Railway security incident: rotate secrets stored before October 21

Railway, the app hosting platform, says an outside attacker got into “a subset of internal Railway systems” on October 20 and 21, 2026, and decrypted some customers’ stored environment variables. In a preliminary report dated October 22, Railway says “at most 1.85% of all workspaces” had some environment variables potentially compromised, which it puts at about 100,000 workspaces. It recommends that every customer who signed up before October 21 rotate the keys they store on Railway.

What happened

All times are UTC, from Railway’s timeline:

• Oct 20, 13:58: the attack window begins; on-call engineers are paged for abnormal latency. They soon find an attempted privilege escalation and halt build pipelines.
• Oct 21, early morning: forensics show the attacker could pull secrets in encrypted form. The attacker then obtains CI credentials and decrypts a subset of environment variables.
• Oct 21, 20:19 to 22:10: Railway invalidates user sessions, publishes a disclosure and tells all users to rotate credentials.
• Oct 22, 03:32: Railway confirms the attacker no longer has access. Full API service and normal deployments return later that day.

Railway says running apps stayed online, but new builds and deployments were paused for all customers. It says the attacker did not access Railway user accounts. It has not ruled out access to user source code and says it will confirm that in its final report. It has not yet said how the attacker first got in.

Because it could not tell which variables were decrypted, Railway sent the keys it stored for all users to upstream providers such as GitHub, GitLab, Anthropic, OpenAI, OpenRouter and Stripe so they could revoke them. Railway says more than 100,000 users were hit by those reset requests, and that a vendor notice alone does not mean a customer’s credentials were affected.

What to do

Railway’s report and changelog ask customers to:

• Rotate sensitive environment variables and API keys stored on Railway, revoking the old ones.
• Remove public network access to databases.
• Review GitHub audit logs and installed GitHub app access, and check container registry logs such as Docker Hub’s.
• Check AI provider accounts for fraudulent spend. Railway says it “is unable to refund customers for spend performed with compromised API keys,” but will escalate requests filed with proof.
• Redeploy the latest commit, reconnect GitHub and recreate CLI and CI tokens, since commits pushed during the pause were not deployed.

Railway says a final report will follow. If you are weighing other hosts, our VPS and app hosting comparison lists prices and plans.