Hongdam Studio notes

16,326 Supabase databases let anyone read their tables: check yours in two minutes

2026-10-24T06:00:00+07:00

UpGuard counted 16,326 Supabase databases where anyone who holds the app's public key can read the tables ¹. The study, published 24 September 2026 and updated 14 October, started from about 300,000 domains that appeared to use Supabase and found signs of personal data in more than half of the 16,326. UpGuard links the problem to how tables are made: Supabase turns on row-level security (RLS, explained next) for tables created in its Table Editor, but not for tables created through the API, which is how coding agents work ¹.

Row-level security (RLS) is the rule set inside Postgres, the database Supabase runs on, that decides which rows each caller may read or change. A Supabase app includes a public key in its browser code, called the publishable key (older name: the anon key). Supabase describes it as safe to publish because it can only access what RLS allows ². With RLS off, that key can access every row. A second key, the secret key (older name: the service_role key), bypasses RLS entirely and belongs on a server ².

Four scans since March 2025 all found open tables

Matt Palmer's scan of Lovable projects came first: he found the flaw on 20 March 2025, completed a scan of 1,645 projects on 21 March and published on 29 May 2025 ³. NVD, the US vulnerability database, lists it as CVE-2025-48757 (insufficient RLS in Lovable through 15 April 2025): published 30 May 2025, severity 9.3 of 10 as scored by MITRE, the CVE's issuer. The record is marked disputed, because the supplier holds each customer responsible for protecting its own app's data ⁴.

Scan	Published	Sample	Open tables found
Palmer, Lovable projects ³	29 May 2025	1,645 projects, home pages only	170 projects (about 10.3%), 303 endpoints
Modern Pentest, Y Combinator startups ⁵	26 January 2026	71 startups with reachable Supabase databases	20 exposed personal data (28%); 43 had some exposure (61%)
Symbiotic Security ⁶	2 June 2026	1,072 Supabase sites from Lovable, v0, Bolt.new, Replit and Windsurf	39 with tables readable by the public key; 34 more with sensitive columns exposed
UpGuard ¹	24 September 2026	about 300,000 domains showing signs of Supabase	16,326 databases with readable tables

The samples differ, so the percentages cannot be compared across rows. Wiz found the same problem in Moltbook, a social network for AI agents, and reported it on 31 January 2026: the project URL and public key were in the production JavaScript, RLS was not configured, and queries returned 1.5 million API tokens and 35,000 email addresses. One PATCH request (an HTTP call that edits a record) changed an existing post, so writes were open too. The maintainer closed the tables in several steps within hours ⁷.

Two checks show whether anyone can read your app's data

The Connect dialog in the Supabase dashboard shows the project URL and the publishable key ². This request asks for one table that the app uses, with the placeholders replaced:

curl -s "https://YOUR-REF.supabase.co/rest/v1/orders?select=*&limit=3" \
  -H "apikey: YOUR_PUBLISHABLE_KEY"

Rows in the reply mean every visitor to the site can read that table. [] means the key can access no rows (RLS on with no policy, or an empty table). A 42501 permission error means the table is not exposed to the key at all ⁸.

The SQL Editor in the same dashboard checks every table at once:

select c.relname as table_name,
       c.relrowsecurity as rls_on,
       has_table_privilege('anon', c.oid, 'select') as anon_can_read
from pg_class c
join pg_namespace n on n.oid = c.relnamespace
where n.nspname = 'public' and c.relkind in ('r','p')
order by rls_on, table_name;

A row with rls_on false and anon_can_read true is a table the public key reads. Both checks run against your own project.

The fix: turn on RLS, take away the public role's access, and add one policy per action

alter table public.orders enable row level security;
revoke all on public.orders from anon;

create policy "owner reads own orders" on public.orders
  for select to authenticated
  using ((select auth.uid()) = user_id);

create policy "owner adds own orders" on public.orders
  for insert to authenticated
  with check ((select auth.uid()) = user_id);

auth.uid() returns the signed-in user's id; wrapping it in select lets Postgres evaluate it once per statement instead of once per row ⁹.

