Security incidents.

Security incidents that the companies on the wall have themselves disclosed since January 2024, with the cause each one gave. Every entry links to the company's own statement.

Checked against each company's statement on Nov 10, 2026

Disclosed incidents

By quarter of disclosure, since January 2024

Peak 10 · Q3 2025

  • Total: 37
  • Q1 2024: 1
  • Q2 2024: 3
  • Q3 2024: 4
  • Q4 2024: 0
  • Q1 2025: 0
  • Q2 2025: 2
  • Q3 2025: 10
  • Q4 2025: 7
  • Q1 2026: 0
  • Q2 2026: 9
  • Q3 2026: 1
  • Q4 2026: 0
Disclosed incidents
37
Since January 2024
With a stated cause
34
As given by the company
Companies
32
With at least one entry
Status-page advisories
60
The most recent, shown below

2026

10 disclosed incidents

  1. Hugging Face

    Disclosed Jul 16, 2026

    Intrusion into part of Hugging Face's production infrastructure

    Hugging Face disclosed that an intrusion it said was carried out by an autonomous AI agent system reached a small number of internal datasets and some credentials used by its services, and spread to several internal clusters. It said public models, datasets and Spaces showed no signs of being altered and that it was still assessing whether customer or partner data was affected.

    Root cause, as stated by Hugging Face

    Hugging Face said the attacker uploaded a malicious dataset that exploited two flaws in its dataset processing pipeline, a remote-code loader and a template injection, to execute code on a worker, then gathered credentials from there.

    Read the official disclosure (opens in a new tab)

  2. LastPass

    Disclosed Jun 22, 2026

    LastPass Salesforce customer data accessed through Klue

    LastPass said an intruder took OAuth tokens that vendor Klue held for its customers and used them to access LastPass data in Salesforce, including business contact details and related CRM, support case and sales data. LastPass said its products, infrastructure and customer vaults were not affected.

    Root cause, as stated by LastPass

    LastPass attributed the access to the theft of OAuth tokens during the incident at Klue.

    Read the official disclosure (opens in a new tab)

  3. Gong

    Disclosed Jun 19, 2026

    Gong user data accessed through Klue integration

    Gong said an intrusion at third-party integrator Klue may have exposed internal user data, such as user names, job titles and email addresses, for some customers who had connected Klue to Gong. Gong said it had identified no direct effect on customers' call recordings or transcripts and had blocked Klue's API access.

    Root cause, as stated by Gong

    Gong said the incident began at Klue, whose integration service was accessed by an unauthorized actor, and that Gong's own products and systems were not directly breached.

    Read the official disclosure (opens in a new tab)

  4. HackerOne

    Disclosed Jun 19, 2026

    HackerOne CRM data copied through Klue integration

    HackerOne said an unauthorized party used Klue's OAuth integration to copy CRM data from its Salesforce instance; the data potentially affected covers business contact details and sales account and opportunity records. It said its policies bar customer vulnerability data from the CRM, that a preliminary investigation found no sign such data was accessed, and that its products and infrastructure were unaffected.

    Root cause, as stated by HackerOne

    HackerOne described it as a supply-chain incident caused by the breach of its vendor Klue.

    Read the official disclosure (opens in a new tab)

  5. Snyk

    Disclosed Jun 19, 2026

    Snyk Salesforce data accessed through Klue integration

    Snyk reported that an unauthorized party accessed data in its Salesforce environment through the Klue integration. It said the impact was limited to business CRM data, including customer business contact information and the titles and descriptions of a subset of support cases, and that its products and platform were not affected.

    Root cause, as stated by Snyk

    Snyk attributed the access to a security incident at its vendor Klue.

    Read the official disclosure (opens in a new tab)

  6. Jamf

    Disclosed Jun 18, 2026

    Jamf Salesforce data accessed through Klue integration

    Jamf reported that an unauthorized party accessed data in its Salesforce instance on 11 June 2026 through the integration of Klue, a competitive intelligence vendor. Jamf said the activity was limited to Salesforce data, that investigators found no evidence of lateral movement, and that its products were not affected.

