Railway pauses deployments after possible exposure of decrypted secrets
The cloud hosting provider told all users to rotate environment variables and private registry credentials while it investigates.
Cloud hosting provider Railway has paused all deployments and urged every user to rotate their environment variables and secrets after detecting suspicious activity on systems that store customer environment variables earlier this week, according to bleepingcomputer.com. The company said an unauthorized third party may have accessed encrypted environment variables and in some cases obtained their decrypted contents.
Railway advised users to immediately change secrets including private registry credentials. It said the incident was part of a series of attacks targeting AI inference providers, which were notified and advised to revoke all keys.
The company suspended deployments until its investigation is complete. As of October 22 at 08:44 UTC, builds had been restored for Pro and Enterprise workspaces, while deployments remained delayed and queued. Builds had not resumed for Hobby, Free and Trial workspaces.
Platform scale
Railway is a cloud platform that developers use to deploy and run applications, APIs, databases and backend services. According to the company, it has around 4.8 million users hosting more than 16 million services.
Quick answers
What should Railway users do now?
Railway advised all users to immediately rotate their environment variables and secrets, including private registry credentials.
Are Railway deployments working again?
Deployments were paused during the investigation and remained delayed and queued as of October 22 at 08:44 UTC. Builds had resumed for Pro and Enterprise workspaces, but not for Hobby, Free and Trial workspaces.