App hosting platform Railway said on 22 October that it had detected suspicious activity on the systems that store customers' environment variables. The company says a third party may have obtained encrypted variables and, in some cases, their decrypted contents, such as API keys and database credentials. Railway, which has about 4.8 million users, is asking everyone to rotate secrets and credentials immediately and temporarily paused deployments. The incident is part of a wider series of attacks on AI inference providers, which were told to revoke their keys.

What it means: Environment variables are where most development teams keep their most sensitive material: payment keys, database passwords, tokens for AI services and credentials for code registries. When a cloud provider loses control of that data, the problem does not stay with the provider; it travels to every system those keys unlock. For Greek start-ups and software houses using Railway or similar platforms, the practical lesson is that key rotation has to be something you can do in hours, not a project that takes weeks. That requires an inventory of which secrets exist, where they are used and who is able to change them. It is also worth moving towards a secrets manager with short-lived credentials, so that a leaked key expires quickly. The fact that AI inference providers were also targeted shows that keys for AI models now have commercial value to attackers, because they can run up charges on the victim's account. For companies covered by NIS2 or DORA, an incident at a third-party provider like this can also trigger assessment and reporting duties, so documenting every step taken matters.

Read the original on BleepingComputer

Related service: Custom software

Related stories