Thursday, October 22, 2026
IT BusinessDigest
Get the Daily Brief
In Brief

Railway secrets breach: what to rotate now, what waits for builds

Most of the cleanup happens at your other providers, and it can start today. Only the redeploys have to wait for Railway's builds to come back.

Morgan Reid Security and infrastructure writer · · 2 min read
Gray steel chain locked on gate

Railway, the cloud app platform, said on October 21 that an unauthorized party may have reached the systems holding customer environment variables and, for some of them, read the decrypted values. Those variables usually hold API keys, database passwords and registry credentials. Railway has not said how the attacker got in or how many customers are affected, and it has told every customer to rotate everything. It believes the attack is part of a series aimed at platform companies, with AI inference providers as the target.

Builds are paused in every region. As of Railway's 03:00 UTC update on October 22 they had not returned, and they will come back in stages: Enterprise first, then Pro, Hobby, Free and Trial. Railway containers read variables only at startup, so a new value in the dashboard does nothing until the service redeploys.

Do now

Revoke keys at the provider. Railway's guide says deleting an OpenAI key "takes effect immediately." For Google Cloud, disable exposed service account keys from the CLI, since the console cannot, and note that tokens already issued keep working for up to an hour. Reset database passwords, and check OpenAI, Anthropic and cloud billing for use you did not make. GitHub tokens that Railway stripped from its registry settings stay valid on GitHub until you revoke them there, Railway warns, so delete them on GitHub.

Wait for builds

Railway has already reset every storage bucket's access keys and invalidated its GitHub connection tokens. Services pick up the new bucket keys only on redeploy, and you have to reconnect GitHub yourself. Buckets have no automatic backups, so note any missing files now.

What IT teams should do

  1. List every secret in Railway variables and revoke each one at its provider today.
  2. Put the new values into Railway now, then redeploy each service as soon as your plan's builds return.
  3. Search provider logs and Railway's audit log for activity your team did not make. Railway has not said when the exposure began, so go back as far as your logs allow. Its own resets show up as "Railway Staff".

Related: GhostAction and GitHub Actions secrets and PHP2Shell patch paths.

Sources