Railway Confirms Cyberattack Exposed Customer Secrets, Tells All Users to Rotate Keys

Development platform Railway has confirmed a cyberattack that let hackers reach some customer secrets, and the company is now telling every user to rotate their API and cloud keys over fears the breach could be wider than first thought.

In a Wednesday blog post, Railway said the unidentified attackers "may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents." Those variables typically hold passwords and API keys that customer apps use to reach services like cloud storage and databases - credentials that would let an attacker log in and act as the account owner.

Railway's early analysis points to a "subset of users," but the company still advised "all users" to revoke and rotate their keys so attackers can't misuse them. Customer deployments were paused during the investigation, freezing customer websites and apps.

The company did not say how many users were affected or what caused the incident, and did not immediately respond to questions about the attack or whether hackers have made contact, such as with a ransom demand. Railway said the breach was likely part of a broader campaign against platforms "with the aim of compromising AI inference providers" - attacks that trick AI systems into leaking sensitive data through malicious prompts.

The incident follows a similar breach at open source AI coding tool OpenCode, which said hackers took more than 1% of its customers' API keys and other secrets in what it called an AI distillation attack. Railway's breach appears separate from two critical PHP vulnerabilities disclosed this week, for which patches dubbed "PHP2Shell" were released Wednesday; Amazon researchers said they found evidence of exploitation four days before the patches.

Source: TechCrunch