Railway is urging customers to replace sensitive credentials stored on its hosting platform after attackers gained access to internal systems and decrypted some customer secrets. Those credentials can unlock connected services, including AI tools and databases, even when a hosted website appears to be running normally.

The company’s October 22 preliminary report estimates that up to 1.85% of workspaces, about 100,000, had some environment variables potentially compromised. Environment variables are settings applications read when they run, and often contain passwords or access keys.

A working website doesn’t show whether its keys are safe

Railway says existing customer applications stayed online during the incident, while new builds and deployments were paused.…