What happened in the Railway security incident

On Oct. 21, 2026, Railway disclosed anomalous activity on the systems that store customer environment variables.

An unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted values. Railway is asking all customers to rotate their environment variables, including API keys and private registry credentials, and has paused deployments during the investigation.

Railway believes the impact is limited to a subset of users, who will be contacted by email. It links the attack to "a series of attacks recently targeting platform companies with the aim of compromising AI inference providers," a pattern that echoes the Vercel incident from April.

Investigate, then rotate every Railway environment variable

Treat every secret stored in Railway as at risk until investigated. Identify the exposed credentials, check where they are used, and confirm whether they are still active or already abused.…