Railway urges all users to revoke keys after breach exposes decrypted environment variables

Railway, a cloud development platform serving 2 million developers, confirmed on Oct. 21, 2026, that hackers accessed encrypted environment variables and decrypted their contents for a subset of users. The company paused all customer deployments and temporarily disrupted its API, dashboard, and deployment services while investigating the breach, which it believes is part of a broader campaign targeting AI inference providers. Railway urged all users to revoke and rotate their API and cloud keys, even though its initial analysis suggested only a subset was affected.

Environment variables on Railway typically contain passwords and API keys used by developers’ apps to access services like cloud storage, databases, and private package registries. If compromised, these credentials allow attackers to log in and access data as legitimate users. Railway’s investigation detected anomalous activity in systems storing these variables at approximately 07:24 UTC on Oct. 21, 2026, triggering its response. The company later reset storage bucket credentials and GitHub tokens for customer accounts on Oct. 22, rendering previous credentials invalid.

Railway’s CEO, Jake Cooper, discussed notifications from payment providers Stripe and Ant about compromised credentials during the incident’s timeline on Oct. 21. The company’s security disclosure was published at approximately 21:51 UTC, over two hours after the first suspected cryptocurrency theft transaction, which blockchain investigator Taylor Monahan linked to the breach. Monahan identified approximately USD 371,000 in suspected cryptocurrency theft across 19 Ethereum-compatible networks, though Railway has not confirmed these losses or the number of affected customers.

Railway has not disclosed the root cause of the breach, the number of affected users, or whether it received a ransom demand. The company will e-mail customers individually once investigators confirm which accounts were affected, though it has not specified a timeline for resuming deployments or completing its investigation. Customers are advised to monitor updates on Railway’s status page and review logs for signs of unusual activity, even if their accounts were not confirmed as directly affected.

The breach follows a pattern of attacks targeting developer tooling ecosystems, including similar incidents at OpenCode and Fireworks AI. OpenCode reported a breach on Oct. 18, 2026, where hackers stole API keys and other secrets from over 1% of its customers using AI distillation techniques. The U.S. cybersecurity agency CISA warned on Oct. 19, 2026, that China-based AI companies are conducting large-scale attacks on U.S. companies to improve their own models, highlighting a broader trend of targeted cyberattacks on AI-related infrastructure.

This centralized secret management increases exposure risks, as decrypted credentials can grant attackers broad access to linked services. Railway notified upstream providers to proactively revoke potentially exposed keys, a step taken to mitigate further risks from compromised credentials.

The Railway breach is unrelated to two critical PHP vulnerabilities, known as ‘PHP2Shell,’ disclosed on Oct. 21, 2026, which affected approximately 70% of websites. Amazon security researchers detected evidence of exploitation of these vulnerabilities four days before the patch release on Oct. 17, 2026, indicating active exploitation before patches were available.

Railway advises all users to revoke and rotate their API and cloud keys immediately, even if their accounts were not confirmed as directly affected. Customers should review logs for signs of unusual activity and monitor Railway’s status page for updates. The company will e-mail affected customers individually once investigators confirm which accounts were compromised. Railway has already reset storage bucket credentials and GitHub tokens for customer accounts, rendering previous credentials invalid, and notified upstream providers to revoke potentially exposed keys.