{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T16:53:33.742Z",
  "tag": {
    "id": "railway",
    "label": "Railway",
    "isStack": false,
    "url": "https://pwn.watch/t/railway",
    "feed": "https://pwn.watch/t/railway/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 1,
    "notFullyPatched": 1,
    "patched": 0
  },
  "incidents": [
    {
      "slug": "railway-env-var-security-disclosure",
      "title": "Railway discloses unauthorized access to customer environment variables",
      "url": "https://pwn.watch/i/railway-env-var-security-disclosure",
      "json": "https://pwn.watch/i/railway-env-var-security-disclosure.json",
      "status": "live",
      "severity": "high",
      "patchStatus": "partial",
      "product": "Railway (hosted platform)",
      "tags": [
        "hosting",
        "railway"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Customer projects with secrets stored as Railway environment variables (scope still under investigation; Railway says initial analysis suggests a subset of users)"
      ],
      "fixedVersions": [],
      "startedAt": "2026-10-21",
      "closedAt": null,
      "updatedAt": "2026-10-22T16:32:37+02:00",
      "summary": "On Oct 21 2026 Railway reported anomalous activity on systems storing customer environment variables. An unauthorized third party may have accessed encrypted env vars and, for some, obtained decrypted contents (API keys, DB/registry credentials). Railway says it believes this is part of a series of attacks on platform companies aimed at compromising AI inference providers, and asked upstream providers to revoke keys. Builds were paused platform-wide for ~a day; on Oct 22 they were restored for Enterprise and Pro, with Hobby/Free/Trial still pending. All users are told to rotate secrets while scoping continues.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "Rohan Paul",
      "handle": "rohanpaul_ai",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1816185267037859840/Fd18CH0v_bigger.jpg",
      "text": "Developer platform Railway told every customer to rotate all secrets after an intruder decrypted some stored credentials.\n\nThose environment variables hold database passwords, cloud keys and model API keys, letting anyone holding them sign in as the owner.\n\nRailway said a subset https://t.co/69pffCmiFq",
      "date": "2026-10-22T14:19:29.000Z",
      "url": "https://x.com/rohanpaul_ai/status/2113274044955099629",
      "media": [],
      "incident": "railway-env-var-security-disclosure"
    },
    {
      "authorName": "The Hacker News",
      "handle": "TheHackersNews",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1597647879811657728/FLgHrLHy_bigger.jpg",
      "text": "🛑 Railway reports a security incident involving systems storing customer environment variables.\n\nAn unauthorized party may have accessed encrypted secrets and, in some cases, decrypted contents.\n\nRailway has invalidated API tokens and urges users to rotate credentials.\n\nDetails https://t.co/bsimFLmfPR",
      "date": "2026-10-22T11:24:18.000Z",
      "url": "https://x.com/TheHackersNews/status/2113229957040336907",
      "media": [],
      "incident": "railway-env-var-security-disclosure"
    },
    {
      "authorName": "NeilXbt",
      "handle": "neil_xbt",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2060131227756072962/s8DV8v8L_bigger.jpg",
      "text": "🚨BREAKING!\n\n\"An unauthorised third party may have accessed encrypted customer environment variables and, in some cases, obtained the decrypted contents.\" \n\nThat's Railway describing its own breach.\n\n• The incident: Railway disclosed unauthorised access to the systems storing",
      "date": "2026-10-22T05:41:53.000Z",
      "url": "https://x.com/neil_xbt/status/2113143785802625282",
      "media": [],
      "incident": "railway-env-var-security-disclosure"
    },
    {
      "authorName": "Jake",
      "handle": "JustJake",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1875304774314401792/sFwtBtJt_bigger.jpg",
      "text": "We've begun the process of ramping builds up\n\nWe'll continue this into the evening, overnight, and into the morning. Tomorrow we will include a full post mortem\n\nWe once again want to apologize for any inconvenience https://t.co/UaD21DIwzA",
      "date": "2026-10-22T04:33:53.000Z",
      "url": "https://x.com/JustJake/status/2113126674103722181",
      "media": [],
      "incident": "railway-env-var-security-disclosure"
    },
    {
      "authorName": "Mark Gadala-Maria",
      "handle": "markgadala",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1904279027013001216/STf4Q5To_bigger.jpg",
      "text": "🚨BREAKING: RAILWAY has just disclosed MAJOR security incident.\n\nCustomer API keys, database passwords, and other sensitive credentials may have been EXPOSED TO HACKERS.\n\nRailway is urging ALL customers to rotate their credentials IMMEDIATELY.\n\nAnd in an extraordinary move, the https://t.co/CXu72n1lMX",
      "date": "2026-10-22T00:00:31.000Z",
      "url": "https://x.com/markgadala/status/2113057879167058072",
      "media": [],
      "incident": "railway-env-var-security-disclosure"
    },
    {
      "authorName": "Crypto Briefing",
      "handle": "Crypto_Briefing",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1346106979605995520/BcuRRkze_bigger.jpg",
      "text": "🚨BREAKING: @Railway reports a security breach in which an unauthorized third party may have accessed customer environment variables, potentially exposing API keys and database credentials.\n\nRailway urges users to rotate credentials immediately as deployments remain paused. https://t.co/RSYPPmTOpf",