We ran these statements on 24 October 2026 on Postgres on our own computer (PGlite 0.5.11, Postgres 18.6) with test versions of the anon and authenticated roles, not on a hosted Supabase project. Before, the public role read every order. After, the public role got permission denied, user 1 read only user 1's rows, and an insert naming user 2 failed with a row-level security violation.

A policy that says `true` opens the table again

A policy of using (true) matches every row for every caller. Palmer reports that the scanner Lovable released in April 2025 checked that a policy exists, not what it says ³. Lovable's documentation lists rules that let everyone through among its quick scan's database checks, and says the scans find common issues, not all of them ¹⁰. On the same test Postgres, a table with a using (true) policy returned its row to the anon role. One query lists the policies that match:

select tablename, policyname, cmd
from pg_policies
where schemaname = 'public' and (qual = 'true' or with_check = 'true');

On 30 October 2026 Supabase changes the default for new tables; existing tables keep their settings

A Supabase changelog entry of 28 April 2026 says new tables in the public schema are no longer reachable through the Data API (the generated REST layer that supabase-js calls) until a grant allows it. New projects get the new default from 30 May 2026, in a rollout over a few weeks; the entry sets 30 October 2026 for existing projects, six days after this note. Existing tables keep their grants and stay reachable, and RLS works as before. The entry gives the reason: agents, CLI scripts and AI platforms create tables without a human reviewing the change ⁸. The new default does not close tables that are already open; the check above shows which ones are.

An existing project can adopt the new default before 30 October with two statements from the same entry ⁸. On our test Postgres, a table made afterwards returned permission denied to anon, the older table stayed readable, and an explicit grant select made the new one readable again.

alter default privileges for role postgres in schema public
  revoke select, insert, update, delete on tables from anon, authenticated, service_role;
alter default privileges for role postgres in schema public
  revoke usage, select on sequences from anon, authenticated, service_role;

An event trigger (a Postgres rule that runs when the database structure changes) can turn on RLS for each table created afterwards, whichever tool made it. Supabase publishes its own version ¹¹; this shorter one ran in the same test and caught both create table and create table as:

create function rls_on_new_tables() returns event_trigger
language plpgsql security definer set search_path = pg_catalog as $$
declare t record;
begin
  for t in select * from pg_event_trigger_ddl_commands()
           where command_tag in ('CREATE TABLE', 'CREATE TABLE AS', 'SELECT INTO')
             and schema_name = 'public'
  loop
    execute format('alter table %s enable row level security', t.object_identity);
  end loop;
end $$;

create event trigger rls_on_new_tables on ddl_command_end
  when tag in ('CREATE TABLE', 'CREATE TABLE AS', 'SELECT INTO')
  execute function rls_on_new_tables();

Tables created before the trigger need alter table … enable row level security run on them manually ¹¹.

Two more problems: columns the browser can write, and secret keys in the browser

On Linkable, a paid site built with Lovable, Palmer sent a POST request with no authorization header and inserted a record with payment_status set to "paid", bypassing Stripe ³. A column the browser may write is a column a visitor may set. Column-level grants remove the write access: on our test Postgres, a signed-in user's insert or update of plan got permission denied, while display_name stayed writable.

revoke insert, update on public.profiles from authenticated;
grant insert (id, display_name), update (display_name) on public.profiles to authenticated;

The server that receives the payment provider's event then writes plan with the secret key, which bypasses RLS ². That key in a browser bundle defeats every policy above. Supabase answers a secret key sent from a browser with a 401 error, and says a leaked key still works from other tools ². In a framework such as Next.js, a NEXT_PUBLIC_ prefix on a variable name sends its value to the browser:

NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=sb_publishable_...   # sent to the browser
SUPABASE_SECRET_KEY=sb_secret_...                          # server only: no prefix

grep -r "sb_secret_" dist build .next/static over a build folder finds a new-format secret key left in it. You replace a leaked secret key in the dashboard under Settings, API Keys ². Supabase is deprecating the anon and service_role keys by the end of 2026 and replacing them with the publishable and secret keys ².

PHP2Shell: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two flaws that let attackers run code

2026-10-24T06:00:00+07:00

PHP, the language many websites run on, has two flaws in its core that let an outsider run commands on a web server without logging in. PHP released fixes on 21 October 2026 ¹, four days after Amazon recorded the first attack attempt ⁶. Sansec credits the exploit (attack code) that combines both flaws, called PHP2Shell, to the research firm Calif ¹⁵.

