In this article
  1. What happened
  2. Why it matters
  3. What to do now
  4. What’s still unknown

TL;DR: Railway, the app hosting platform, said on October 21, 2026 that “an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.” Railway says those variables can hold API keys and database and registry credentials. It says the impact may be limited to a subset of users, but it recommends that every user roll all environment variables stored in Railway, including API keys and private registry credentials, and review logs for unusual activity. Railway has paused all deployments while it investigates, so you can’t roll out new versions until builds come back.

What happened

Status as of Oct 22, 2026, 7:12 a.m. Manila (Oct 21, 23:12 UTC): Railway’s status page lists the incident as “Identified,” with builds in all four listed regions, the API and the support site still marked as a major outage. Railway’s latest update, at 22:45 UTC (6:45 a.m. Manila), says it is revoking all existing storage bucket credentials. Builds are still paused. This is a moving story; we’ll update it.

Railway’s security disclosure, by Jacob Cooper, was published at 20:44 UTC on October 21 (4:44 a.m. Manila on October 22). Railway says:

  • “Earlier this morning,” it “detected anomalous activity involving systems that store customer environment variables.” The post doesn’t give a time or time zone for that.
  • Its investigation so far “indicates that an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.”
  • “We believe this is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers.” Railway says it has “notified these upstream providers to revoke all keys proactively.” It doesn’t name the providers.
  • Its “initial analysis suggests the impact may be limited to a subset of users,” but it recommends the steps below for all users “as a precaution.”
  • It will email affected customers directly as it confirms which accounts were affected.

The blog post links to Railway’s status incident, titled “Railway Platform Outage.” Its updates say (times UTC, October 21):

  • 07:24: Railway started investigating an issue. By 09:28 it said the dashboard, API and CLI were unavailable, new builds were paused in all regions and its support site was affected.
  • 19:15 to 20:35: Railway said it would re-enable builds in stages, Enterprise workspaces first, then Pro, Hobby, and Free and Trial. At 20:19 it said it was “invalidating OAuth sessions as part of our mitigation,” so some users will be signed out and need to log in again.
  • 21:59: Railway linked the security notice, recommended that users “revoke all environment variables stored in Railway, including API keys and private registry credentials, and review your service logs for unusual activity,” and said “Deployments remain paused while we investigate, including for Enterprise customers.”
  • 22:10: “We are rotating all Railway bucket credentials in response to the security incident. New credentials will appear in your dashboard automatically.” Railway added that because deployments are paused, you can’t redeploy to pick up the new credentials until builds are restored.
  • 22:37 and 22:45: builds remained paused. Railway said customers may see storage bucket credentials revoked by Railway employee “Faraz Patankar” in their audit logs or activity panel, and that this is expected.

Why it matters

Railway says environment variables can include “API keys or database and registry credentials,” and it believes the attackers were after AI inference providers. Railway also says you can’t update your applications with new credentials while deployments are paused, so the window between rotating a key and running with the new one is set by when Railway restores builds.

What to do now

  1. Revoke and rotate every secret you stored in Railway. Railway recommends that you “immediately roll all environment variables, including any API keys, stored in Railway, as well as any private registry credentials.” Railway says environment variables may contain API keys and database and registry credentials. Revoke each old value with whoever issued it, not just change it in Railway.
  2. Review your logs. Railway recommends you “review logs for those services for unusual activity,” meaning the services those keys and credentials unlock, such as your API providers, databases and registries.
  3. Expect Railway’s own bucket credential changes. Railway says it is rotating all Railway storage bucket credentials and new ones will appear in your dashboard automatically. Revocations by Railway employee “Faraz Patankar” in your audit log or activity panel are expected, Railway says. You can’t redeploy to pick up the new bucket credentials until builds are restored.
  4. Plan for paused deploys. Railway says that until builds are restored, “you will not be able to roll out new versions,” including on Enterprise. It says some users will be signed out and need to log in again.
  5. Watch for Railway’s email and status updates. Railway says it will contact affected customers directly by email and will post updates on its blog and on status.railway.com. Its status page says you can email [email protected], though Railway “may not be able to share more detail than is published here.”

What’s still unknown

Railway hasn’t said how the attacker reached the systems that store environment variables, when the access happened, how many accounts or which variables were affected, or which upstream providers it asked to revoke keys. It also hasn’t said when builds will resume. Its status incident began at 07:24 UTC as a platform outage, and its updates first mention the security incident at 21:59 UTC; Railway hasn’t said how the earlier outage relates to the security incident.

Sources & method

Sources

Method. Last checked October 22, 2026, at 7:12 a.m. Manila time (October 21, 23:12 UTC). Every fact here comes from Railway’s blog post and status page. The blog post’s page metadata says it was last modified at 22:12 UTC on October 21; Railway doesn’t say what changed. Our own inferences: revoking old values with the issuer, the examples of what the credentials unlock in step 2, and the point that rotation timing depends on when builds return. No affiliate links on this page. How we work.

Spotted an error? See our corrections policy and tell us.