If you host on Railway, rotate every secret you store there today. In a security disclosure dated October 21, Railway says an unauthorized third party may have accessed environment variables, and for some of them obtained the decrypted contents.

What Railway says happened

Railway detected anomalous activity on the morning of October 21 on systems that store customer environment variables. Those can include API keys and database or registry credentials.

Railway believes this is part of a series of attacks on platform companies aimed at compromising AI inference providers. It notified those providers so they could revoke keys proactively.

Who needs to act

Railway says impact may be limited to a subset of users, but it tells all users to act. Affected customers will be emailed. Do not wait for that email.

All deployments are paused during the investigation, so no new versions can roll out until deployments resume.

Update from Railway's status page

Per the Railway status page:

  • Railway is rotating all storage-bucket credentials itself. New credentials appear in your dashboard automatically, but you cannot redeploy to pick them up until builds resume.
  • You may see credential revocations in your audit logs, made by a Railway employee. Railway says this is expected.
  • Railway invalidated OAuth sessions, so some users are signed out and must log in again.
  • Builds are still paused. Railway says next-step guides are coming.

What to do now

This is general advice, not Railway's instructions beyond the rotation request:

  1. Rotate at the provider first. Generate a new key or password, then revoke the old one.
  2. Start with AI provider keys and database credentials, then private registry credentials and everything else.
  3. Update the variables in Railway, then redeploy once deployments resume.
  4. Check each provider's logs for requests you do not recognize, and review your Railway logs too.

Where to follow along

Railway says updates will appear on its post and on status.railway.com.

Related reading: GitLab critical flaw patch and Plex Media Server security update.