[railway]

October 24, 2026

• Railway's preliminary report puts the October breach at roughly 100,000 workspaces (about 1.85%) with encrypted environment variables exposed, some decrypted using compromised credentials. The company says attacker access ran from October 20 13:58 UTC to October 22 03:32 UTC and that the campaign appears aimed at harvesting AI provider API keys for model distillation; everyone who signed up before October 21 should rotate (Railway), expanding on Tuesday's rotation advisory. HN commenter internetter calls the write-up too high-level to explain how the attacker persisted through multiple days of mitigation. (discussion) · Cloud & Identity

in PHP2Shell's Reliability Problem — and a Third, Unpatched PHP Bug

October 23, 2026

• Railway tells all users to rotate secrets. The PaaS (~4.8 million users, 16M+ services) found anomalous activity in the systems storing customer environment variables and says an unauthorized third party may have accessed encrypted variables and, in some cases, obtained decrypted contents. Railway describes the incident as part of a series of attacks on AI inference providers, who were told to revoke keys. BleepingComputer · Supply Chain & Identity

in Two Unpatched KSMBD RCEs Go Public — and an AI Scanner Found Them