Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Do cloud providers have a lock-down mode where you can press 1 button and stop all spend?by AJRF
- Jeez, what a rough past 24 hours for all security folk. Hang in thereby DrawTR
- Train wreck. People were writing on discord 3 hours ago, 10 hours after the incident started, that keys created just for railway were running up usage. Meanwhile builds have been down for more than 12 hours. Only NOW did they just send out an email to all customers. I wouldn't have found out until then if I wasn't checking the discord periodically.by alpineman
- I have a bad gut feeling that every day is going to look a bit like today with endless urgent patches and breaches.
Fwiw it sounds similar to the hack over the weekend that opencode suffered.
by martinald - Seen multiple folks in the Railway Discord confirming that their secrets stored in Railway have been used by third parties, so it definitely sounds like the attackers were able to read decrypted environment variables.by MattIPv4
- Right just as I take my first day off (for the entire year!) from work to fly out for a vacation. The mother of all security bombs starts dropping all around stacks and services that I am responsible for. How else could have taken time off go for me…by fbrncci
- Postiz founder posted on X that his service is being brought down, his keys were already used and Railway was quiet about this until he spoke up:
- Crazy day for cybersecurity: PHP RCE, eMudhra certificates, and now Railway.
And it’s all just getting started imo.
by vldszn