    Root cause, as stated by Jamf

    Jamf said the incident originated in a breach of its vendor Klue, whose integration credentials were used.

    Read the official disclosure (opens in a new tab)

  7. GitHub

    Disclosed May 20, 2026

    Exfiltration of GitHub-internal repositories via poisoned VS Code extension

    GitHub said it found and shut down a breach of one employee's device on 18 May 2026 and that, on its current assessment, only GitHub-internal repositories were taken. It said the attacker's claim of about 3,800 repositories was broadly in line with its findings so far. It reported no evidence of impact to customer data held outside those internal repositories, some of which contain items such as support excerpts.

    Root cause, as stated by GitHub

    GitHub said the employee device was compromised through a malicious third-party VS Code extension; a full report was promised once the investigation completes.

    Read the official disclosure (opens in a new tab)

  8. Grafana Cloud

    Disclosed May 16, 2026

    Grafana Labs codebase downloaded from GitHub and ransom demanded

    Grafana Labs confirmed that a cybercrime group used a stolen token to access its GitHub repositories, download source code and internal repositories containing business contact names and emails, and demand a ransom, which Grafana refused. Grafana said there was no evidence that Grafana Cloud or customer production systems were compromised.

    Root cause, as stated by Grafana Cloud

    Grafana said a token exposed in the TanStack npm supply-chain attack was missed during rotation and was used to access its repositories.

    Read the official disclosure (opens in a new tab)

  9. Mistral AI

    Disclosed May 12, 2026

    Malicious Mistral SDK packages published in TanStack supply-chain attack

    Mistral AI reported that tainted versions of its npm and PyPI SDK packages were published by an automated worm on 11 and 12 May 2026 and removed within hours. It said the PyPI release ran credential-harvesting code when imported on Linux, while the npm packages' malicious code could not run. Mistral said its infrastructure was not affected.

    Root cause, as stated by Mistral AI

    Mistral said the attack stemmed from the compromise of the third-party TanStack packages and involved an affected developer device.

    Read the official disclosure (opens in a new tab)

  10. Vercel

    Disclosed Apr 19, 2026

    Unauthorized access to internal Vercel systems

    Vercel disclosed that an attacker gained access to certain internal systems and was able to enumerate and decrypt environment variables not marked as sensitive for a limited set of customers. The attacker had taken over an employee's Google Workspace and Vercel accounts.

    Root cause, as stated by Vercel

    Vercel said the incident started at Context.ai, an outside AI tool one of its employees used, whose Google Workspace OAuth app had been compromised more broadly.

    Read the official disclosure (opens in a new tab)

2025

19 disclosed incidents

  1. Mixpanel

    Disclosed Nov 27, 2025

    Mixpanel smishing incident affecting customer accounts

    Mixpanel said it detected an SMS-phishing (smishing) campaign on 8 November 2025 and described a security incident that impacted a limited number of its customers. It said it contained the unauthorized access, secured the affected accounts and reviewed authentication, session and export logs.

    Root cause, as stated by Mixpanel

    Mixpanel said the incident followed a smishing (SMS phishing) campaign it detected; its post does not give further detail on how access was obtained.

    Read the official disclosure (opens in a new tab)

  2. PostHog

    Disclosed Nov 26, 2025

    PostHog JavaScript SDK packages compromised by Shai-Hulud 2.0

    PostHog reported that malicious versions of several of its JavaScript SDK packages were published to npm on 24 November 2025 after an attacker stole a bot's GitHub token and used it to reach CI secrets including an npm publishing token.

    Root cause, as stated by PostHog

    PostHog said a workflow change that ran code from external pull requests in a trusted CI context let the attacker execute arbitrary code and steal the token.

