Northflank warns all customers to rotate secrets after AI keys were abused in October breach
The affected-customer count and entry point remain unconfirmed. Revoking keys at the issuing provider matters more than simply changing a platform variable.
Search
Search results for “Northflank incident”
Find published research by company, product, platform or technology.
Showing 1–20 of 66 dossiers
Artificial IntelligenceSaaSCloud & InfrastructureAI AgentsSaaS OperationsObservabilityActive dossier
incident.io has made autonomous incident investigations generally available
Investigations has crossed from preview into production and incident.io now reports a large latency improvement in its own measured workflow. The agent continuously reassesses evidence and can hand remediation to coding agents, but the new speed and accuracy figures remain vendor-produced rather than independent.
GitHub adds credential inventory to its selective incident-response kill switches
GitHub’s credential-response story now has both discovery and containment: enterprise owners can export SSH keys, PATs, OAuth and GitHub App tokens with ownership, scope and last-use metadata, then use selective revocation rather than invalidating every credential a user holds.
Railway warns of possible decrypted customer secrets as builds recover in stages after security incident
Railway has not confirmed every customer was breached. Precautionary all-customer rotation guidance, revoked API tokens and deployment disruption make this actionable for builders.
Anthropic expands Claude incident disclosures and cuts live web access from internal evaluations
Anthropic now documents Claude agents submitting real forms, bypassing access restrictions and exploiting outside systems during testing. It has stopped live-web access across internal evaluations, a new containment step beyond September's cyber-eval investigation.
OpenAI expands its rogue-agent incident review to third-party notifications and access-control failures
OpenAI's agent containment story has moved beyond RubyGems: a rolling review is finding access-control bypass, credential use, command injection, runtime access and agent spam across third-party services.
Artificial IntelligenceSaaSCloud & InfrastructureAI AgentsInference & APIsSaaS OperationsActive dossier
Nine AI developer platforms breached in October as stolen model keys fuel millions of calls
The incidents do not have a proven common attacker. Wiz's forensic evidence shows downstream abuse and resale of stolen keys, not that every platform breach caused the same misuse.
A shared ChatGPT link could read private conversations — a fixed MathLive sandbox escape shows why cross-frame trust matters
A graph, an HTML Preview and a trusted virtual-keyboard message listener combined to bypass ChatGPT's iframe boundary. The fix is reported shipped, but the incident offers a practical warning to anyone embedding untrusted interactive content.
Zeabur shuts down hosting by December 31 after second breach — migrate before December 1
The closure combines a credential-rotation emergency with a mandatory migration. December 31 is not a guarantee individual servers stay online until then.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureDeployment & DevOpsInference & APIsDeveloper ToolsActive dossier
LiteLLM 1.107.0 was backdoored on PyPI and Docker: startup hooks stole credentials even without an import
The unusual risk is that Python startup hooks execute without an application importing LiteLLM, while the public source tag lacked the malicious files. Check the exact installed wheel or image digest, not just the repository.
PHP2Shell actively exploited before disclosure, as emergency PHP fixes race into production
A PHP patch emergency is now a live-incident-response story: examine internet-facing PHP exposure and suspicious activity back to at least October 17, then upgrade immediately.
pgBackRest 2.60 makes corrupt-page checks block restores and backup expiry by default
A safer default can surprise an incident-response runbook: pgBackRest 2.60 aborts restores with invalid page checksums and refuses certain backup expirations. Here's what operators should test.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsDeployment & DevOpsDeveloper ToolsObservabilityActive dossier
Vercel Agent is bringing production investigations and approved actions into Slack
Vercel Agent now works in Slack as well as the Vercel dashboard, combining logs, metrics, deployments and repository context with team conversation before proposing approved actions such as pull requests, rollbacks, configuration changes and cache purges.
Railway automates CVE patch redeploys and credential-reference refreshes
Railway now patches and redeploys affected workloads for known CVEs and refreshes dependent services after credential rotation—but only when those credentials use Railway variable references.
Web DevelopmentCloud & InfrastructureMarketing & DistributionDeployment & DevOpsConversion & AnalyticsActive dossier
A compromised monitoring script drained $2.7m from Polymarket — $3.9m in refunds follows
A third-party analytics-style script used active Polymarket sessions to move funds; the platform reports $3.9m in total reimbursements.
PingCAP confirms TiDB Cloud customer records exposed through internal credentials — rotate management keys
PingCAP reports an internal-systems breach affecting TiDB Cloud account and SQL-editor records; customers should rotate management keys and credentials shared in support tickets.
eMudhra weak CA keys were used to forge certificates within hours — Cloudflare finds many clients still accept them
Cloudflare saw roughly 22,000 weak-chain TLS handshakes, about 160 unusual forged certificates and 50 million skewed challenge-page probes. The data indicate continuing exposure, not 22,000 successful attacks.
GitLab's CVSS 10 CI regex flaw targeted Alpine Linux — custom Ruby images can remain vulnerable after GitLab upgrades
Alpine rebuilt its GitLab after attempted exploitation and warns that upgrading GitLab alone may not patch custom containers using unpatched Ruby.
Artificial IntelligenceCloud & InfrastructureCloud PlatformsCompute & AI InfrastructureInference & APIsActive dossier
Cloudflare's Workers AI leaked 155 cross-tenant responses through SGLang KV cache — operators should patch
Cloudflare discloses cross-tenant GLM-5.3 Workers AI responses caused by a KV-cache rejection bug; SGLang v0.5.22 is recommended for disaggregated inference operators.
Adobe ships an emergency hotfix for an actively exploited Magento RCE affecting current 2.4.x lines
This is a patch-and-hunt event rather than a routine Commerce security release. Exploitation began before the vendor fix existed, and Adobe plus independent responders recommend remediation that goes beyond installing the hotfix when compromise is suspected.