If your website, app or API runs on Railway, treat today as a key-rotation day. On 21 October 2026 Railway published a security disclosure saying it had detected anomalous activity involving the systems that store customer environment variables.
According to Railway, an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents. Railway says its analysis so far suggests the impact may be limited to a subset of users, but it still recommends that all users act. It did not publish how many users are affected or what the root cause was.
What Railway recommends
From Railway's disclosure:
- Roll all environment variables stored in Railway, including API keys and private registry credentials.
- Review logs for those services for unusual activity.
- Expect an email from Railway if your account is confirmed as affected.
Railway also said it believes this is part of a series of attacks aimed at platform companies, with the goal of compromising AI inference providers, and that it has asked upstream providers to revoke keys proactively. As of 22 October, The Hacker News reported that Railway had rotated its own bucket credentials, invalidated Railway API tokens and restored builds for Pro and Enterprise workspaces, with other plans still being worked on. Check the Railway status page for current details, because they are changing quickly.
The Hacker News also cited a security researcher who reported that cryptocurrency wallets whose private keys were stored on Railway had been drained. Treat that as reported and not confirmed by Railway.
Why environment variables matter so much
Environment variables are where most apps keep the keys to everything else: database passwords, payment gateway keys, email and SMS provider keys, cloud storage keys and AI provider keys. If a key leaks, an attacker can use it exactly as your app would, from anywhere, until you revoke it.
What to do this week (works on any platform)
- List every secret. Open your platform's variables page and write down each key and where it came from (database, payment provider, email service, cloud account, AI provider).
- Rotate in order of damage. Start with database and cache passwords, then payment keys, then cloud access keys, then email, SMS and AI provider keys.
- Rotate one at a time. Create the new key, put it in your app's variables, redeploy, test, then revoke the old key. This avoids downtime.
- Rotate signing secrets too. Session and JWT signing keys, and webhook secrets. Expect users to be logged out once.
- Check provider dashboards for strange use. Look for unfamiliar API calls, new access keys, new team members, unexpected cloud spend or unfamiliar AI model usage.
- Check access logs on your database and storage for logins from unknown IP addresses.
- Never keep wallet or signing keys in plain environment variables. Use a dedicated secrets manager or a hardware-backed key store where you can.
- Turn on alerts. Set billing alerts and per-key usage limits with your cloud and AI providers so abuse shows up fast.
- Write down what you rotated and when. It makes the next incident much faster.
If you also run PHP or Node.js, this is a good week to update those runtimes as well. See our guides on the PHP2Shell patch and the Node.js October 2026 security release, and our website maintenance checklist for a routine that keeps this from piling up.
Not sure which keys your app uses, or want help rotating them safely? Talk to Susraj Tech.
Frequently asked questions
Do I have to rotate secrets if Railway has not emailed me?
Railway recommends it for all users as a precaution while it confirms which accounts were affected.
Will rotating a key break my site?
Not if you create the new key, update your app and test it before revoking the old one.
Sources
- Railway: Security Disclosure, Wednesday October 21st
- Railway status page: incident updates
- The Hacker News: Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation
- TechCrunch: Developer platform Railway urges all users to revoke secret keys after cyberattack
Last reviewed 22 October 2026. This article is general security information, not a guarantee of protection. Details may change as Railway publishes more information.
