Railway says an attacker may have accessed and decrypted customer environment variables, urges all users to rotate secrets and pauses deployments

Context

Railway is a cloud hosting platform for deploying apps and databases. This is the company's own notice; Andrew Curran's post is commentary on it.

Deep dive

On October 21, Railway posted an urgent notice linking to a security disclosure by Jacob Cooper. It says Railway detected anomalous activity that morning involving systems that store customer environment variables, and that an unauthorized third party may have accessed encrypted environment variables and, for some, obtained the decrypted contents. Those variables may hold secrets such as API keys and database or registry credentials.

Railway said it believes the attack is part of a series recently targeting platform companies with the aim of compromising AI inference providers, and that it has notified those upstream providers to revoke all keys proactively. Its initial analysis suggests the impact may be limited to a subset of users, but it recommends every user immediately rotate all environment variables, API keys and private registry credentials stored in Railway and review logs for unusual activity.

All deployments are paused during the investigation, so customers cannot ship new versions until builds are restored. Railway said it will email affected customers directly and post updates on its blog and status page. AI commentator Andrew Curran shared the news, writing that Railway has been hacked. Railway has not said how many accounts were affected or how the attacker got in.

What to expect next

Watch for Railway to confirm how many customers were affected, how the attacker got in, and when deployments resume. Also watch whether AI inference providers report misuse of revoked keys, and whether other platform companies disclose attacks in the same series. Customers who did not rotate secrets quickly may face follow on breaches, and the pause on builds could push some teams to weigh other hosts.