Platform-as-a-service provider Railway disclosed on 22 October that an unauthorised third party may have gained access to encrypted customer environment variables and, in some cases, obtained their decrypted contents, with impact limited to a subset of users it has not quantified. Environment variables typically hold API keys, database credentials and feature flags. Railway said the incident is likely part of a series of attacks against platform companies aimed ultimately at compromising AI inference providers, and that it has notified upstream providers so keys can be revoked. It has rotated bucket credentials, invalidated API tokens and restored builds for Pro and Enterprise workspaces, and is urging customers to rotate environment variables and private registry credentials and review logs. Security researcher Taylor Monahan reported that cryptocurrency wallets whose private keys were stored on Railway were drained, with the first known theft transaction occurring at 19:36, at least two hours before the incident was disclosed.

• Source article