    Read the official disclosure (opens in a new tab)

  3. Trigger.dev

    Disclosed Nov 25, 2025

    Trigger.dev GitHub organization accessed after Shai-Hulud 2.0 infection

    Trigger.dev reported that credentials stolen from an engineer's machine were used on 24 and 25 November 2025 to clone 669 repositories, force-push 199 branches across 16 repositories and close 42 pull requests. It said its npm packages were not compromised and that production databases and AWS resources were not accessed.

    Root cause, as stated by Trigger.dev

    Trigger.dev said an engineer installed a package compromised by the Shai-Hulud 2.0 worm on a development machine, which led to credential theft.

    Read the official disclosure (opens in a new tab)

  4. Gainsight

    Disclosed Nov 25, 2025

    Compromised tokens for Gainsight's Salesforce connected app

    Gainsight said Salesforce detected unusual activity involving the Gainsight connected application and temporarily disabled Gainsight's integrations as a precaution while investigating. Gainsight said Salesforce had identified compromised customer tokens, that it knew at the time of only a handful of customers whose data was affected, and that Salesforce had notified them.

    Gainsight did not state a cause.

    Read the official disclosure (opens in a new tab)

  5. Postman

    Disclosed Nov 24, 2025

    Postman npm packages infected by Shai-Hulud 2.0

    Postman reported unusual activity in its npm organization tied to the Shai-Hulud 2.0 supply-chain attack, with 17 public packages (51 versions) infected and subsequently unpublished. Postman said its investigation had so far found that its app and production cloud services were not compromised.

    Postman did not state a cause.

    Read the official disclosure (opens in a new tab)

  6. RubyGems

    Disclosed Oct 9, 2025

    Unauthorized root access to RubyGems.org AWS account

    Ruby Central reported that an unauthorized actor changed the root password of the RubyGems.org AWS account on 19 September 2025 and accessed it repeatedly until control was regained on 30 September. Ruby Central said it found no evidence that user data, gems or service availability were compromised.

    Root cause, as stated by RubyGems

    Ruby Central said the AWS root password and MFA were not rotated after people with access to the shared credential vault left, and that copies of the credential could exist outside its control.

    Read the official disclosure (opens in a new tab)

  7. Discord

    Disclosed Oct 3, 2025

    Discord support data exposed through third-party customer service provider

    Discord said an unauthorized party compromised a third-party customer service provider and gained access to information from a limited number of users who had contacted support or Trust & Safety. It said the data may include contact details, limited billing information, IP addresses and support messages, and that about 70,000 users may have had government ID photos exposed. Discord said passwords and full card numbers were not involved.

    Root cause, as stated by Discord

    Discord said the attacker compromised its third-party customer service provider, 5CA, in an attempt to extort the company.

    Read the official disclosure (opens in a new tab)

  8. npm

    Disclosed Sep 22, 2025

    Shai-Hulud self-replicating worm on the npm registry

    GitHub described a self-replicating worm, reported to it on 14 September 2025, that spread through npm by taking over maintainer accounts and adding malicious post-install scripts to popular packages. GitHub removed more than 500 compromised packages and blocked uploads matching the malware's indicators.

    Root cause, as stated by npm

    GitHub said the worm got into npm through compromised maintainer accounts and was able to steal several kinds of secrets, including npm tokens.

    Read the official disclosure (opens in a new tab)

  9. PyPI

    Disclosed Sep 16, 2025

    PyPI publishing tokens exfiltrated through GitHub Actions workflows

    PyPI reported that an attacker modified GitHub Actions workflows in many repositories to steal PyPI publishing tokens stored as secrets, and some tokens were exfiltrated. PyPI invalidated the affected tokens and said they did not appear to have been used to publish anything.

    Root cause, as stated by PyPI

    PyPI said the tokens were long-lived secrets stored in GitHub repositories whose workflows were altered to send them to external servers; PyPI itself was not compromised.

    Read the official disclosure (opens in a new tab)

  10. Dynatrace

    Disclosed Sep 8, 2025

    Dynatrace CRM contact data potentially affected via Salesloft Drift

    Dynatrace said it was among the companies affected by the August 2025 attack on Salesloft's Drift application, with the activity confined to its Salesforce CRM. It said the potentially affected data was limited to business contact information such as customer contact names and company identifiers, and that no products or services were affected.

