Preliminary Report Oct 21st Security Incident

What it is

Railway's preliminary report (page text as of 22 October 2026) on an intrusion into internal systems between 20 October 2026 13:58 UTC and 22 October 2026 03:32 UTC. The attacker decrypted stored environment variables for a subset of workspaces. The forensic investigation is still ongoing and a final report is promised.

Preconditions / Affected

• Confirmed: at most 1.85% of workspaces (about 100,000) had environment variables potentially decrypted.
• The real at-risk group is larger. Railway could not tell which variables were decrypted, so it is also contacting users it judges high risk from the attacker's behavior. Two risk buckets: workspaces with a very large number of environment variables, and environments holding many AI vendor keys.
• Railway recommends that every customer who signed up before 21 October rotate keys stored on Railway.
• Vendor revocation emails do not mean your credentials were hit. Railway sent GitHub and SpaceXSI every API key on the platform, and some vendors revoked all of them.
• Not affected: running deployments stayed online. User accounts were not logged into. Source code access is not ruled out until the final report.

What to do

Railway lists four actions for all customers:

• Remove public network access to databases.
• Rotate any sensitive variables and keys.
• Check GitHub account audit logs and review all app access.
• Check audit logs in registries such as Dockerhub.

Railway says it has published guides for checking anomalous activity and rotating credentials on various tools. Questions go to support@railway.com.

Two side effects to expect: Railway revoked all Railway access tokens and rolled all GitHub App installations. If your GitHub email differs from your Railway email, re-login with "Log in using email".

Caveats

• The exploit method and scale are withheld. The page says the attacker used abliterated models and substantial compute, but gives no technical detail, so there is no way to check whether your own setup shares the weakness.
• Railway's remediation list includes rolling all keys (twice), rolling credentials for all storage buckets, rebuilding internal tooling from validated source, and moving builders from third-generation multi-tenant to fourth-generation single-tenant. It also lists undisclosed mitigations.
• Railway says it delayed telling customers to rotate until the attacker was ejected, to avoid re-compromise. It notified vendors first, from 21 October 09:25 UTC. The FAQ gives 09:35 UTC for the same event.
• Builds were paused during triage and were restored for all tiers at the time of writing. Some functionality was still offline, expected back "in the coming days".