Mark Gadala-Maria on X: " BREAKING: RAILWAY has just disclosed MAJOR security ...

Mark Gadala-Maria @markgadala 🚨BREAKING: RAILWAY has just disclosed MAJOR security incident. Customer API keys, database passwords, and other sensitive credentials may have been EXPOSED TO HACKERS. Railway is urging ALL customers to rotate their credentials IMMEDIATELY. And in an extraordinary move, the cloud hosting giant has PAUSED ALL DEPLOYMENTS while it investigates. Here's what we know: → POTENTIAL SECURITY BREACH: Railway detected unauthorized activity involving systems storing customer environment variables. → DECRYPTED SECRETS EXPOSED: Attackers may have accessed encrypted environment variables AND obtained the decrypted contents of some of them. → CRITICAL CREDENTIALS AT RISK: Database passwords, cloud credentials, API keys, and private registry credentials could all be compromised. → ALL DEPLOYMENTS HALTED: Railway has suspended builds and deployments across its platform. Its dashboard and API are also experiencing major disruptions. → EMERGENCY WARNING TO EVERY CUSTOMER: Railway is urging ALL users to immediately rotate stored credentials and investigate suspicious activity. → POSSIBLE COORDINATED ATTACK: Railway believes this could be part of a larger campaign targeting cloud platforms to compromise AI inference providers. → FULL SCOPE UNKNOWN: Railway says the impact may be limited to a subset of users, but it is still investigating. Think how serious this is. The platform developers trust to PROTECT their application secrets may have exposed those very secrets to attackers. And now they're being told to rotate credentials while new deployments are BLOCKED. First PHP. Then Node.js. Then LiteLLM. Now RAILWAY. October 21, 2026 is turning into one of the most alarming days in cybersecurity this year. If you use Railway, take action NOW. Mark Gadala-Maria @markgadala 8h 🚨 BREAKING: Node.js just dropped its OWN security bombshell. 4 HIGH-SEVERITY vulnerabilities patched TODAY, including one that could let hackers remotely execute malicious code on vulnerable servers. → 10 SECURITY FLAWS were addressed in today's Node.js release, FOUR rated 12:00 AM · Oct 22, 2026 · 16.4K Views 7

Mark Gadala-Maria @markgadala 2h Your website could be vulnerable to critical security flaws right now, and you might not even know it. We're offering a FREE security assessment to help identify vulnerabilities before attackers exploit them. Get yours here: lucidsecurity.si 1 Mark Gadala-Maria @markgadala 2h Railway @Railway 4h An urgent notice from the Railway team blog.railway.com/p/security-dis…

Aron Brand @aron_brand 1h rotate your keys and get used to it, i predict critical breaches on a daily basis for the foreseeable future, ai is finding the holes faster than anyone can close them