Cloud platform Railway, which supports approximately 4.8 million users and hosts over 16 million services, issued an urgent security warning on October 21, 2026, after detecting "anomalous activity involving systems that store customer environment variables". An investigation indicated that "an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents". The company has advised all users to immediately rotate all environment variables.

This incident is critical for developers, as environment variables frequently contain sensitive data such as API keys, database credentials, private registry credentials, and potentially cryptocurrency wallet private keys. The potential exposure of such data could lead to broader security compromises for affected users and their applications.

What the records show

Railway detected the anomalous activity on its systems that store customer environment variables early on October 21, 2026. The company's analysis indicated an unauthorized third party potentially accessed encrypted environment variables and, in some cases, obtained their decrypted values. While Railway's "initial analysis suggests the impact may be limited to a subset of users," the company recommended that all customers take immediate precautionary actions. These actions include rotating all secrets stored as environment variables, such as API keys and private registry credentials, and checking connected service logs for unusual activity. Railway has not disclosed the number of affected users.

The timeline

Railway first detected the anomalous activity on October 21, 2026. The company published a security disclosure on its blog and status page on October 21, 2026, recommending customers