Railway, a cloud development platform that lets developers build applications and services, confirmed that a cyberattack exposed some customer secrets. In a blog post on Wednesday, the company said unidentified attackers may have accessed encrypted environment variables and, for certain cases, obtained the decrypted contents. These variables typically contain passwords, API keys and other credentials that applications use to connect to services such as cloud storage and databases. With that information, an attacker could log in and act as the legitimate user.
Railway’s initial analysis indicates that the breach affected only a subset of its customers, but the firm advised every user to revoke and rotate all API and cloud keys to prevent further abuse. The company temporarily halted new builds and deployments while it investigated, and resumed restoration shortly thereafter. It did not disclose how many users were impacted or the precise cause of the incident, and it declined to comment on whether it received any ransom demands from the attackers.
Founder and chief executive Jake Cooper told TechCrunch that Railway plans to publish a post‑mortem detailing the event. The exact method of the intrusion and the systems compromised remain unclear. Railway suggested the attack may be part of a larger campaign targeting platforms with the goal of compromising AI inference providers, a tactic that involves tricking AI models into leaking sensitive data through malicious prompts.
The breach follows a warning from the U.S. Cybersecurity and Infrastructure Security Agency that China‑based AI firms are conducting large‑scale attacks on American companies to improve their own models. Earlier this week, the open‑source AI coding tool OpenCode reported a similar breach in which hackers stole more than one percent of its customers’ API keys and other secrets, attributing the incident to an AI distillation attack that seeks to extract information from AI models.
Railway’s incident is separate from two critical security flaws disclosed this week in the PHP web programming language, which powers roughly 70 percent of websites. The vulnerabilities, dubbed “PHP2Shell,” prompted a coordinated global effort to release patches on Wednesday. Amazon security researchers said they observed exploitation attempts four days before the patches were made public, indicating that the bugs are already being used in attacks.
The article has been updated with additional information from Railway.