    Root cause, as stated by Dynatrace

    Dynatrace attributed the exposure to the attack on the third-party Drift application.

    Read the official disclosure (opens in a new tab)

  11. Qualys

    Disclosed Sep 6, 2025

    Qualys Salesforce data accessed via Salesloft Drift

    Qualys said OAuth tokens stolen in the Salesloft Drift campaign gave limited access to some information in its Salesforce environment. It reported that its production environments, its source code, and the customer data held in its cloud platform, agents and scanners were not impacted.

    Root cause, as stated by Qualys

    Qualys attributed the access to stolen OAuth tokens associated with the Salesloft Drift integration.

    Read the official disclosure (opens in a new tab)

  12. Tenable

    Disclosed Sep 3, 2025

    Tenable Salesforce data accessed via Salesloft Drift

    Tenable said an unauthorized user accessed part of the customer information in its Salesforce instance, including support case subject lines and initial descriptions and business contact details. Tenable said its products were not affected and it had no evidence of misuse.

    Root cause, as stated by Tenable

    Tenable linked the access to the data-theft campaign exploiting the Salesloft Drift integration with Salesforce.

    Read the official disclosure (opens in a new tab)

  13. Cloudflare

    Disclosed Sep 2, 2025

    Cloudflare Salesforce case data taken via Salesloft Drift

    Cloudflare reported that an attacker accessed its Salesforce tenant between 12 and 17 August 2025 and exfiltrated the text of customer support cases, including contact details. Cloudflare found 104 of its API tokens in that data and rotated them, with no suspicious use observed.

    Root cause, as stated by Cloudflare

    Cloudflare said the attacker used OAuth credentials for the Salesloft Drift chat integration that had been stolen in a breach of Salesloft.

    Read the official disclosure (opens in a new tab)

  14. Palo Alto Networks

    Disclosed Sep 2, 2025

    Palo Alto Networks CRM data exposed via Salesloft Drift

    Palo Alto Networks confirmed it was among the organizations whose Salesforce data was accessed through the compromised Salesloft Drift application. It said the exposed data was mostly business contact information, internal sales account data and basic case data, and that its products and services were not affected.

    Root cause, as stated by Palo Alto Networks

    The company attributed the exposure to the breach of the third-party Salesloft Drift application.

    Read the official disclosure (opens in a new tab)

  15. HackerOne

    Disclosed Aug 28, 2025

    HackerOne Salesforce records accessed via Salesloft Drift

    HackerOne said records in a subset of its Salesforce instance were accessed on 13 and 18 August 2025 through the Drift application from Salesloft. It reported that customer vulnerability data was not believed to be exposed and found no lateral movement.

    Root cause, as stated by HackerOne

    HackerOne attributed the access to a compromise of the third-party Drift application connected to its Salesforce instance.

    Read the official disclosure (opens in a new tab)

  16. PyPI

    Disclosed Jul 31, 2025

    Phishing campaign compromising PyPI user accounts

    PyPI reported that a phishing campaign using a lookalike domain captured the credentials of four user accounts and that attackers created two API tokens and uploaded two malicious releases of one project, which were removed within hours. PyPI said its own infrastructure was not breached.

    Root cause, as stated by PyPI

    PyPI said users were deceived by emails linking to a near-identical domain that proxied the real site and captured their logins.

    Read the official disclosure (opens in a new tab)

  17. Amazon Web Services

    Disclosed Jul 23, 2025

    Malicious code committed to Amazon Q Developer VS Code extension

    AWS reported that a threat actor pushed malicious code into the open-source repository of the Amazon Q Developer extension for VS Code, and it shipped in version 1.84.0. AWS said the code did not execute because of a syntax error, removed the release and asked users to update to 1.85.0.

