https://pwn.watch/t/railway Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 14:32:37 GMT https://pwn.watch/i/railway-env-var-security-disclosure https://pwn.watch/i/railway-env-var-security-disclosure Thu, 22 Oct 2026 14:32:37 GMT high <p>On Oct 21 2026 Railway reported anomalous activity on systems storing customer environment variables. An unauthorized third party may have accessed encrypted env vars and, for some, obtained decrypted contents (API keys, DB/registry credentials). Railway says it believes this is part of a series of attacks on platform companies aimed at compromising AI inference providers, and asked upstream providers to revoke keys. Builds were paused platform-wide for ~a day; on Oct 22 they were restored for Enterprise and Pro, with Hobby/Free/Trial still pending. All users are told to rotate secrets while scoping continues.</p> <p><strong>Status:</strong> live · <strong>Patch:</strong> partial</p> <p><strong>Latest updates:</strong></p><ul><li>2026-10-22: Builds restored for Enterprise (by ~06:12 UTC) and Pro (06:29 UTC); Hobby, then Free/Trial to follow. Deploys still queued/slow as of 08:44 UTC. (<a href="https://status.railway.com/">source</a>)</li><li>2026-10-22: Railway publishes per-service remediation guides (AWS, GCP, GitHub, Stripe, OpenAI, Anthropic, Grok, OpenRouter, Postgres/MySQL/Redis/MongoDB credential rotation). (<a href="https://blog.railway.com/">source</a>)</li><li>2026-10-22: CEO: builds ramping up overnight; full post-mortem promised. (<a href="https://x.com/JustJake/status/2113126674103722181">source</a>)</li></ul>