Skip to content
Railway Security Incident: Unauthorized Access to Customer Environment Variables

Railway Security Incident: Unauthorized Access to Customer Environment Variables

First seen 22 Oct 2026, 16:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 17:47 UTC
  • •Unauthorized access to customer environment variables may have occurred.
  • •Approximately $371,000 has reportedly been drained from wallets linked to Railway.
  • •Railway has advised all customers to rotate their API keys and has invalidated all tokens.

On October 21, 2026, Railway reported a security incident where an unauthorized third party may have accessed customer environment variables, including API keys and database credentials. Security researcher Taylor Monahan noted that approximately $371,000 was drained from wallets associated with keys stored on Railway. Railway has advised all customers to rotate their keys immediately. The incident is suspected to be part of a series of attacks targeting AI service providers. Railway has not disclosed how the attackers gained access or the specific customers affected. As of October 22, 2026, Railway invalidated all customer API tokens and reset credentials for storage buckets and GitHub connections. The incident follows the release of critical vulnerabilities in PHP services, with many services reportedly unpatched. Railway's terms of service limit liability to $100 for affected customers.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
Railway reports security incident
Railway disclosed unauthorized access to customer environment variables, advising key rotation.
Dennis-Weidner
2026-10-21
Critical PHP vulnerabilities published
Two critical PHP flaws were published, with many services running unpatched versions.
Dennis-Weidner
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-22
Railway invalidates all API tokens
Railway invalidated all customer API tokens as a precautionary measure following the incident.
Cryptoticker

More articles in this cluster (3)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 3

Common questions

What should Railway customers do?
All Railway customers should immediately rotate their API keys and review their logs for any suspicious activity.
How much money was reportedly drained?
Approximately $371,000 has been reported as drained from wallets associated with keys stored on Railway.
What vulnerabilities were released around the same time?
Two critical PHP vulnerabilities were published on October 21, 2026, which may affect many services using PHP.