    Root cause, as stated by Amazon Web Services

    AWS said an inappropriately scoped GitHub token in the extension's CodeBuild configuration was used to make the commit.

    Read the official disclosure (opens in a new tab)

  18. Coinbase

    Disclosed May 15, 2025

    Insider-enabled theft of Coinbase customer data and extortion attempt

    Coinbase disclosed in an SEC Form 8-K that a threat actor demanded payment after obtaining customer names, contact details, partially masked Social Security and bank account numbers, government ID images, account data and some internal documents. Coinbase said passwords and private keys were not compromised and the insiders could not reach customer funds, and gave a preliminary cost estimate of about $180 million to $400 million.

    Root cause, as stated by Coinbase

    Coinbase said the actor appeared to have paid multiple contractors or employees in support roles outside the United States to pull the information from internal systems they could access for their jobs.

    Read the SEC filing (opens in a new tab)

  19. Grafana Cloud

    Disclosed Apr 28, 2025

    GitHub workflow token exposure at Grafana Labs

    Grafana Labs reported that an attacker abused a GitHub Actions workflow in one of its repositories to extract a limited number of tokens and used one against four private repositories, triggering a canary token alert on 26 April 2025. Grafana said access was limited to automation systems and that, with its investigation still ongoing, it had found no evidence of code changes, production access or customer data exposure.

    Root cause, as stated by Grafana Cloud

    Grafana said the cause was a GitHub Action it had turned on shortly beforehand, which let an outsider obtain a limited number of tokens.

    Read the official disclosure (opens in a new tab)

2024

8 disclosed incidents

  1. KnowBe4

    Disclosed Jul 23, 2024

    Fake North Korean IT worker hired and loaded malware

    KnowBe4 disclosed that a remote software engineer it hired turned out to be a North Korean operative using a stolen US identity, who began loading malware onto a company-issued Mac as soon as it arrived. The company's security team detected and contained the device on 15 July 2024 and said no data was lost or exfiltrated.

    Root cause, as stated by KnowBe4

    KnowBe4 said its hiring and background-check process failed to detect the stolen identity.

    Read the official disclosure (opens in a new tab)

  2. Squarespace

    Disclosed Jul 9, 2024

    Hijacking of Squarespace Domains customer accounts

    Squarespace reported that a limited number of Domains customer accounts were compromised, resulting in unauthorized changes to domain settings and DNS records. Squarespace said the targeted domains were cryptocurrency-related domains and businesses, and that it suspended affected accounts while it investigated.

    Root cause, as stated by Squarespace

    Squarespace's postmortem said its analysis found a weakness related to OAuth logins, which it fixed on 12 July 2024, and that all compromised accounts used third-party OAuth.

    Read the official disclosure (opens in a new tab)

  3. Twilio

    Disclosed Jul 1, 2024

    Authy phone numbers exposed through unauthenticated endpoint

    Twilio said attackers had been able to work out information tied to Authy accounts, phone numbers among them. Twilio said it had seen no evidence that its systems were breached or that other sensitive internal data was reached, said Authy accounts themselves were not compromised, and asked users to update the Authy apps.

    Root cause, as stated by Twilio

    Twilio attributed the exposure to an unauthenticated endpoint, which it has since secured.

    Read the official disclosure (opens in a new tab)

  4. Affirm

    Disclosed Jul 1, 2024

    Affirm Card holder data exposed in Evolve Bank & Trust breach

    Affirm reported in an SEC filing that Evolve Bank & Trust, the outside bank that issues the Affirm Card, told it on 25 June 2024 that a third party had gained unauthorized access to personal and financial information of Evolve's customers and of its fintech partners' customers. Affirm said it believed its card users' personal information was compromised, while its own systems were not.

    Root cause, as stated by Affirm

    Affirm stated the incident occurred at its card-issuing partner Evolve; the filing does not describe how Evolve was breached.

