Security

Breaches, attacks and emergency patches, quoted from each provider's status page.

Days without a breachDays since the last breach anywhere was resolved.
0
Breaches, 12 moSomeone got in or secrets got out: unauthorized access, leaked credentials, keys to rotate. Adds 600 points.
2
Attacks, 12 moDDoS, abuse or malicious traffic that hurt the service. Graded by impact like any outage.
3
Patches, 12 moDowntime from fixing a vulnerability: emergency reboots, CVE mitigations. Graded by impact.
1
AllHostingAI APIsCloudDatabasesDev toolsDev APIs
Any 6Breach 2Attack 3Patch 1

Oct 20265 incidents

Oct 30BREACHSEV 2Northflank · Security incidentNorthflank detected a threat alert and found attackers may have decrypted customer environment variables. Users were told to rotate all secrets and disable public addon access. Users reported unauthorized use of AI API keys stored on the platform. Secret rotation was enabled for Postgres and MongoDB, and audit logs were enabled for all customers. Investigation is ongoing and the incident remains open.Hosting · sourceopen 17h 55m
Oct 26BREACH · FOLLOW-UPSEV 4Railway · Railway Recovery after October 21 IncidentFollow-up to the October 21 security incident. Railway says it is still recovering systems and forensic work continues. New signups remain paused with no reopening date, and updates are posted daily. The text does not say existing customer services are back to normal.Hosting · sourceopen 4d 12h
Oct 24BREACH · FOLLOW-UPSEV 4Railway · Clarification: Recent Oct 24 API key revocations are precautionaryRailway clarified that AI providers revoked some replacement API keys created after the October 21 incident. The revocations were precautionary, caused by Railway giving providers a batch that included newer keys. Affected customers must create new keys, update Railway variables, and redeploy. Railway says it is not under a new attack and that existing working keys need no further rotation.Hosting · source16h 33m
Oct 21BREACHSEV 2Railway · Railway Platform OutageA security incident halted builds for all Railway plans from October 21. Builds were restored in stages to all plans by October 22, with slow builds and US West deployment failures meanwhile. Customers with exposed credentials were notified; rotation advised. Signups remain paused and the community site is still down.Hosting · source2d 14h
Oct 16PATCHSEV 2Fly.io · Platform Wide Rolling Host RebootsFly.io rebooted hosts fleet-wide as a mitigation for a Linux kernel vulnerability (CVE-2026-99999). Each host was down 15-20 minutes, so Machines, volumes and MPG clusters went offline in rolling phases over about 19 hours. MPG saw elevated primary-standby switchovers. A small number of hosts stayed degraded afterward.Hosting · source12h 53m

Jul 20261 incident

Jul 21ATTACKSEV 2Northflank · Active DDoS Attack in US - CentralA DDoS attack hit public ingress into the Northflank cluster in the US-Central region, first from 11:09 to 11:41 UTC and again from 13:23 to 13:58 UTC on 21 July 2026. Internal traffic was not affected. Mitigations were applied and the attack stopped each time.Hosting · source32m

May 20261 incident

May 10ATTACKSEV 2Northflank · Active DDoS Attack in Europe - West - NetherlandsHosting · source2h 02m

Mar 20261 incident

Mar 25ATTACKSEV 2Northflank · Active DDoS Attack in Europe - West - NetherlandsHosting · source3h 21m