A CVE (Common Vulnerabilities and Exposures) number is the public ID of one flaw. A SAPI (server API) is the way PHP connects to a web server. php-fpm is a pool of PHP worker processes that nginx or Apache sends requests to; mod_php runs PHP inside Apache's own processes.

Two CVEs, both rated 9.2 out of 10, let attackers run code on the server

CVE-2026-109618: a request that exhausts memory_limit makes PHP abort while it is starting up, and the cleanup that follows treats half-built data as valid ². CVE-2026-109619: state from one request keeps pointing at memory that request owned, and a later request on the same worker (the process that handles requests) uses the freed memory ³. Both lead to remote code execution (RCE: an outsider runs commands on the server) with the web worker's privileges ²³.

PHP scores each 9.2 on CVSS v4, a 0-to-10 severity scale, with attack complexity rated high ²³. NVD adds a CVSS 3.1 score of 9.8 for CVE-2026-109618 ⁴. The PHP Foundation states that a score of 10.0 that circulated before the release was wrong ⁵.

mod_php is the most exposed setup; php-fpm depends on the application

PHP's advisory lists five affected setups: Apache mod_php, php-fpm, php-cgi, FrankenPHP and LiteSpeed. It rates mod_php highest, because an unauthenticated request reaches the first flaw before any application code runs ¹, and the advisory demonstrated it with default memory and input limits ².

For php-fpm the sources differ:

CVE-2026-109618: the advisory's source analysis calls FPM susceptible but shows no full exploit; FPM exits the worker when startup fails ².
CVE-2026-109619: FPM is exposed through a frontend that passes PHP_VALUE settings, or through session upload progress, which was validated ³.
Calif demonstrated FPM behind nginx where the application decodes data after startup (session_start(), unserialize()) and lists pre-login code execution on WordPress 7.1.2, Drupal 11.4.3 and Joomla 6.1.4 ¹⁶.
Red Hat: reliable exploitation needs precise heap manipulation, and FPM workers exit on early failure ¹². Sansec: a researcher found public proofs of concept fail on default installs and mostly need a separate file-inclusion bug in the target ¹⁵.

The advisory does not cover servers without PHP or machines that run PHP only for command-line scripts; it covers PHP that serves web requests ¹. RHEL 7 is not affected by CVE-2026-109618, only by CVE-2026-109619 ¹².

Attacks began on 17 October, four days before the fix

Amazon's honeypot network (decoy servers that record attacks) logged the first attempt on 17 October from an anonymization network. On 21 October between 02:00 and 08:00 UTC more attempts arrived with varied payloads, which suggests several attackers; Amazon cannot say whether any would have worked on a real system ⁶. Cloudflare saw attack traffic against customers before the release and switched on managed WAF rules (web application firewall rules, which filter requests) for Free and paid plans at 03:02 UTC on 21 October ¹⁷.

The PHP team says the CVE ids leaked about 15:00 UTC on 20 October, a demonstration video followed that evening, and the release moved from 22 October to 21 October, 14:00 UTC. It found no working public exploit at release ⁵. The alert from CISA (the US government's cybersecurity agency), published 21 October and revised 23 October, reports no successful exploitation observed ⁷. The Known Exploited Vulnerabilities catalog, version 2026.10.23, lists neither CVE (read 24 October 2026) ⁸.

`php -v` shows the command-line PHP; the web server can run a different one

A small PHP file on the web server can print which PHP build serves web requests. PHP_VERSION holds the version string and PHP_SAPI the server API name ²²; fpm-fcgi is php-fpm, apache2handler is the Apache module, cgi-fcgi is FastCGI and litespeed is LiteSpeed ²³. Red Hat points to a temporary phpinfo() page for web settings, because php -i reports the command-line configuration ¹².

php -v                                              # command-line build only
echo '<?php echo PHP_VERSION, " ", PHP_SAPI, "\n";' | sudo tee /var/www/html/ver-check.php
curl -s https://example.com/ver-check.php           # e.g. 8.3.36 fpm-fcgi
sudo rm /var/www/html/ver-check.php

