Railway calls for key rotation after customer secret exposure

Railway pauses deployments after possible secret exposure

Cloud development platform Railway has told all users to revoke and rotate their API and cloud keys after a cyberattack may have exposed customer secrets. The company said unidentified attackers may have accessed encrypted environment variables and, for some customers, obtained their decrypted contents.

Railway said its initial analysis indicated that the incident was limited to a subset of users. It nevertheless advised every user to rotate credentials, because compromised secrets could allow an attacker to authenticate to connected services as the legitimate owner. The company also paused customer deployments while its investigation continues, freezing affected customers' websites and applications.

Why environment variables create wider exposure

Environment variables commonly contain passwords, API keys and other credentials used by applications to connect with cloud data storage, databases and external services. Access to those values can therefore extend beyond the development platform itself, depending on which services each customer configured and what permissions their keys carry.

Railway did not disclose how many customers were affected, the initial cause of the incident, or which of its systems were compromised. It also did not say whether the attackers had contacted the company or made a ransom demand.

The company said the breach was likely connected to a broader attack on platforms, with the aim of compromising AI inference providers. That description follows a similar disclosure from OpenCode, an open-source AI coding tool that said attackers obtained API keys and other secrets from more than 1% of its customers. OpenCode attributed its incident to an AI distillation attack involving large numbers of agents attempting to extract sensitive information from AI models.

Separate PHP vulnerabilities add to the security pressure

Railway said its incident appears separate from two critical vulnerabilities disclosed in PHP, the web programming language used in some 70% of websites and public-facing internet systems. Patches for the flaws, dubbed PHP2Shell, were released on Wednesday after a coordinated effort intended to give large organizations time to fix their systems before possible attacks.

Amazon security researchers reported evidence of exploitation four days before the patches were released, indicating that the PHP flaws were already being used in attacks. The Railway disclosure also follows a CISA warning that China-based AI companies were conducting large-scale attacks on US companies to improve their models.

Business implication

For businesses using Railway, the immediate action is to rotate API, cloud and other application credentials, then check connected services for unexpected access. Teams should also account for the deployment pause in their continuity plans and identify which secrets can grant access beyond the Railway environment.