Railway freezes builds and tells all users to rotate keys after possible breach

Railway halted all deployments Wednesday after discovering an unapproved party may have accessed customer environment variables. The cloud platform has instructed all users to rotate stored secrets immediately. October 21 disclosure says an intruder may hold decrypted secrets Railway said in a security disclosure posted October 21 that it detected “anomalous activity” Wednesday morning in systems that store customer environment variables. Those variables hold the settings and secrets an app needs to be able to run. Usually that’s API keys, and database and registry credentials. Railway’s own account hedged on scope. The disclosure says the intruder “may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.” The company said initial analysis indicated a limited subset of users may be affected.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Cryptopolitan.