On the server itself:

ps -eo pid,lstart,user,args | grep -E 'php-fpm|apache2|httpd|lsphp|frankenphp|php-cgi' | grep -v grep
sudo apachectl -M | grep php            # mod_php loaded into Apache
grep -rn fastcgi_pass /etc/nginx/       # which php-fpm socket nginx uses

Distribution packages keep an older upstream number with a new suffix, so a printed version can read lower than the release table below while the package carries the fix; CloudLinux names alt-php85 8.5.11-5 and ea-php84 8.4.26-2.el8.cloudlinux.1 as fixed builds ¹⁴. Package versions decide.

apt list '?installed ?name(^php[0-9.]+$)'                                  # Debian, Ubuntu
zgrep CVE-2026-109618 /usr/share/doc/php8.3-common/changelog.Debian.gz    # Debian, Ubuntu
rpm -q --changelog php-common | grep CVE-2026-109618                       # RHEL family

The changelog checks come from Sansec ¹⁵. CloudLinux notes its native PHP 8.2 and 8.3 changelogs omit the CVE ids; there rpm -q php-cli reads 8.2.35 or 8.3.36 or later ¹⁴.

Four PHP versions (8.2 to 8.5) have a fixed release; 8.1 and older depend on the vendor

PHP branch	Fixed release (21 October 2026)	Upstream security support ends
8.5	8.5.12	31 Dec 2029
8.4	8.4.27	31 Dec 2028
8.3	8.3.36	31 Dec 2027
8.2	8.2.35	31 Dec 2026
8.1, 8.0, 7.4	none; a source patch branch for each	ended
7.3 and older	none listed	ended
8.6.0	RC4 carries the fix; earlier 8.6.0 builds do not	not released

Sources: ¹²³²⁴. The patch replaces the way PHP jumped out of the code on an out-of-memory error with a soft stop at the next safe point and a hard process exit at a higher limit ².

Linux distributions (Ubuntu, Debian, Red Hat) use their own version numbers for the fix:

System	Package	Fixed version or erratum
Ubuntu 26.10	php8.5	8.5.9-0ubuntu2.1
Ubuntu 26.04	php8.5	8.5.4-0ubuntu1.5
Ubuntu 24.04	php8.3	8.3.6-0ubuntu0.24.04.13
Ubuntu 22.04	php8.1	8.1.2-1ubuntu2.28
Ubuntu 20.04, 18.04 (Ubuntu Pro)	php7.4, php7.2	7.4.3-4ubuntu2.29+esm5, 7.2.24-0ubuntu0.18.04.17+esm14
Debian 13	php8.4	8.4.27-1~deb13u1 (DSA-6574-1)
Debian 12	php8.2	8.2.35-1~deb12u1 (DLA-4848-1)
RHEL 10	php, php8.4	8.3.36-1.el10_2, 8.4.27-1.el10_2
RHEL 9	php:8.2, php:8.3, php 8.0	RHSA-2026:87072, 87079, 87151
RHEL 8	php:8.2, php:7.4	RHSA-2026:87073, 87080

Sources: Ubuntu ⁹, Debian ¹¹, Red Hat ¹³. Red Hat's data, checked on 24 October 2026, lists the RHEL 9 php:8.4 stream as affected with no erratum ¹³. On cPanel hosts, ea-php82 to ea-php85 builds with the fix became stable on 21 October, and builds numbered 8.2.35-1, 8.3.36-1, 8.4.27-1 and 8.5.12-1 followed on 23 October ¹⁴.

The update is the fix; the restart is what makes it apply

PHP's advisory calls the update the only complete fix ¹; a running worker keeps the code it started with. Ubuntu states that updating the packages is not enough on its own; unattended-upgrades (on by default since Ubuntu 16.04) applies security updates within about 24 hours, and applications still need a restart or the system a reboot afterward ¹⁰. Red Hat states a reload is not enough and a container is replaced, not restarted in place ¹².

