Railway Urges All Users to Rotate Keys After Cyberattack Exposes Some Customer Secrets

The development platform, which lets customers build apps and services on its cloud, said in a blog post that unidentified hackers “may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.” Those variables typically hold passwords and API keys that developers’ apps use to reach other services, including cloud data storage and databases. With such secrets, an attacker could log in and access data as if they were the rightful owner.

Railway said its initial analysis suggested the breach was limited to a “subset of users,” but it recommended that “all users” revoke and rotate all of their keys so attackers could not abuse them. The company also paused customer deployments while it investigates, freezing customer websites and apps.

Railway did not say how many users were affected or what caused the incident. It did not immediately respond to a request for comment about the incident or whether it had received any correspondence from the hackers, such as a ransom demand. It is unclear how the attack unfolded or which Railway systems were compromised.

Railway said the breach was likely part of a broader attack on platforms “with the aim of compromising AI inference providers,” according to TechCrunch. Such attacks involve tricking AI systems into leaking sensitive data through malicious prompts that push past their guardrails.

The incident comes soon after the U.S. Cybersecurity and Infrastructure Security Agency warned that China-based AI companies are conducting large-scale attacks on U.S. companies to improve their own models. Earlier this week, open source AI coding tool OpenCode said customer secrets had been breached in a similar attack, with hackers taking more than 1% of its customers’ API keys and other secrets. OpenCode attributed the attack to an AI distillation attack, in which large numbers of agents seek to extract sensitive information from AI models.

TechCrunch reported that the Railway attack appears separate from two critical security vulnerabilities publicly disclosed in the PHP web programming language this week. The flaws prompted companies and governments around the world to pull down sites to fix them before attackers could exploit them. PHP is used in about 70% of websites and public-facing internet systems.

Patches for the bug, called “PHP2Shell,” were publicly released on Wednesday after a global coordinated effort to let large organizations fix their systems ahead of possible attacks. Security researchers at Amazon found evidence of exploitation four days before the patches were released, suggesting the bugs are now being used in attacks.