    Read the SEC filing (opens in a new tab)

  5. TeamViewer

    Disclosed Jun 27, 2024

    Compromise of TeamViewer corporate IT environment

    TeamViewer reported an intrusion into its internal corporate IT environment detected on 26 June 2024, in which employee directory data including names, corporate contact details and encrypted employee passwords was copied. The company said its product environment, connectivity platform and customer data were not affected.

    Root cause, as stated by TeamViewer

    TeamViewer said the attacker used the credentials of a standard employee account and attributed the activity to the group known as APT29 / Midnight Blizzard.

    Read the official disclosure (opens in a new tab)

  6. Hugging Face

    Disclosed May 31, 2024

    Unauthorized access to Hugging Face Spaces platform, secrets possibly exposed

    Hugging Face said it detected unauthorized access to its Spaces platform and suspected that a subset of Spaces secrets had been accessed. It revoked a number of tokens stored in those secrets and emailed affected users.

    Hugging Face did not state a cause.

    Read the official disclosure (opens in a new tab)

  7. Dropbox Sign

    Disclosed May 1, 2024

    Unauthorized access to Dropbox Sign production environment

    Dropbox disclosed that an attacker reached the Dropbox Sign (formerly HelloSign) production environment and customer database, exposing emails, usernames and account settings for all users and, for some, phone numbers, hashed passwords, API keys, OAuth tokens and MFA data. Dropbox said it found no evidence that documents or payment information were accessed.

    Root cause, as stated by Dropbox Sign

    Dropbox said a third party gained access to a Sign automated configuration tool and compromised a back-end service account whose privileges were then used to reach the customer database.

    Read the official disclosure (opens in a new tab)SEC filing (opens in a new tab)

  8. Cloudflare

    Disclosed Feb 1, 2024

    Intrusion into Cloudflare's self-hosted Atlassian systems

    Cloudflare reported that a suspected nation-state actor accessed its internal Confluence wiki, Jira and source code management system in November 2023, viewing wiki pages and tickets and archiving 76 source code repositories, which Cloudflare said it could not confirm were taken but treated as stolen. Cloudflare said no customer data or systems were affected.

    Root cause, as stated by Cloudflare

    Cloudflare said it had not rotated one service token and three service account credentials that were exposed in the October 2023 Okta compromise, wrongly believing they were unused.

    Read the official disclosure (opens in a new tab)

Security advisories on status pages

Posts from the last two years whose own title mentions security. Most are advisories about third-party vulnerabilities, not breaches. Found by keyword, so the list can miss some.

  1. Kaseya · Google Brotli Vulnerability (CVE-2026-111497)

    Nov 10, 2026

    Notice (opens in a new tab)

  2. Hetzner · CVE-2026-97631 - critical security vulnerability in the EDK II UEFI firmware component

    Nov 10, 2026

    Notice (opens in a new tab)

  3. Linode (Akamai) · Customer Security Advisory: OpenSSH Password Authentication Bypass Vulnerability [CVE-2026-123158]

    Nov 5, 2026

    Notice (opens in a new tab)

  4. Contabo · Patching of internal systems (CVE-2026-98432)

    Nov 3, 2026

  5. Linode (Akamai) · Customer Security Advisory: CVE-2026-98432

    Oct 30, 2026

    Notice (opens in a new tab)

  6. Akamai · Customer Security Advisory: CVE-2026-98432

    Oct 30, 2026

    Notice (opens in a new tab)

  7. Upsun (Platform.sh) · [Scheduled] Security update for a system library (Dedicated)

    Oct 30, 2026

    Notice (opens in a new tab)

  8. Redpanda Cloud · CVE-2026-98432 Investigation

    Oct 29, 2026

  9. IONOS · WordPress security update 7.1.4: your websites are protected

    Oct 28, 2026

    Notice (opens in a new tab)

  10. Flywheel · Emergency WordPress Security Updates

    Oct 28, 2026

    Notice (opens in a new tab)

  11. Bunny.net · Security update regarding one of our infrastructure providers

    Oct 28, 2026

    Notice (opens in a new tab)

