrl": "https://cryptobriefing.com/bitget-no-user-data-tidb-cloud-breach/", "url": "https://pwn.watch/i/pingcap-tidb-cloud-breach" }, { "incident": "godaddy-mass-certificate-revocation-oct-2026", "incidentTitle": "GoDaddy mass-revokes 404,607 TLS certificates over CP/CPS profile mismatch", "severity": "medium", "status": "live", "patchStatus": "partial", "date": "2026-10-19", "title": "227,422 of 404,607 certificates revoked as of 05:29 UTC.", "body": null, "sourceUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083191", "url": "https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026" }, { "incident": "pingcap-tidb-cloud-breach", "incidentTitle": "PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-19", "title": "PingCAP publishes incident report; Japan notice cites up to ~50,000 personal records.", "body": null, "sourceUrl": "https://pingcap.co.jp/trust-hub/security/security-update-october-2026/", "url": "https://pwn.watch/i/pingcap-tidb-cloud-breach" }, { "incident": "godaddy-mass-certificate-revocation-oct-2026", "incidentTitle": "GoDaddy mass-revokes 404,607 TLS certificates over CP/CPS profile mismatch", "severity": "medium", "status": "live", "patchStatus": "partial", "date": "2026-10-18", "title": "Five-day revocation deadline (23:45 UTC) passes with 170,566 certificates revoked; GoDaddy files a delayed-revocation incident.", "body": null, "sourceUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083191", "url": "https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026" }, { "incident": "zeabur-october-2026-breach-shutdown", "incidentTitle": "Zeabur breach exposes 3.2M env-var records; company to shut down", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-15", "title": "Attacker reads ~53 production secrets and re-adds SSH keys after a key is disabled; last recorded activity at 21:05.", "body": null, "sourceUrl": "https://zeabur.com/blogs/october-2026-security-incident", "url": "https://pwn.watch/i/zeabur-october-2026-breach-shutdown" }, { "incident": "zeabur-october-2026-breach-shutdown", "incidentTitle": "Zeabur breach exposes 3.2M env-var records; company to shut down", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-14", "title": "Attacker starts using Zeabur internal AWS keys and shared-cluster admin tokens (stored in plaintext), reads secrets and env vars across 9 regions, and signs in as root to 101 GCP dedicated servers.", "body": null, "sourceUrl": "https://zeabur.com/blogs/october-2026-security-incident", "url": "https://pwn.watch/i/zeabur-october-2026-breach-shutdown" }, { "incident": "godaddy-mass-certificate-revocation-oct-2026", "incidentTitle": "GoDaddy mass-revokes 404,607 TLS certificates over CP/CPS profile mismatch", "severity": "medium", "status": "live", "patchStatus": "partial", "date": "2026-10-14", "title": "GoDaddy confirms a third-party report of CP/CPS discrepancies, suspends issuance, fixes its CP/CPS and starts contacting the 404,607 affected subscribers.", "body": null, "sourceUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083191", "url": "https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026" }, { "incident": "pingcap-tidb-cloud-breach", "incidentTitle": "PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-14", "title": "All identified compromised credentials invalidated and access paths blocked; four vulnerabilities found by IR firm fixed.", "body": null, "sourceUrl": "https://www.pingcap.com/trust-hub/security/security-update-october-2026/", "url": "https://pwn.watch/i/pingcap-tidb-cloud-breach" }, { "incident": "pingcap-tidb-cloud-breach", "incidentTitle": "PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-07", "title": "PingCAP detects the intrusion and starts disabling credentials.", "body": null, "sourceUrl": "https://www.pingcap.com/trust-hub/security/security-update-october-2026/", "url": "https://pwn.watch/i/pingcap-tidb-cloud-breach" }, { "incident": "pingcap-tidb-cloud-breach", "incidentTitle": "PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-09-09", "title": "Unauthorized access with stolen service-account credentials begins.", "body": null, "sourceUrl": "https://www.pingcap.com/trust-hub/security/security-update-october-2026/", "url": "https://pwn.watch/i/pingcap-tidb-cloud-breach" }, { "incident": "webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940", "incidentTitle": "WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-30", "title": "CISA added CVE-2026-41940 to the KEV catalog (due 2026-05-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940" }, { "incident": "cwp-control-web-panel-cve-2025-48703", "incidentTitle": "CWP Control Web Panel: Control Web Panel OS Command Injection Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-11-04", "title": "CISA added CVE-2025-48703 to the KEV catalog (due 2025-11-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cwp-control-web-panel-cve-2025-48703" }, { "incident": "oracle-cloud-classic-login-breach-march-2025", "incidentTitle": "Oracle Cloud login servers breached: ~6M SSO/LDAP records offered for sale", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-04-08", "title": "Reports that Oracle privately confirmed the breach to customers", "body": null, "sourceUrl": "https://www.theregister.com/off-prem/2025/04/08/oracle-tells-customers-its-public-cloud-was-compromised/431082", "url": "https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025" }, { "incident": "ingressnightmare-ingress-nginx-cve-2025-1974", "incidentTitle": "IngressNightmare: unauthenticated RCE in Kubernetes ingress-nginx admission controller (CVE-2025-1974)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-24", "title": "Kubernetes publishes advisory and fixed controller releases; Wiz publishes IngressNightmare", "body": null, "sourceUrl": "https://kubernetes.io/blog/2025/03/24/ingress-nginx-cve-2025-1974/", "url": "https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974" }, { "incident": "oracle-cloud-classic-login-breach-march-2025", "incidentTitle": "Oracle Cloud login servers breached: ~6M SSO/LDAP records offered for sale", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-03-21", "title": "rose87168 claims theft of ~6M records; Oracle denies an Oracle Cloud breach", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/oracle-says-obsolete-servers-hacked-denies-cloud-breach/", "url": "https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025" }, { "incident": "cyberpersons-cyberpanel-cve-2024-51567-51378", "incidentTitle": "CyberPersons CyberPanel: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-04", "title": "CISA added CVE-2024-51378 to the KEV catalog (federal deadline 2024-12-25)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378" }, { "incident": "cyberpersons-cyberpanel-cve-2024-51567-51378", "incidentTitle": "CyberPersons CyberPanel: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-07", "title": "CISA added CVE-2024-51567 to the KEV catalog (federal deadline 2024-11-28)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378" }, { "incident": "cyberpersons-cyberpanel-cve-2024-51567-51378", "incidentTitle": "CyberPersons CyberPanel: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-29", "title": "CVE-2024-51567 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-51567", "url": "https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378" }, { "incident": "cyberpersons-cyberpanel-cve-2024-51567-51378", "incidentTitle": "CyberPersons CyberPanel: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-29", "title": "CVE-2024-51378 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-51378", "url": "https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378" }, { "incident": "hugging-face-spaces-secrets-leak", "incidentTitle": "Hugging Face Spaces secrets accessed without authorization", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-05-31", "title": "Hugging Face discloses unauthorized access to Spaces secrets and revokes tokens", "body": null, "sourceUrl": "https://huggingface.co/blog/space-secrets-disclosure", "url": "https://pwn.watch/i/hugging-face-spaces-secrets-leak" }, { "incident": "cwp-control-web-panel-cve-2022-44877", "incidentTitle": "CWP Control Web Panel: OS Command Injection (CVE-2022-44877)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-01-17", "title": "CISA added CVE-2022-44877 to the KEV catalog (due 2023-02-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cwp-control-web-panel-cve-2022-44877" } ] }