# Debian, Ubuntu
sudo apt update && sudo apt install --only-upgrade '?name(^php[0-9.]+$)'
sudo systemctl restart php8.3-fpm       # php-fpm; unit name follows the branch
sudo systemctl restart apache2          # mod_php
# RHEL family
sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm          # php-fpm
sudo systemctl restart httpd            # mod_php

The apt upgrade and the apache2 restart follow Ubuntu's notice ¹⁰; the Red Hat unit names follow Red Hat's bulletin ¹². On cPanel hosts CloudLinux names /scripts/restartsrv_httpd and /scripts/restartsrv_apache_php_fpm ¹⁴.

If you cannot update yet, PHP lists partial measures, which it says do not make an install safe: session.upload_progress.enabled=0 and, on 8.5, fatal_error_backtraces=0, set in php.ini or the pool config (not ini_set() or .user.ini) with a restart; memory_limit=-1 through php_admin_value; a lower post_max_size ¹.

Checking that no process still runs the old code

sudo needrestart -r l                   # Debian, Ubuntu: lists services on outdated code, changes nothing
sudo dnf needs-restarting -s            # RHEL family: services started before an updated package
for p in $(pgrep -f php-fpm); do sudo ls -l /proc/$p/exe; done
ps -o pid,lstart,args -C php-fpm8.3     # start times later than the upgrade

needrestart -r l reports services that need a restart and makes no change ¹⁹. needs-restarting -s limits its report to systemd services whose process predates an updated package ²⁰. A /proc/PID/exe link ending in (deleted) marks a process started from a binary that has since been replaced ²¹; php-fpm and php-cgi are their own binaries, while mod_php lives inside Apache, so the Apache service is the one that carries it.

CVE-2026-115560 affects updated builds in one configuration

PHP's 23 October notice names a third CVE, in session upload progress, that Cloudflare states affects patched versions including 8.5.12 ¹⁷. It needs session.serialize_handler set to php_binary or php_serialize, an application that switches it to php with ini_set() before session_start(), and upload progress turned on. The temporary fix is session.upload_progress.enabled=0 until the next regular release, which carries the full advisory ¹; Red Hat states the setting fully addresses it ¹².

Signs of a break-in: the sources list few

PHP's advisories list no indicators of compromise, and state that clean logs do not prove safety ³.
CISA names PHP worker processes launching shells or downloading tools, and points to its SIGMA detection rule ⁷.
Amazon names the string PHP_SESSION_UPLOAD_PROGRESS in multipart POST bodies and lists six source addresses on shared anonymization networks ⁶.
The advisory's log audit looks for repeated warnings before target scripts run, fatal errors, and "Maximum execution time exceeded" ³.
Sansec reports a path that returns freed worker memory in a PHPSESSID cookie; that memory can hold passwords, session tokens, API keys and TLS private keys ¹⁵.

On hosted sites, the hosting company applies the fix

The version: WordPress lists the server setup under Tools, Site Health, Info, Server ¹⁸; the ver-check.php file above works through a host's file manager; a hosting control panel's PHP setting shows the branch it serves.
The fix is the host's build. CloudLinux's builds for cPanel hosts keep old numbers while carrying the fix, so a panel reading 8.4.26 can be patched ¹⁴. Cloudflare states that patching means the vendor's PHP update, not only site code or plugin updates, and that a host which manages PHP applies it ¹⁷.
Versions: 8.2.35 is the oldest fixed upstream release, and 8.2 security support ends 31 December 2026 ¹²⁴. PHP 8.1 and older receive no upstream update; vendors backport the fix or the site moves to a newer version ¹. CISA lists taking a PHP system offline if it cannot be updated, or if it runs PHP 8.1 or earlier ⁷.
Cloudflare's managed WAF rules for both CVEs run by default on Free and paid plans, as an added layer beside the update ¹⁷.

One workflow, 30,000 runs a month: Zapier US$1,149, Make US$116, Cloudflare Workers US$5

2026-10-24T06:00:00+07:00

One order workflow costs US$5 a month on Cloudflare Workers and US$1,149 on Zapier at 30,000 runs. A workflow is a chain of automatic steps, and a run is one pass through it; Zapier, Make and n8n are tools for building workflows. The workflow is the same; each platform counts a run in a different unit, and the unit decides the price.

