Railway discloses Oct 21 breach: misconfigured OIDC binding exposed cloud credentials
letandrewcook · x · 2026-11-11
Cloud platform Railway published a detailed report on the October 21st security attack: after scanning the codebase for escalation paths, the attacker found an erroneously defined OIDC binding configuration and used it at 03:26 UTC to obtain short-lived production cloud credentials.
Those credentials exposed two internal secrets: a longer-lived credential that, combined with VPC access, could read encrypted env variables from a production database, and an SSH private key used by the CD system to push binaries to machines partially connected to that VPC. The takeaway: internal tooling now demands the same rigor as external-facing systems.
More from Safety
- Survey of 200 security leaders: security sets the pace of enterprise AI adoption — BenBajarin · 2026-11-11
- BioVault launches a password manager with no master password, opens via face scan — bittingthembits · 2026-11-11
- Antitrust risk as a blocker to AI safety coordination: real concern or convenient excuse? — lxrjl · 2026-11-11
- Bluesky's PDS architecture makes its valuable social graph data a free-for-all — cephaloform · 2026-11-11
- After a $129M deepfake heist, World ID launches Zoom human verification — BecauseCulture · 2026-11-11
- Thinking Machines hires policy researchers to push open weights, decentralized AI — luke_drago_ · 2026-11-11