Incident Report: October 21st Security Attack

Railway reports a coordinated security attack that began with probing on October 18 and entered its systems on October 20 through a previously unknown flaw in build isolation. The attacker partly escaped a shared build machine, obtained a build credential, and used Railway’s self-hosted Temporal system to access some build histories containing customer variables and internal code. Access to Railway’s monorepo helped the attacker identify further routes. An incorrectly configured cloud identity binding then enabled access to short-lived production credentials, an orchestration machine, and credentials connected to Railway’s encrypted-variable database and key-management service. From October 21, the attacker queried for likely AI-provider keys and decrypted some environment variables.

Railway says the attacker was fully expelled by 09:25 UTC on October 21, and that logs indicate variables in at most 1.85% of workspaces - about 100,000 - could have been decrypted; this is an upper bound because the logs identify environments, not specific variables. The company says it found no evidence that customer repositories or snapshots were downloaded, and believes the attacker sought AI-provider credentials for resale and use in model distillation. Railway revoked cloud and static credentials, disabled decryption access, invalidated user sessions and tokens, and twice paused builds while fixing and hardening systems. Builds resumed for all plans on October 22. The report describes the attack’s escalation, forensic limits, customer notifications, and remaining security work.