  12. Liquid Web · eMudhra Certificate Authority Security Issue

    Oct 27, 2026

    Notice (opens in a new tab)

  13. Cloudinary · Notice regarding recently-reported Ruby regular expression vulnerabilities (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264)

    Oct 24, 2026

    Notice (opens in a new tab)

  14. Gainsight · Industry-wide PHP and Node.js security update

    Oct 23, 2026

    Notice (opens in a new tab)

  15. DreamHost · PHP Security Vulnerability: Protections Are In Place

    Oct 23, 2026

    Notice (opens in a new tab)

  16. Pantheon · PHP Vulnerability CVE-2026-115560

    Oct 23, 2026

    Notice (opens in a new tab)

  17. Kinsta · Information in regards to newly discovered PHP vulnerability CVE-2026-115560 (Oct 23, 2026)

    Oct 23, 2026

    Notice (opens in a new tab)

  18. Contabo · PHP security advisory (CVE-2026-115560): mitigation recommended

    Oct 23, 2026

  19. Akamai · Customer Security Advisory: Brotli Remote Code Execution Vulnerabilities [CVE-2026-111497]

    Oct 23, 2026

    Notice (opens in a new tab)

  20. Notion · PHP2Shell (CVE-2026-109618, CVE-2026-109619)

    Oct 23, 2026

  21. Akamai · Customer Security Advisory: Critical F5/NGINX Out-of-Band Vulnerabilities

    Oct 22, 2026

    Notice (opens in a new tab)

  22. Linode (Akamai) · Customer Security Advisory: Critical F5/NGINX Out-of-Band Vulnerabilities

    Oct 22, 2026

    Notice (opens in a new tab)

  23. Astronomer · PHP Security Advisory: Astro and Astro Private Cloud Not Affected; Review Custom Images

    Oct 22, 2026

  24. Redpanda Cloud · CVE-2026-111943 (emudhra) Response

    Oct 22, 2026

  25. Chargebee · Subject: Security Notice: No Impact from PHPshell Zero-Day Vulnerability

    Oct 22, 2026

    Notice (opens in a new tab)

  26. Zapier · Security updates in progress for third-party software components

    Oct 22, 2026

  27. Scaleway · [Serverless Functions][fr-par/nl-ams/pl-waw] Security updates applied to PHP and Node.js runtimes

    Oct 22, 2026

    Notice (opens in a new tab)

  28. Everbridge · Security Bulletin: PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619

    Oct 22, 2026

    Notice (opens in a new tab)

  29. Railway · Deployment queue backlog after the October 21 security incident (record added Nov 5)

    Oct 22, 2026

    Notice (opens in a new tab)

  30. Railway · Builds restored in stages after the October 21 security incident (record added Nov 5)

    Oct 22, 2026

    Notice (opens in a new tab)

  31. HubSpot · Update on PHP security vulnerability

    Oct 22, 2026

    Notice (opens in a new tab)

  32. Astronomer · Security Update: Runtime Releases and Guidance for the eMudhra/emSign Certificate Issue

    Oct 22, 2026

  33. Kaseya · PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619): Kaseya status - Investigation and Remediation

    Oct 21, 2026

    Notice (opens in a new tab)

  34. Kinsta · PHP Security Vulnerability Update

    Oct 21, 2026

    Notice (opens in a new tab)

  35. Cloudinary · Notice regarding recently-reported PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

    Oct 21, 2026

    Notice (opens in a new tab)

  36. Liquid Web · PHP Security Vulnerability Assessment (CVE-2026-109618 & CVE-2026-109619)

    Oct 21, 2026

    Notice (opens in a new tab)

  37. Auvik · PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

    Oct 21, 2026

    Notice (opens in a new tab)

  38. Akamai · Customer Security Advisory: PHP Remote Code Execution Vulnerabilities

    Oct 21, 2026

    Read the RCA (opens in a new tab)

  39. Linode (Akamai) · Customer Security Advisory: PHP Remote Code Execution Vulnerabilities

    Oct 21, 2026

    Read the RCA (opens in a new tab)

