Urgent: Railway Security Disclosure - Rotate Credentials

Railway Logo

Earlier this morning, Railway detected anomalous activity involving systems that store customer environment variables. After further investigation, our investigation to date indicates that an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents. Environment variables may contain secrets such as API keys or database and registry credentials.

We believe this is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers. We have notified these upstream providers to revoke all keys proactively, as we take these kinds of events extremely seriously.

What you should do

* Immediately revoke and reissue all environment variables, including any API keys, stored in Railway.
* If you have any credentials on an external registry, .
* Review logs for those services for unusual activity.

Until builds are restored, you will not be able to roll out new versions. We apologize for this inconvenience. Follow this incident ( https://status.railway.com/incident/QH8L8B3E?utm_campaign=Security+Disclosure%3A+Wednesday+October+21st&utm_content=Security+Disclosure%3A+Wednesday+October+21st&utm_medium=email_action&utm_source=customer.io ) to be notified when builds resume and for further updates.

We will provide new updates on this announcement, and on status.railway.com ( https://status.railway.com?utm_campaign=Security+Disclosure%3A+Wednesday+October+21st&utm_content=Security+Disclosure%3A+Wednesday+October+21st&utm_medium=email_action&utm_source=customer.io ) as we gather all facts about the scope of impact.

Manage email preferences ( https://railway.com/account/notifications?utm_campaign=Security+Disclosure%3A+Wednesday+October+21st&utm_content=Security+Disclosure%3A+Wednesday+October+21st&utm_medium=email_action&utm_source=customer.io )

© 2026 Railway Corp. All rights reserved.

Accession

nse/railway/2026-10-22/4755

From

Railway Support · support@railway.app

Sent

22 October 2026 · 01:00 UTC