Railway security update: Preliminary report and guidance

Railway Logo

We’re following up on Railway’s October 21 security disclosure ( https://blog.railway.com/p/security-disclosure-wednesday-october-21st?utm_campaign=Remaining+Users+%E2%80%94+Preliminary+Security+Report+%E2%80%94+2026-10-23&utm_content=Remaining+Users+%E2%80%94+Preliminary+Security+Report+%E2%80%94+2026-10-23&utm_medium=email_action&utm_source=customer.io ) to share our preliminary report ( https://blog.railway.com/p/preliminary-report-october-security-incident?utm_campaign=Remaining+Users+%E2%80%94+Preliminary+Security+Report+%E2%80%94+2026-10-23&utm_content=Remaining+Users+%E2%80%94+Preliminary+Security+Report+%E2%80%94+2026-10-23&utm_medium=email_action&utm_source=customer.io ). This is an update on the existing incident, not a new incident.

As of October 23 at 18:57:54 UTC, we have completed the higher-risk notifications arising from our investigation since the initial disclosure on October 21 at 22:36 UTC. 

Your workspace does not meet the criteria we used to identify higher-risk workspaces. You should no longer wait for a higher-risk notification based on our findings to date.

This does not rule out compromise. If you have not already done so, we recommend that you:

* Rotate sensitive credentials — Replace API keys, database passwords, and access tokens that were stored in Railway environment variables during the incident. Revoke the old credentials with their providers.
* Update your Railway variables and redeploy dependent services — Coordinate database credential changes with the applications that use them.
* Review provider activity and audit logs — Check your AI and cloud providers, GitHub ( https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/reviewing-your-security-log?utm_campaign=Remaining+Users+%E2%80%94+Preliminary+Security+Report+%E2%80%94+2026-10-23&utm_content=Remaining+Users+%E2%80%94+Preliminary+Security+Report+%E2%80%94+2026-10-23&utm_medium=email_action&utm_source=customer.io ), and registries such as Docker Hub for unfamiliar access, unexpected usage, or unauthorized changes.

If you have already rotated credentials and revoked the old ones since the incident was contained, you do not need to repeat those completed rotations solely because of this update. Please continue monitoring for suspicious activity.

If new findings change our assessment of your workspace, we will contact you directly. We’re sorry for the incident, the uncertainty, and the burden it has created for you and your organization. For help with rotation or to report suspicious activity, contact support@railway.com ( support@railway.com?utm_campaign=Remaining+Users+%E2%80%94+Preliminary+Security+Report+%E2%80%94+2026-10-23&utm_content=Remaining+Users+%E2%80%94+Preliminary+Security+Report+%E2%80%94+2026-10-23&utm_medium=email_action&utm_source=customer.io ).

Thanks,
The Railway Team

Unsubscribe from marketing emails ( https://railway.com/preferences?token=a2d8789b-5683-419d-a1fd-faec3a03807d&utm_campaign=Remaining+Users+%E2%80%94+Preliminary+Security+Report+%E2%80%94+2026-10-23&utm_content=Remaining+Users+%E2%80%94+Preliminary+Security+Report+%E2%80%94+2026-10-23&utm_medium=email_action&utm_source=customer.io )

© 2026 Railway Corp. All rights reserved.

Accession

nse/railway/2026-10-23/4913

From

Railway · hello@notify.railway.app

Sent

23 October 2026 · 21:00 UTC