Railway Breach: Cloud Platform Pauses Deployments, Says Rotate Secrets

Railway, a cloud platform that developers use to host apps and databases, said on Wednesday, 21 October, that it had detected unusual activity in the systems that store customers’ environment variables, and that an unauthorised third party may have read some of them. The intruder “may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents,” the company said. Railway has paused all deployments across its platform while it investigates.

API Keys and Database Passwords Sit in These Variables

Environment variables are where developers keep the secrets their apps need to run, such as API keys for payment or AI services, database passwords and private registry logins. Anyone holding them can act as the app: read its database, run up bills on paid services or push code to its registries.

Railway has not said how many customers are affected. Its first analysis suggests the impact may be limited to a subset of users, and it will email customers it confirms were affected, according to OfficeChai. The company said it has told upstream providers so they can revoke keys that may have been exposed, but did not name them. It has not said how the attacker got in.

Rotate Every Variable, Even Without an Email

Railway asked all users to change every environment variable stored on the platform, including API keys and private registry credentials, and to check their service logs for unusual activity, whether or not they have been told they are affected. There is a catch: with deployments paused, customers cannot yet ship builds that pick up the new credentials. Railway said it is working to restore builds but gave no timeline.

Developers who rotate a key at the provider, such as a payment gateway or an AI company, should also check that provider’s usage and billing records for activity they did not make.

Part of a Wave of Attacks on Developer Platforms

Railway described the incident as “part of a series of attacks recently targeting platform companies”, which it linked to efforts to compromise AI inference providers. OfficeChai noted that the coding tool OpenCode said this month that third-party AI keys saved by 1.4% of its Console users may have been exposed after an intrusion on 16 October. On the same day as Railway’s disclosure, attackers also pushed a malicious LiteLLM release that stole credentials. More reports are in Daily Updates.

Based on reporting by OfficeChai, The CyberSec Guru and The Hacker News (OpenCode).

Image: The CyberSec Guru.