HN

Need help?
<- Back
Railway Security Disclosure

Railway Security Disclosure

passenger

Comments (91)

  • vldszn
    Crazy day for cybersecurity: PHP RCE, eMudhra certificates, and now Railway.And it’s all just getting started imo.https://blog.cloudflare.com/emudhra-certificate-compromisehttps://www.wiz.io/blog/php2shell-php-rce
  • theturtletalks
    Postiz founder posted on X that his service is being brought down, his keys were already used and Railway was quiet about this until he spoke up:https://x.com/wickedguro/status/2113015432974405658
  • fbrncci
    Right just as I take my first day off (for the entire year!) from work to fly out for a vacation. The mother of all security bombs starts dropping all around stacks and services that I am responsible for. How else could have taken time off go for me…
  • MattIPv4
    Seen multiple folks in the Railway Discord confirming that their secrets stored in Railway have been used by third parties, so it definitely sounds like the attackers were able to read decrypted environment variables.
  • martinald
    I have a bad gut feeling that every day is going to look a bit like today with endless urgent patches and breaches.Fwiw it sounds similar to the hack over the weekend that opencode suffered.
  • anon
    undefined
  • 1-6
    It's time for competent programmers to get rehired to help patch massive exploits that are about to unfold before us.
  • fyzix
    How is it possible rotate keys if you disable deployments? You're basically telling us to take our services offline...
  • DrawTR
    Jeez, what a rough past 24 hours for all security folk. Hang in there
  • alpineman
    Train wreck. People were writing on discord 3 hours ago, 10 hours after the incident started, that keys created just for railway were running up usage. Meanwhile builds have been down for more than 12 hours. Only NOW did they just send out an email to all customers. I wouldn't have found out until then if I wasn't checking the discord periodically.
  • AJRF
    Do cloud providers have a lock-down mode where you can press 1 button and stop all spend?
  • minraws
    how are the secrets decrypted, I would like some explanation so that I can have some understanding here, I am starting to feel like all these companies are just meme-ing with their security posture.Like did someone vibe code too hard, how do env secrets leak for everyone...
  • arbayi
    i revoked my api keys, changed with new ones but guess what? railway does not allow deployments at the moment, so my app is down.
  • eecks
    Huh, I've been using Railway tonight and this was the first I've seen of this. Just got an email about it now too at 23:36
  • shinycode
    I’m lucky I moved away from it to host my own db with coolify
  • MattIPv4
  • wateralien
    Is this our new AI daily reality?
  • sergiotapia
    Actually I will move my projects away from Railway. With AI what it is today, no reason to shy away from hosting on actual VPS.What is the best VPS to use today? Is it still hetzner or ovh?
  • gbnwl
    The past two days have been awful as someone who uses Railway.
  • sergiotapia
    If you're on Railway do not wait, ROTATE every API key at the source, and do not set new values because Railway is still compromised and not secured.
  • lijok
    Damn I guess all those l33t hiring practices were for nothing
  • goforbg
    the worst service I've signed up for has to be railway. What a terrible product.
  • Keloran
    Well this is certainly interesting, I wonder how their secrets were being stored, I assumed they were stored in vault and then injected with a sidecar, but I guess not
  • esseph
    Fuck, I thought this was about trains
  • dayyan
    [flagged]
  • paxy
    It’s funny that every security breach disclosure now has a mandatory “the attacker used AI!” as if it absolves you from having to maintain a secure system. If anything it makes the situation more damning. If it was possible to find exploits using AI then your own red teaming should have found them before the attacker did.
  • torben-friis
    >We believe this is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers.Is that an accusation? As in, major AI players taking out competitors ?