The example run is one trigger and four actions across three apps

In the example, a web form posts each order to a webhook, a web address that passes the order's data to the workflow. The workflow finds the customer in a Google Sheet, writes the order as a row, emails a confirmation from Gmail and posts a message in Slack. Volumes are 300, 3,000 and 30,000 runs a month, or 10, 100 and 1,000 a day. Prices are list prices taken from each vendor's pages on 24 October 2026, for the lowest plan or tier that covers the volume, not including the fees of Google, Slack or an email provider. Euro prices are converted to US dollars where compared, at the European Central Bank reference rate of 23 October 2026, EUR 1 = US$1.1193 ¹⁷.

One run is 4 tasks, 5 credits, 1 execution, 1 request or 1 minute

Zapier counts a task for each successful action. The trigger and built-in steps (Filter, Formatter, Paths, Delay) count 0 ¹². The run is 4 tasks.
Make counts a credit for each module action, and reading an incoming webhook is one of them. Router and error-handler modules count 0 ³⁴. The run is 5 credits. Make's pricing page dates the switch to credits as its billing unit to 27 August; its help pages say operations.
n8n counts a run of the whole workflow at any number of steps: "An execution is a single run of your entire workflow." ⁵ The run is 1 execution.
Cloudflare Workers is code that Cloudflare runs for each incoming request, so you rent no server. It bills requests, and calls the code makes outward are free. The paid Standard plan also bills CPU time, the processor time the code uses; waiting on the network does not count ⁶⁷. The run is 1 request.
GitHub Actions bills minutes on its runners, with each job rounded up to a whole minute ⁸⁹. A job that ends in seconds is 1 minute.

Per-step counting grows with the workflow. One more action moves Zapier from 4 to 5 tasks (a quarter more) and Make from 5 to 6 credits (a fifth more). n8n stays at 1 execution, and a Worker adds milliseconds of CPU time, which fall within the 30 million included at these volumes ⁶.

At 30,000 runs, Zapier costs about 10 times Make and 230 times Cloudflare Workers

Platform and plan	A run counts as	300 runs	3,000 runs	30,000 runs
Zapier, Professional ¹	4 tasks	US$58.50 (1,500-task tier)	US$283.50 (20,000-task tier)	US$1,149 (200,000-task tier)
Make, Core ³	5 credits	US$10.59 (10,000-credit tier)	US$18.82 (20,000-credit tier)	US$116.47 (150,000-credit tier)
n8n Cloud, Starter then Pro ⁵	1 execution	€24 (Starter, 2,500 executions)	€60 (Pro, 10,000)	€144 (Pro, 50,000)
n8n self-hosted, Community Edition ⁵¹⁰¹¹	1 execution	€5.99 to €26.99 server, plus update hours	€5.99 to €26.99 server, plus update hours	€5.99 to €26.99 server, plus update hours
Cloudflare Workers, Free or Standard ⁶⁷	1 request	US$0 on Free, US$5 on Standard	US$0 on Free, US$5 on Standard	US$0 on Free, US$5 on Standard
GitHub Actions, Linux 2-core, private repository ⁸⁹	1 job minute	US$0 (300 of 2,000 free minutes)	US$6.00 (1,000 minutes over)	US$168.00 (28,000 minutes over)

Annual billing lowers Zapier to US$39, US$189 and US$769, Make to US$9, US$16 and US$99, and n8n Cloud to €20, €50 and €120 ¹³⁵. The Free plans do not cover the example run: Zapier's Free plan allows two-step Zaps and 100 tasks, Make's Free plan covers 200 runs in its 1,000 credits, and n8n Cloud starts with a trial limited to 1,000 executions ¹³⁵. GitHub Actions starts a job from an event, which an outside form can send with a repository_dispatch call ¹⁸; standard runners in a public repository cost nothing ⁸.

Workers Free limits each request to 10 ms of CPU time. Cloudflare reports about 2.2 ms for the average Worker and 10 to 20 ms for heavier ones, such as authentication or large payloads ⁷. The example run's CPU time is not measured here, so the table shows both plans.

