# Cloud & hosting security incidents · pwn.watch

> Security incidents affecting PaaS, managed databases and hosting control panels.

Page: https://pwn.watch/t/hosting · generated 2026-10-22T16:23:59.585Z

## Status (as of 2026-10-22)
- Incidents: 12 (4 live, 4 live and not fully patched, 8 patched)
- Days without a Cloud & hosting security incident: 0 (4 still unpatched, so the counter stays at 0)
- Newest incident started: 2026-10-21

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/hosting.json
- RSS (every update): https://pwn.watch/t/hosting/feed.xml
- This file: https://pwn.watch/t/hosting/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [Railway discloses unauthorized access to customer environment variables](https://pwn.watch/i/railway-env-var-security-disclosure) ([json](https://pwn.watch/i/railway-env-var-security-disclosure.json)): high, live, partial, started 2026-10-21
- [OVHcloud CLI releases backdoored on GitHub](https://pwn.watch/i/ovhcloud-cli-github-infostealer) ([json](https://pwn.watch/i/ovhcloud-cli-github-infostealer.json)): critical, closed, patched, started 2026-10-19
- [Zeabur breach exposes 3.2M env-var records; company to shut down](https://pwn.watch/i/zeabur-october-2026-breach-shutdown) ([json](https://pwn.watch/i/zeabur-october-2026-breach-shutdown.json)): critical, live, partial, started 2026-10-14
- [GoDaddy mass-revokes 404,607 TLS certificates over CP/CPS profile mismatch](https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026) ([json](https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026.json)): medium, live, partial, started 2026-10-14
- [PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken](https://pwn.watch/i/pingcap-tidb-cloud-breach) ([json](https://pwn.watch/i/pingcap-tidb-cloud-breach.json)): high, live, partial, started 2026-09-09
- [WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability](https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940) ([json](https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940.json)): high, closed, patched, started 2026-04-30, CVE-2026-41940
- [CWP Control Web Panel: Control Web Panel OS Command Injection Vulnerability](https://pwn.watch/i/cwp-control-web-panel-cve-2025-48703) ([json](https://pwn.watch/i/cwp-control-web-panel-cve-2025-48703.json)): critical, closed, patched, started 2025-11-04, CVE-2025-48703
- [IngressNightmare: unauthenticated RCE in Kubernetes ingress-nginx admission controller (CVE-2025-1974)](https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974) ([json](https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974.json)): critical, closed, patched, started 2025-03-24, CVE-2025-1974
- [Oracle Cloud login servers breached: ~6M SSO/LDAP records offered for sale](https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025) ([json](https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025.json)): high, closed, no-fix-needed, started 2025-03-21
- [CyberPersons CyberPanel: 2 actively exploited vulnerabilities](https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378) ([json](https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378.json)): critical, closed, patched, started 2024-10-29, CVE-2024-51567, CVE-2024-51378
- [Hugging Face Spaces secrets accessed without authorization](https://pwn.watch/i/hugging-face-spaces-secrets-leak) ([json](https://pwn.watch/i/hugging-face-spaces-secrets-leak.json)): high, closed, no-fix-needed, started 2024-05-31
- [CWP Control Web Panel: OS Command Injection (CVE-2022-44877)](https://pwn.watch/i/cwp-control-web-panel-cve-2022-44877) ([json](https://pwn.watch/i/cwp-control-web-panel-cve-2022-44877.json)): critical, closed, patched, started 2023-01-17, CVE-2022-44877