Railway is urging customers to replace sensitive credentials stored on its hosting platform after attackers gained access to internal systems and decrypted some customer secrets. Those credentials can unlock connected services, including AI tools and databases, even when a hosted website appears to be running normally.
The company’s October 22 preliminary report estimates that up to 1.85% of workspaces, about 100,000, had some environment variables potentially compromised. Environment variables are settings applications read when they run, and often contain passwords or access keys.
A working website doesn’t show whether its keys are safe
Railway says existing customer applications stayed online during the incident, while new builds and deployments were paused. Its investigation was still ongoing, and it had not ruled out access to customer source code.
The company’s initial October 21 disclosure recommends replacing stored access keys and private software-registry credentials, then checking the connected services’ logs for unusual activity.
That advice reaches beyond changing the password used to sign into Railway. If a website uses a key to call an AI service, replacing that key means revoking it with the provider and supplying the replacement to the application that needs it.
Railway recommends the precaution for credentials stored before October 21, including customers not told they were directly affected. It asked some outside providers to revoke all their keys stored on the platform, so a provider’s reset notice alone doesn’t establish that a particular customer’s key was stolen.
Updates pushed during the pause need another deployment
Railway’s October 23 recovery guidance explains another reason to check an apparently healthy site: changes submitted during the pause were not queued. A service continues running its last successful version until someone deploys another one.
A publisher could therefore have a functioning site while a recent correction or application update remains absent. Comparing the version actually deployed with the team’s latest approved version can expose that gap before it is mistaken for a caching problem.
Some GitHub connections need to be restored because Railway revoked them during the incident. Teams deploying from their computers or automated release systems also need replacement credentials after the platform invalidated existing sessions and tokens.
Railway says builds were restored for every plan by its preliminary report. The recovery guide advises checking repository access, retrying the latest deployment and contacting support with the failed deployment’s details if problems continue.
Source: Railway
Start the conversation by posting the first comment