Researchers flag broader pattern of six major PaaS breaches in one month
2 Oct 30 1:39 PM · 12d ago · 1 post · 26 comments · 1 source · development 2 of 3
A Hacker News commenter documented a spike in attacks against multi-tenant SaaS vendors, identifying six substantial breaches since early September: PingCAP/TiDB, Fireworks AI, Zeabur, OpenCode Console, Railway, and now Northflank, characterising the situation as a full infosec emergency.
“I count at least six substantial, lightning-speed attacks against multi-tenant as-a-service vendors since September. Not this year--just since last month.”
jonathaneuniceNorthflank Compromised deployment platform
The whole story postscomments the bright band is this development · numbered dots are the others · click one to jump
What people said 24 voices · best of 27 · verbatim
-
IMO, There is no "middle-ground" to the situation.I wanted to write a blog post about it as I was thinking the same but I guess a comment will help me get my thoughts across just as much.Either we are gonna see a convergence to hyperscalers as you mention, or we would go back to completely indie companies which compete on perf/price.There could…
-
This could all go multiple ways but one of them is we end up in a place where technical security is just not possible to implement any more. What does that world look like?Presumably it means much more behavioral security and inherent friction built in to everything we do. Maybe high value transactions will just inherently have to take multiple…
-
I hope this is a real wake-up call for teams running anything remotely SaaS-shaped. I count at least six substantial, lightning-speed attacks against multi-tenant as-a-service vendors since September. Not this year--just since last month. PingCAP/TiDB, Fireworks AI, Zeabur, OpenCode Console, Railway, now Northflank. All of them modern "we keep…
-
I'm curious what people think of BYOC (bring your own cloud) as an option offering to customers or buying it as a customer. Looking at Northflanks website they list it as an offering, I presume those customers are not affected by the breach.What are your opinion on the concept? Growing trend that should be encouraged or a mistake for most…
-
So if you want to judge as a customer for selection and figure out how likely a new(ish) PaaS company going to get breached, how would you evaluate them?1. Ask them about what percentage of their own resources goes towards cybersecurity, audits etc. Would they even tell you.2. Technical stack maturity. If the details are available, because they…
-
War ?Last I checked major companies are still outsourcing essential engineering to save a buck.A bit old, but how was this practice ever acceptable.https://www.propublica.org/article/defense-department-pentag...A multi trillion dollar company( Microsoft) too cheap to hire onshore for DoD contracts.
-
> probably pretty good protectionsIn my career I've seen maybe two companies have pretty good protections. Both had government contracts so they had no choice. Otherwise there's no reason for companies to secure their stack. They make money easier without it.The buildings are on fire because they're being built out of straw because it's cheaper…
-
A trick i've started doing is encrypting my env vars, then hard-code the decryption key in the codethat way if the provider gets popped, they need my binary to decrypt itit shouldn't be necessary and it sounds stupid, but in cases like this, it proves invaluable (it appears they don't have customer code/binary access, but maybe that wasn't…
-
Run agents and everything they build. Secure execution from the first sandbox Getting hacked while in the business of selling a secure sandbox isn't really a good look. It seems like can't even trust anything these days. The other day OpenCode got hacked and leaked everyone's secrets inside .env to attackers and now this. Sigh.
-
The things that Northflank and Railway were apparently breached to steal aren't just things that hyperscalers would have protected worse instead of better; they're AI API keys, things that only existed because people were using hyperscalers instead of running inference on their own hardware (or on Amazon AWS EC2 GPU instances).
-
i wonder if there is a chain reaction point, when one compromised vendor holds secrets to another one and that becomes the next target. Northflank lists Sentry as their customer. So if Northflank secrets are decrypted and Sentry used them for deployment, you have a starting point to attack Sentry next which then opens up a lot more.
-
> There's no amount of "nicer to use" that can replace security, at least certainly when selling to enterprisesAzure would beg to differ.
-
I actually think it’s the opposite. I think people will move back to their own hardware with OSS deployment like dokku. If everything is more bespoke the attack surface is smaller as is the pay off. Hacking railway got access to lots of api keys, hacking some random vps gets less payoff.
-
Maybe Bill Gates has a point when he says that models capable of significant cyberattacks need to run on controlled infrastructure. Is the era of open weight models you can strip safeguards from turning out to be so great? From my perspective, this kind of sucks.
-
I feel like these breaches started to accelerate after Anthropic wrote a full post about how easy it is to abliterate glm 5.3 to make a frontier-level cyber model.Now, to be clear, abliteration was no state secret, but that blog post was pure accelerationism.
-
Unfortunately, this is going to be an everyday story. More and more bugs and breaches will be discovered and this move fast world more and more will be continued to be made.Security is a perception, but right now it seems like it needs good PR.
-
I wonder which one of these are at least partially due to effortless vibecoding...Also, if vulnerabilities are so easy to find, it should also be easy to detect them through a simple red team exercise.
-
We're observing a worrisome speed up in security breaches. To me it's clear that weaponized AI will cause more harm than some productivity benefits.It’s the death of homegrown software.
-
> All of them modern "we keep your content safe" playersBut they weren’t and probably aren’t and won’t be. They just put forth an image as much as needed to sell.
-
I wonder what it's like inside the big cloud providers. I think outside Microsoft they've always been security first, but this new era has to be crazy town.
-
I think all of these companies need to let you separate secrets from other env vars and not let you ever read your secrets once they're written down.
-
The Hacker News front page is just becoming a security incidence status page at this point. Everything seems pretty fucked.
-
Theres always a market for seedbox providers. Hyperscalers will always wear the white gloves and enable this market.
-
Is the Network Infrastructure Hiding Protocol work at IEEE going to help thwart AI assisted attacks, if adopted?
All 3 developments of Northflank confirms breach; AI API keys stolen amid wave of… →
Hacker News