Security
Breaches, attacks and emergency patches, quoted from each provider's status page.
Days without a breach
Days since the last breach anywhere was resolved.Breaches, 12 mo
Someone got in or secrets got out: unauthorized access, leaked credentials, keys to rotate. Adds 600 points.Attacks, 12 mo
DDoS, abuse or malicious traffic that hurt the service. Graded by impact like any outage.Patches, 12 mo
Downtime from fixing a vulnerability: emergency reboots, CVE mitigations. Graded by impact.Oct 20268 incidents
Oct 30BREACHSEV 2Northflank · Security incidentNorthflank detected a threat alert and found attackers may have decrypted customer environment variables. Users were told to rotate all secrets and disable public addon access. Users reported unauthorized use of AI API keys stored on the platform. Secret rotation was enabled for Postgres and MongoDB, and audit logs were enabled for all customers. Investigation is ongoing and the incident remains open.Hosting · sourceopen 17h 10m
Oct 26BREACH · FOLLOW-UPSEV 4Railway · Railway Recovery after October 21 IncidentFollow-up to the October 21 security incident. Railway says it is still recovering systems and forensic work continues. New signups remain paused with no reopening date, and updates are posted daily. The text does not say existing customer services are back to normal.Hosting · sourceopen 4d 11h
Oct 24BREACH · FOLLOW-UPSEV 4Railway · Clarification: Recent Oct 24 API key revocations are precautionaryRailway clarified that AI providers revoked some replacement API keys created after the October 21 incident. The revocations were precautionary, caused by Railway giving providers a batch that included newer keys. Affected customers must create new keys, update Railway variables, and redeploy. Railway says it is not under a new attack and that existing working keys need no further rotation.Hosting · source16h 33m
Oct 24PATCHNOT COUNTEDCloudinary · Notice regarding recently-reported Ruby regular expression vulnerabilities (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264)Cloudinary notice on Ruby regular expression vulnerabilities (four CVEs) fixed upstream October 23, 2026. Cloudinary upgraded its own platform the same day, found no exploitation or customer impact, and says no action is needed for Cloudinary. Customers using Ruby in their own apps should update to a patched release.Dev APIs · source0m
Oct 21PATCHNOT COUNTEDCloudinary · Notice regarding recently-reported PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619Dev APIs · source0m
Oct 21BREACHSEV 2Railway · Railway Platform OutageA security incident halted builds for all Railway plans from October 21. Builds were restored in stages to all plans by October 22, with slow builds and US West deployment failures meanwhile. Customers with exposed credentials were notified; rotation advised. Signups remain paused and the community site is still down.Hosting · source2d 14h
Oct 16PATCHSEV 2Fly.io · Platform Wide Rolling Host RebootsFly.io rebooted hosts fleet-wide as a mitigation for a Linux kernel vulnerability (CVE-2026-99999). Each host was down 15-20 minutes, so Machines, volumes and MPG clusters went offline in rolling phases over about 19 hours. MPG saw elevated primary-standby switchovers. A small number of hosts stayed degraded afterward.Hosting · source12h 53m
Oct 1ATTACKSEV 2Ably · Elevated API ErrorsA DDoS attack caused elevated token-request errors with 503 responses in all Ably Realtime regions for about six minutes on October 1, 2026. Ably restored service by adding capacity and deployed traffic-blocking and rate-limiting rules. ably.com was also intermittently unavailable.Dev APIs · postmortem · source27m
Aug 20262 incidents
Aug 17ATTACKSEV 1Stytch · Emails not being deliveredAbuse of free-tier email sending exhausted quota with the primary email provider. Failover to the secondary provider reported success but did not deliver mail. All outbound email, including magic links, OTPs and password resets, failed from 09:15 to 12:15 UTC on 17 August. Malicious accounts were banned and new safeguards added. Sender reputation may cause some legitimate mail to land in spam for a while.Dev APIs · postmortem · source3h 33m
Aug 11ATTACKSEV 2Mailgun · Click and Open Tracking Degraded (US Regions)A denial-of-service attack hit Mailgun's click and open tracking servers in US regions from about 05:32 to 07:07 UTC on 11 August 2026. Some tracking requests timed out or failed. A fix was implemented and the incident was resolved.Dev APIs · source1h 35m
Jul 20261 incident
Jul 21ATTACKSEV 2Northflank · Active DDoS Attack in US - CentralA DDoS attack hit public ingress into the Northflank cluster in the US-Central region, first from 11:09 to 11:41 UTC and again from 13:23 to 13:58 UTC on 21 July 2026. Internal traffic was not affected. Mitigations were applied and the attack stopped each time.Hosting · source32m
Jun 20261 incident
Jun 22OTHERSEV 2WorkOS · Degraded performance for Directory Provisioning for AuthkitA data migration unintentionally disabled AuthKit directory provisioning for existing customer directories from June 22 to June 25. User creations, attribute and role updates, and deactivations were delayed or missed. Affected directories were restored and missed changes backfilled. Some removed users may have kept organization access; no misuse was found. No directory events were lost.Dev APIs · postmortem · source2d 7h
May 20261 incident
May 10ATTACKSEV 2Northflank · Active DDoS Attack in Europe - West - NetherlandsHosting · source2h 02m
Mar 20262 incidents
Mar 25ATTACKSEV 2Northflank · Active DDoS Attack in Europe - West - NetherlandsHosting · source3h 21m
Mar 19ATTACKSEV 2Groq · openai/gpt-oss-120b Performance IssueThe openai/gpt-oss-120b model suffered degraded performance from coordinated malicious traffic starting 12:51 UTC on 2026-03-19. Groq blocked the source orgs, cancelled their billing plans and restricted their verification. The model was restored and resolved by 13:50 UTC.AI APIs · source59m