Railway Urges All Users to Rotate Secrets After Security Incident

Railway, a cloud platform for deploying applications, urged all customers on Oct. 21 to rotate stored secrets after warning that an unauthorized third party may have accessed encrypted environment variables and obtained some of their decrypted contents.

In its security disclosure, Railway said it detected anomalous activity earlier that morning involving systems that store customer environment variables. Those variables can contain API keys, database credentials and private registry credentials. Its initial analysis suggested only a subset of users might be affected, but it recommended action by everyone as a precaution.

The warning comes with an operational obstacle. In a status update at 5:59 p.m. ET, Railway said deployments remained paused, including for Enterprise customers. “We understand you are unable to update your applications with new credentials at this time,” it said. The company urged users to revoke stored credentials and review service logs for unusual activity.

Railway's documentation says variables supply configuration and secrets to applications during builds and while services run. Changes to those variables must be deployed to take effect, explaining why the pause complicates replacing credentials in hosted applications.

Railway's disclosure did not identify affected crypto or web3 projects, wallet-signing keys or cryptocurrency losses. It also did not specify the intrusion method, exposure window or number of affected users.

Security Advice Extends Beyond Railway

Odysseus, founder of onchain security firm Phylax Systems, urged Railway users to assess whether a compromise could provide access to other systems, including employee hardware, and to “rotate everything in the blast radius.”

Railway said it believes the incident is part of a series of attacks targeting platform companies to compromise AI inference providers. It said it had notified those upstream providers to revoke all keys proactively.

The company said it would email customers directly as it confirms which accounts were affected and post further updates to its disclosure and status page.