🧰 Railway

The items that name it 19

• Northflank security breach leads to abuse of customers' AI API keys
  articleas affected products2026-10-31It is written here as Railway (incident with potential exposure of decrypted customer environment variables).

  incident with potential exposure of decrypted customer environment variables

• “Black October” for AI Developer Platforms
  writeupas affected products2026-10-30
• Ricardo Arguello (@RicardoIQSource) on X
  threadas affected products2026-10-26It is written here as Railway (same target as the other breaches: AI keys; details are in the linked post).

  same target as the other breaches: AI keys; details are in the linked post

• Bye Bye Brotli? Google's Compression Library Is a Security Mess
  articleas classification.key entities2026-10-25
• Rafter (@RafterSecurity) on X
  threadas classification.technologies2026-10-23
• Preliminary Report Oct 21st Security Incident
  advisoryas classification.technologies2026-10-23
• In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
  articleas classification.key entities2026-10-23
• Daily Vibe Casting (@vibecastingapp) on X
  threadas classification.key entities2026-10-22
• Unboxing Phishing Kits: Huntress Examines 3 Real Kits
  articleas classification.technologies2026-10-22
• Railway Security Disclosure
  advisoryas classification.technologies2026-10-21
• Huntress Tragic Quadrant: Top Cyber Threats Wrecking Businesses
  articleas affected products2026-10-01

  Legitimate developer platform used by attackers to host token-harvesting infrastructure for device code phishing, unflagged by most security teams

• Device Code Phishing Keeps Evolving. Here’s What to Watch For
  writeupas tools2026-07-31

  Platform-as-a-service built for 'vibe coding' that was used as legitimate-looking infrastructure for an earlier wave of device code phishing attacks linked to EvilTokens.

• Conditional Access Misconfigurations Exposed 55 Orgs with MFA On
  articleas classification.key entities2026-07-09
• We Need to Talk About Device Code Phishing
  articleas classification.key entities2026-06-22
• How EvilTokens Turbocharges Old School Phishing with AI
  articleas tools2026-05-11

  Legitimate Platform-as-a-Service (PaaS) infrastructure ('built for vibe coding') abused by attackers to relay device code phishing logins; same cloud IP address hit 50 organizations in a single week.

• Social Engineering Leveled Up. Has Your Security Program?
  articleas affected products2026-05-01It is written here as Railway (cloud deployment platform).

  Legitimate platform weaponized by EvilTokens to stand up credential-harvesting infrastructure

• Attackers Didn’t Wait for AI. They Built Workflows Around It.
  articleas tools2026-04-22

  Cloud platform abused by attackers to spin up session token theft infrastructure on demand, impacting hundreds of organizations globally in a matter of weeks (cited as used in a 2026 device code phishing campaign)

• Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure
  writeupas classification.technologies2026-03-23
• Weekly Research Brief: PHP Vulnerability; Objections to OKX-ICE’s Stock Tokenization; Solana Alpenglow Ships
  articleas classification.key entities