Railway Security Disclosure

What it is

Railway's notice of 21 October 2026 reports anomalous activity on systems that store customer environment variables. Its investigation so far indicates an unauthorized third party may have accessed encrypted variables and decrypted some of them. Railway says these can hold API keys and database or registry credentials.

Preconditions / Affected

Initial analysis suggests the impact may be limited to a subset of users. Railway has not said which accounts, so it recommends that every user act. It will email customers directly as it confirms affected accounts.

What to do

• Roll all environment variables stored in Railway, including API keys.
• Roll any private registry credentials.
• Review logs for those services for unusual activity.
• Expect no new rollouts until builds resume, because all deployments are paused. Railway says to follow the incident for notice of resumption.
• Watch status.railway.com and the post for updates as the scope narrows.

Caveats

Railway's investigation is ongoing and it says "may have accessed". It does not say how the intrusion happened, how many variables were decrypted, or when builds will resume. It also does not name the attackers or the upstream AI inference providers it notified.