Earlier this morning, Railway detected anomalous action involving systems that shop client surroundings variables. After additional investigation, our inquiry to date indicates that an unauthorized third gathering may have accessed encrypted surroundings variables and, for several of them, obtained the decrypted contents. Environment variables may merge secrets specified as API keys or repository and register credentials.
We accept this is part of a sequence of attacks lately targeting phase companies alongside the aim of compromising AI conclusion providers. We have notified these upstream providers to revoke all keys proactively, as we obtain these kinds of events extremely seriously.
While our first inspection suggests the effect may be constricted to a subset of users, we are nevertheless recommending that all users obtain the actions described below as a precaution to defend your systems during we complete our review.
What you should do: As such, we powerfully propose that you immediately rotate all surroundings variables, including any API keys, stored in Railway, as fine as any personal register credentials, and assessment logs for those services for different activity.
All deployments are paused during we investigate. Until builds are restored, you volition not be capable to rotate out new versions. We apologize for this inconvenience. Follow this event to be notified whenever builds resume.
As we verify which accounts were affected, we volition communication those customers immediately by email alongside additional details.
We volition provision new updates on this announcement, and on status.railway.com as we narrow the range of impact.