Monthly cost of 30,000 runs, US dollars · lower is better
Zapier Professional	1,149 USD
GitHub Actions, 28,000 billed minutes	168 USD
n8n Cloud Pro, €144	161.18 USD
Make Core	116.47 USD
n8n self-hosted, 2 vCPU 4 GB server in Singapore, €26.99	30.21 USD
n8n self-hosted, 2 vCPU 4 GB server at NBG1 or HEL1, €5.99	6.7 USD
Cloudflare Workers Standard	5 USD

Monthly billing, list prices as of 24 October 2026, euro prices at EUR 1 = US$1.1193. The n8n self-hosted bars show the server cost only, without update hours.

n8n self-hosted: a €5.99 to €26.99 server plus update hours

Self-hosting means running n8n's free Community Edition on a server you rent and update yourself ⁵. Hetzner lists a 2 vCPU (virtual processor core), 4 GB server at €5.99 a month excluding VAT at its NBG1 and HEL1 locations (CX23), and a 2 vCPU, 4 GB AMD server at €19.99 at those locations and €26.99 at SIN1 in Singapore (CPX22) ¹⁰¹¹. The order line on both pages read "currently unavailable" on 24 October 2026. n8n's Hetzner guide asks for at least 4 GB and 2 vCPU once its Assistant feature is added ¹². The load is small: n8n's benchmark puts one instance at up to 220 executions a second, and 30,000 runs a month average 0.012 a second ¹³.

The server price is the smaller part. An update is three commands, docker compose pull, docker compose down and docker compose up -d ¹⁴. Read from GitHub on 24 October 2026, n8n published 26 releases, on 17 different days, in the 30 days to that date, and 29 security advisories on two days: 14 on 30 September and 15 on 14 October, 15 medium and 14 high severity ¹⁵¹⁶. At one hour per update window (time to update and test the workflow), those two days come to 2 hours a month. The hour is an assumption, not a measurement; no source times it.

With more steps, Make costs more than n8n Cloud

A ten-credit run (a trigger and nine actions) at 30,000 runs needs 300,000 Make credits, US$214.31 a month on Core, while n8n Cloud Pro stays at €144 (US$161.18) ³⁵.
Up to 200 runs a month, Make's Free plan covers the example workflow at US$0. At 300 runs the lowest paid tiers are Make US$10.59, n8n Cloud €24 (US$26.86) and Zapier US$58.50.
A daily job such as a price check is 30 runs a month. Zapier's lowest Professional tier (750 tasks, US$29.99), Make's lowest Core tier (US$10.59) and n8n Starter (€24) each cover it ¹³⁵.
Code on Cloudflare Workers or GitHub Actions has no per-step unit; its cost is the time to build and maintain it. Hongdam's price is ฿8,000 a workflow: one trigger, up to three apps, an alert when it stops and 30 days of fixes, in n8n, Make, Zapier or code, with the tool's own fees charged at the price we pay ¹⁹.

Hongdam Studio notes

16,326 Supabase databases let anyone read their tables: check yours in two minutes

Four scans since March 2025 all found open tables

Two checks show whether anyone can read your app's data

The fix: turn on RLS, take away the public role's access, and add one policy per action

A policy that says true opens the table again

On 30 October 2026 Supabase changes the default for new tables; existing tables keep their settings

Two more problems: columns the browser can write, and secret keys in the browser

PHP2Shell: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two flaws that let attackers run code

Two CVEs, both rated 9.2 out of 10, let attackers run code on the server

mod_php is the most exposed setup; php-fpm depends on the application

Attacks began on 17 October, four days before the fix

php -v shows the command-line PHP; the web server can run a different one

Four PHP versions (8.2 to 8.5) have a fixed release; 8.1 and older depend on the vendor

The update is the fix; the restart is what makes it apply

Checking that no process still runs the old code

CVE-2026-115560 affects updated builds in one configuration

Signs of a break-in: the sources list few

On hosted sites, the hosting company applies the fix

One workflow, 30,000 runs a month: Zapier US$1,149, Make US$116, Cloudflare Workers US$5

The example run is one trigger and four actions across three apps

One run is 4 tasks, 5 credits, 1 execution, 1 request or 1 minute

At 30,000 runs, Zapier costs about 10 times Make and 230 times Cloudflare Workers

n8n self-hosted: a €5.99 to €26.99 server plus update hours

With more steps, Make costs more than n8n Cloud

A policy that says `true` opens the table again

`php -v` shows the command-line PHP; the web server can run a different one