      "date": "2026-10-21T22:40:24.000Z",
      "url": "https://x.com/Crypto_Briefing/status/2113037715709255981",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVMEcvoXsAEK3Rq.jpg"
        }
      ],
      "incident": "railway-env-var-security-disclosure"
    },
    {
      "authorName": "Jake",
      "handle": "JustJake",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1875304774314401792/sFwtBtJt_bigger.jpg",
      "text": "Today, we were alerted of malicious activity that compromised Railway's servers\n\nWe are sharing this with you broadly and swiftly. We recommend folks rotate their keys out of an abundance of caution. https://t.co/b4MRzBh2Wb",
      "date": "2026-10-21T22:04:18.000Z",
      "url": "https://x.com/JustJake/status/2113028631463436786",
      "media": [],
      "incident": "railway-env-var-security-disclosure"
    },
    {
      "authorName": "Railway",
      "handle": "Railway",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2060407291996692484/ave6xJl9_bigger.jpg",
      "text": "An urgent notice from the Railway team\n\nhttps://t.co/niUAhTAQJM",
      "date": "2026-10-21T21:51:00.000Z",
      "url": "https://x.com/Railway/status/2113025284148715845",
      "media": [],
      "incident": "railway-env-var-security-disclosure"
    }
  ],
  "changes": [
    {
      "incident": "railway-env-var-security-disclosure",
      "incidentTitle": "Railway discloses unauthorized access to customer environment variables",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Builds restored for Enterprise (by ~06:12 UTC) and Pro (06:29 UTC); Hobby, then Free/Trial to follow. Deploys still queued/slow as of 08:44 UTC.",
      "body": null,
      "sourceUrl": "https://status.railway.com/",
      "url": "https://pwn.watch/i/railway-env-var-security-disclosure"
    },
    {
      "incident": "railway-env-var-security-disclosure",
      "incidentTitle": "Railway discloses unauthorized access to customer environment variables",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Railway publishes per-service remediation guides (AWS, GCP, GitHub, Stripe, OpenAI, Anthropic, Grok, OpenRouter, Postgres/MySQL/Redis/MongoDB credential rotation).",
      "body": null,
      "sourceUrl": "https://blog.railway.com/",
      "url": "https://pwn.watch/i/railway-env-var-security-disclosure"
    },
    {
      "incident": "railway-env-var-security-disclosure",
      "incidentTitle": "Railway discloses unauthorized access to customer environment variables",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "CEO: builds ramping up overnight; full post-mortem promised.",
      "body": null,
      "sourceUrl": "https://x.com/JustJake/status/2113126674103722181",
      "url": "https://pwn.watch/i/railway-env-var-security-disclosure"
    },
    {
      "incident": "railway-env-var-security-disclosure",
      "incidentTitle": "Railway discloses unauthorized access to customer environment variables",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Railway rotated all Railway bucket credentials and invalidated Railway API tokens; researcher Taylor Monahan says the attackers also drained crypto wallets whose private keys were stored on Railway, starting at least two hours before disclosure.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html",
      "url": "https://pwn.watch/i/railway-env-var-security-disclosure"
    },
    {
      "incident": "railway-env-var-security-disclosure",
      "incidentTitle": "Railway discloses unauthorized access to customer environment variables",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "Public security disclosure; deployments paused; users told to rotate all env vars and registry credentials.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/railway-env-var-security-disclosure"
    },
    {
      "incident": "railway-env-var-security-disclosure",
      "incidentTitle": "Railway discloses unauthorized access to customer environment variables",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "Status page: investigating issues; builds paused (07:24 UTC), then dashboard/API/CLI unavailable (11:33 UTC).",
      "body": null,
      "sourceUrl": "https://status.railway.com/",
      "url": "https://pwn.watch/i/railway-env-var-security-disclosure"
    },
    {
      "incident": "railway-env-var-security-disclosure",
      "incidentTitle": "Railway discloses unauthorized access to customer environment variables",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "OAuth sessions invalidated as part of mitigation; users signed out (20:30 UTC).",
      "body": null,
      "sourceUrl": "https://status.railway.com/",
      "url": "https://pwn.watch/i/railway-env-var-security-disclosure"
    },
    {
      "incident": "railway-env-var-security-disclosure",
      "incidentTitle": "Railway discloses unauthorized access to customer environment variables",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "Railway posts 'urgent notice' on X; CEO says servers were compromised and urges key rotation (21:51-22:04 UTC).",
      "body": null,
      "sourceUrl": "https://x.com/Railway/status/2113025284148715845",
      "url": "https://pwn.watch/i/railway-env-var-security-disclosure"
    },
    {
      "incident": "railway-env-var-security-disclosure",
      "incidentTitle": "Railway discloses unauthorized access to customer environment variables",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21 morning",
      "title": "Railway detects anomalous activity; investigates.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/railway-env-var-security-disclosure"
    }
  ]
}