Developer platform Railway urges ‘all users’ to revoke secret keys after cyberattack

A cyberattack on Railway

Railway, a cloud development platform, confirmed that hackers could read some customer secrets. Secrets are passwords and keys that let apps reach other services. The company urged every user to replace (rotate) their API and cloud keys. It also paused customer deployments while it investigates, which means some customer websites and apps are frozen for now.

Key facts

• Hackers may have accessed encrypted environment variables and, for some, the decrypted contents.
• Railway says the breach may be limited to a "subset of users", but it has not said how many were hit.
• Railway has not said what the root cause was or how the attack happened.
• OpenCode, a separate AI coding tool, said hackers took more than 1% of its customers' API keys and other secrets earlier this week.

Why secrets matter

Environment variables are settings that hold passwords and API keys. Apps use them to open cloud storage and databases. If an attacker gets these keys, they can log in and act like the real owner. That is why changing the keys is so important, even if the attacker has not been found.

Why it matters

Railway thinks this attack may be part of a larger effort to target AI companies and platforms. A related warning came from the U.S. cybersecurity agency CISA, which said China-based AI companies are running large attacks on U.S. firms. Separately, a PHP bug called "PHP2Shell" has led many sites to go offline for patching, and security researchers at Amazon found signs it was being used in attacks before the patch came out.

What to watch

• Whether Railway finds out how many users were affected and how the attack happened.
• Whether hackers ask for a ransom or contact the company.
• When Railway restarts customer deployments.
• Whether the attacks on AI platforms and the PHP2Shell bug spread further.