  40. Flywheel · PHP Security Update

    Oct 21, 2026

    Notice (opens in a new tab)

  41. Jamf · Public disclosure of compromised intermediate certificate authority keys (eMudhra) affecting certificate trust across the internet

    Oct 21, 2026

    Notice (opens in a new tab)

  42. Pantheon · PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619

    Oct 21, 2026

    Notice (opens in a new tab)

  43. LiveAgent · PHP vulnerabilities CVE-2026-109618 / CVE-2026-109619 (PHP2Shell)

    Oct 21, 2026

    Notice (opens in a new tab)

  44. Namecheap · [RESOLVED] PHP Security Vulnerability affecting Hosting Services | October 21, 2026

    Oct 21, 2026

    Notice (opens in a new tab)

  45. Railway · API and dashboard errors during the October 21 security incident (record added Nov 5)

    Oct 21, 2026

    Notice (opens in a new tab)

  46. Railway · Builds unavailable during the October 21 security incident (record added Nov 5)

    Oct 21, 2026

    Notice (opens in a new tab)

  47. Railway · API and dashboard errors during the October 21 security incident (record added Nov 5)

    Oct 21, 2026

    Notice (opens in a new tab)

  48. Buildkite · Buildkite response to the eMudhra certificate compromise

    Oct 20, 2026

    Notice (opens in a new tab)

  49. Notion · Security update: Preventative certificate security measures

    Oct 20, 2026

  50. Liquid Web · Patch Deployment for CVE-2026-74580 Impacting Parent Servers

    Oct 20, 2026

    Notice (opens in a new tab)

  51. Linode (Akamai) · (PwnEscape) Guest-to-Host KVM Escape [CVE-2026-99999]

    Oct 15, 2026

    Notice (opens in a new tab)

  52. Pantheon · Drupal core critical security update (CVE-2026-108097)

    Oct 14, 2026

    Notice (opens in a new tab)

  53. WatchGuard · 2026-10-07 - EMEA - WatchGuard Endpoint Security issues

    Oct 7, 2026

    Notice (opens in a new tab)

  54. Pantheon · Security Advisory: Malicious Activity Affecting Platform Hosts

    Oct 1, 2026

    Notice (opens in a new tab)

  55. Kaseya · DattoRMM - Syrah/Vidal - Cagservice.exe is being flagged as malicious (Rapidstop) by Microsoft Defender for Endpoint.

    Sep 28, 2026

    Notice (opens in a new tab)

  56. Liquid Web · Security vulnerability CVE-2026-87898 on Plesk's Site Import extension

    Sep 26, 2026

    Notice (opens in a new tab)

  57. IONOS · Critical Security Update: WordPress Core Vulnerability (CVE-2026-87902)

    Sep 22, 2026

    Notice (opens in a new tab)

  58. Liquid Web · Security Advisory: Critical WordPress Vulnerability - "Click2Shell"

    Sep 22, 2026

    Notice (opens in a new tab)

  59. Brevo · Security Incident - ClickFix

    Sep 17, 2026

  60. Liquid Web · Acronis Plugin Security Advisory (SEC-10986) -cPanel/Plesk

    Sep 16, 2026

    Notice (opens in a new tab)

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

  • Company statements: each company's own blog post, trust-centre notice or status-page report about the incident, linked from its entry
  • SEC filings (opens in a new tab): public Form 8-K disclosures, where a company reported the incident to its regulator
  • Official status pages: the security advisories listed at the end of the page

How fresh it is

  • Disclosed incidents: added and summarised by hand; last checked against their sources on Nov 10, 2026
  • Status-page advisories: re-read from every status page about once an hour; last run 11 min ago

This is not a complete record. It includes only incidents a company acknowledged in its own statement or regulatory filing, and that we could confirm from that source. Summaries and root causes are written in our own words from the linked disclosure and may lag later updates; the linked statement is authoritative. Product vulnerabilities without a confirmed incident are listed under CVEs.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.