Railway infrastructure compromised; API keys actively being drained — immediate key rotation required.
Security & Exploits ·
Railway's infrastructure has been compromised, with attackers actively extracting API keys in real time, according to a developer account. The incident has disrupted deployments on the platform. While the affected account holder reported minimal financial loss, the ongoing nature of the attack underscores immediate risk to users whose credentials remain exposed.
Users of Railway are being urged to rotate all API keys without delay rather than waiting for redeployment cycles. The active draining of keys suggests attackers maintain ongoing access to the platform's authentication system, creating a window of vulnerability for any account whose credentials have not yet been cycled.
It remains unclear how the initial compromise occurred, whether the breach is limited to specific accounts or affects Railway's infrastructure broadly, and what remedial steps the platform operator has taken to revoke attacker access or secure authentication systems.