Since the Google Cloud outage, numerous events have unfolded, and much remains undisclosed. Today, Railway had to shut down its hosting services due to compromised environment files.
I believe and until proven otherwise the AI models escaped and breached the sandbox once again as they say and this time the severity was enormous and beyond control.
if you run any bot, backend, or indexer on Railway: revoke and rotate everything. the phrase "for some of them" is doing a lot of work here, and Railway cannot tell you which ones. assume every key you ever stored there is burned.
BREAKING: @Railway SAYS THAT "AN UNAUTHORIZED THIRD PARTY MAY HAVE ACCESSED ENCRYPTED ENVIRONMENT VARIABLES AND, FOR SOME OF THEM, OBTAINED THE DECRYPTED CONTENTS. ENVIRONMENT VARIABLES MAY CONTAIN SECRETS SUCH AS API KEYS OR DATABASE AND REGISTRY CREDENTIALS"
RECOMMENDS IMMEDIATE ROTATION OF ALL RAILWAY ENVIRONMENT VARIABLES, API KEYS, AND REGISTRY CREDENTIALS
Se você usa Railway rotacione TODAS as suas secret keys imediatamente
Por sorte minha chave do Open Router tinha limite de consumo diário
O que tinha eles consumiram com Opus 5.5 🫠
Every one of my AI API keys from Railway was used by some actors starting this morning. Unbelievable..
against all my will, switching everything to aws with pulumi. just cant handle this railway stuff anymore.
Yeah, they did, but Vercel promptly reported it to everyone and actuslly allowed us to rotate keys.
Railway has been compromised for 12+ hours and we can’t even redeploy apps to rotate keys.
Appreciate the email telling me to act immediately. I’ll get right on that the moment you let me do anything.
I just used Claude to help me scan my railway projects and patch whatever was required … we have no choice at this point
If the exposure was at build time (which does seem to be the attack vector) wouldn't these final output values of your 1Password variables be exposed? Regardless of the layer between them?
昨天是什麼駭客 Holiday 嗎？！
連 Raiway 都中招！
各位朋友們，如果你有使用 Railway 服務，儘速 Rotate 你的伺服器裡面的 Keys
An urgent notice from the Railway team
blog.railway.com/p/security-…
To the people asking for a @Railway alternative: that's not going to solve your problem.
Railway let us know about the issue on the day the issue was detected. Every single alternative you use will eventually be hacked, given enough time in market.
I feel for the Railway team.
An urgent notice from the Railway team
blog.railway.com/p/security-…
