Railway breach exposes decrypted credentials, orders all users to rotate secrets
rohanpaul_ai · x · 2026-10-22
Developer platform Railway disclosed that an intruder accessed encrypted environment variables and decrypted some contents, potentially exposing database passwords, cloud keys and model API keys.
- All users are urged to rotate secrets; Railway froze deployments and reset bucket keys and GitHub tokens itself
- The company ties the intrusion to a string of attacks targeting platforms to compromise AI inference providers, and asked providers to revoke keys
- Days earlier, OpenCode blamed a "distillation attack" for a breach possibly exposing OpenAI, Anthropic and Google keys saved by 1.4% of Console users
- Stolen keys let attackers harvest frontier-model answers for training rivals while victims pay the bills
More from Infra
- Jhaddix: learn to host and tune your own local AI models before it's banned — AIFlow_ML · 2026-10-24
- DeepSeek's 80% gross margin secret is its org structure, not just tech — zephyr_z9 · 2026-10-24
- Kong gateways now carry 500T tokens, growing 140x YoY toward a quadrillion — AccBalanced · 2026-10-24
- AI credit risk hits new highs as Oracle 5Y CDS spikes to ~300 — AccBalanced · 2026-10-24
- Nebius is hoarding GPUs to sell at scarcity prices — funded by a $3.5B 364-day bridge loan — tengyanAI · 2026-10-24
- Spark-X2.6-4B GGUF quantized model trends on Hugging Face under Apache 2.0 — XHToken · 2026-10-24