It’s not just the PHP vulnerability — major internet companies are reporting breaches in their infrastructure.

Cloud deployment platform Railway has disclosed a security incident, saying an unauthorized third party may have accessed customer environment variables — potentially including API keys, database credentials, and private registry credentials — and has paused all deployments across the platform while it investigates.

What happened

In a post titled “Security Disclosure: Wednesday October 21st,” Railway said it detected anomalous activity involving the systems that store customer environment variables earlier that morning. Environment variables are how developers typically configure applications deployed on platforms like Railway, and they frequently contain sensitive secrets: API keys, database connection strings, and credentials for private package registries.

Railway’s investigation so far indicates that the unauthorized party “may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.” The company was careful to note that its initial analysis suggests the impact may be limited to a subset of users, but it’s nonetheless recommending that all customers take precautionary action while the review continues.

Railway said it believes the incident is “part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers,” and that it has already notified upstream providers to proactively revoke potentially exposed keys. The company hasn’t disclosed how the unauthorized access occurred or named the affected upstream providers.

What is Railway, and how big is it?

Railway is a San Francisco-based cloud deployment platform founded in 2020 by CEO Jake Cooper. It lets developers deploy and run applications without managing the underlying infrastructure themselves, bundling compute, managed databases (PostgreSQL, MySQL, MongoDB, Redis), persistent storage, networking, and load balancing into a single platform that bills by the second for actual usage rather than charging for idle virtual machines. Railway serves roughly two million developers and handles more than 10 million deployments a month, with usage from close to a third of Fortune 500 companies. Railway raised a $100 million Series B earlier this year.

What Railway is telling customers to do

Railway is urging all users to immediately roll every environment variable stored on the platform, including API keys and any private registry credentials, and to review logs for those services for signs of unusual activity — regardless of whether they’ve been told they’re affected.

Complicating that advice somewhat: Railway has paused all deployments while it investigates, meaning customers can’t currently roll out new builds to pick up rotated credentials. The company says it’s working to restore builds and is tracking the issue on its status page, where customers can follow updates as deployments resume. Railway says it will reach out directly by email to any customers confirmed to be affected as the investigation narrows down the scope of impact.

Part of a bigger pattern

Railway’s framing — describing this as one of several recent attacks aimed at platform companies that sit upstream of AI inference providers — points to a pattern that’s shown up elsewhere in the developer tooling ecosystem this month. A separate breach at OpenCode, for instance, exposed API keys for several major AI providers in what researchers described as a credential-theft and “distillation” attack, and other reports this month have flagged secrets exposure at AI platforms including Fireworks AI. Taken together, these incidents suggest attackers are increasingly targeting the infrastructure layer where developers store and manage credentials for AI services, rather than the AI providers themselves — a softer target with potentially just as much value if the stolen keys grant access to paid inference accounts.

Railway hasn’t specified a timeline for when deployments will resume or when it expects to complete its investigation. For now, any organization with secrets stored on Railway would be well advised to rotate them as a precaution, even without confirmation that their account was directly affected.