Northflank security incident: PaaS tells users to assume all environment variables were decrypted

Teaser from the source

Northflank, a platform-as-a-service for deploying apps and databases, declared a security incident with a major outage across 7 platform components on Oct 30 2026. Its status page says a Wiz threat alert fired at 11:43 UTC, engineers reviewed it a minute later, and Northflank deployed an initial network policy patch at 12:02 UTC with more patches at 12:50 and 13:05 UTC, then requested Wiz CIRT support at 13:00 UTC. At 13:40 UTC it told users to rotate environment variables immediately, and at 13:58 UTC it said to "assume all environment variables have been decrypted" and to disable or rotate all keys. At 15:12 UTC it added that multiple users are confirming their AI keys have been used, and that secrets on workloads, secret groups and global secrets are all covered. On Oct 31 it extended secret rotation to MySQL, Redis, MinIO and RabbitMQ add-ons. Northflank has not yet said how the attacker got in or how many customers are affected.

This is the RSS-feed teaser. Read the full article at the original source.