Railway (cloud app deployment platform) says an unauthorised third party may have accessed customers' encrypted environment variables and, for some, obtained the decrypted contents; it urges all users to roll their secrets, paused all deployments (builds back for Enterprise, Pro and Hobby workspaces by 22 Oct UTC; Free and Trial to follow; new signups paused), is rotating all storage bucket credentials and has invalidated all Railway API tokens
Railway's security disclosure, posted by Jacob Cooper on 21 October 2026, says Railway detected anomalous activity that morning involving systems that store customer environment variables, and that its investigation to date indicates an unauthorised third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents. Railway notes environment variables may contain secrets such as API keys or database and registry credentials. Railway says it believes this is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers, and that it has notified those upstream providers to revoke all keys proactively. Railway says its initial analysis suggests the impact may be limited to a subset of users, but it recommends that all users immediately roll every environment variable stored in Railway, including API keys, and any private registry credentials, and review logs for those services for unusual activity; it says it will email affected customers directly as it confirms which accounts were affected. Railway's status page carries the incident as 'Railway Platform Outage', first posted at 07:24 UTC on 21 October (3:24 pm Perth); at 09:28 UTC (5:28 pm Perth) Railway said its dashboard, API and CLI were unavailable and new builds paused in all regions, and at 21:59 UTC (5:59 am Perth 22 Oct) it linked the security notice. At 22:10 UTC (6:10 am Perth 22 Oct) Railway said it was rotating all Railway bucket credentials, with new credentials appearing in dashboards automatically but services unable to be redeployed to pick them up until builds are restored; at 22:45 UTC (6:45 am Perth 22 Oct) it said builds remained paused and that the credential revocations shown in customers' audit logs, carried out by a Railway employee, are expected. Railway has not said how the attacker gained access or how many accounts are affected. UPDATE 22 October (Railway status page): at 01:22 UTC (9:22 am Perth) Railway published guides on recommended next steps, covering checks for unexpected usage at OpenRouter, Anthropic, OpenAI, Grok and Stripe, checks for anomalous GitHub, AWS and GCP access, rotation of PostgreSQL, MySQL, MongoDB and Redis database credentials, and redeploying buckets and reconnecting GitHub after the credential reset; Railway says some steps require a redeploy and will have to wait until builds are available, but others can begin now. In its 03:00 UTC update (11:00 am Perth) Railway said builds remained paused and it expected to have an update for Enterprise users soon. UPDATE 22 October, later (Railway status page): at 03:32 UTC (11:32 am Perth) Railway said builds for Enterprise workspaces are now available, so Enterprise customers can complete the guide steps that require a redeploy, including applying new credentials, with Pro, Hobby, then Free and Trial plans to follow in stages. At 04:17 UTC (12:17 pm Perth) Railway said that, in accordance with its security disclosure, it has invalidated all Railway API tokens, so integrations using the Railway Public API need new tokens. From 04:39 UTC Railway reported deployments stalling at stages such as 'Running pre-deploy command'; at 06:01 UTC it said it was still working on enabling builds for Pro, Hobby, then Free and Trial, and at 06:12 UTC (2:12 pm Perth) it said Enterprise deployments were moving through each stage at normal speed. UPDATE 22 October, evening (Railway status page): at 06:29 UTC (2:29 pm Perth) Railway said builds are now available for Pro and Enterprise workspaces, so Pro customers can complete the guide steps that require a redeploy. At 10:15 UTC Railway said some builds were still failing more often than usual and many deployments remained queued; in its 11:47 UTC update (7:47 pm Perth) it said deployment wait times were coming down, though some deployments may still take longer than usual to start, and that it was still working on enabling builds for Hobby, then Free and Trial. UPDATE 23 October (Railway status page): at 21:08 UTC on 22 October (5:08 am Perth 23 Oct) Railway said builds are now available for Hobby workspaces and that new signups remain temporarily paused; at 21:59 UTC (5:59 am Perth) it said builds are enabled for Hobby, Pro and Enterprise workspaces, are generally completing successfully but may take longer than usual, and that it will update when it enables builds for Free and Trial workspaces. Correction (23 Oct 2026): an earlier version put Railway's 'dashboard, API and CLI unavailable' post at 11:33 UTC on 21 October, the security-notice link at 22:10 UTC and the bucket-credential rotation notice at 22:37 UTC; Railway's status page shows those posts at 09:28 UTC, 21:59 UTC and 22:10 UTC. (source: https://status.railway.com/)
- Product
- Railway cloud application deployment platform (environment variables, storage buckets, builds)
- Versions
- n/a — cloud platform incident
- Exploited in Australia?
- unknown
- Patch to
- Railway (21 Oct): immediately roll all environment variables stored in Railway, including API keys, and any private registry credentials, and review logs for those services for unusual activity. Railway is rotating all storage bucket credentials itself; the new credentials appear in the dashboard, but services cannot be redeployed to use them until Railway restores builds. Watch status.railway.com for build restoration and the email Railway says it will send to affected customers. Railway's 22 Oct guides (linked from status.railway.com) cover usage checks at OpenRouter, Anthropic, OpenAI, Grok and Stripe, GitHub, AWS and GCP access reviews, and PostgreSQL, MySQL, MongoDB and Redis credential rotation; steps that need a redeploy must wait until builds return. Railway (22 Oct, 04:17 UTC): all Railway API tokens have been invalidated, so create new API tokens for any Railway Public API integration. Enterprise workspaces can redeploy to apply new credentials since 03:32 UTC and Pro workspaces since 06:29 UTC; Hobby workspaces since 21:08 UTC on 22 Oct (5:08 am Perth 23 Oct); as of 21:59 UTC on 22 Oct, Free and Trial workspaces were still waiting for builds.
Primary: Railway — Security Disclosure: Wednesday October 21st (21 Oct 2026) · Vendor: Railway status page — Railway Platform Outage (updates to 11:47 UTC, 22 Oct 2026)