Security notice
Site or store on Railway? Your payment and database keys may be exposed. Rotate them today.
On October 21, 2026, hosting platform Railway disclosed that an unauthorized third party may have accessed customers' encrypted environment variables and, for some of them, obtained the decrypted contents. Environment variables are where apps usually keep their most sensitive keys: payment provider keys such as Stripe, database passwords and email or API keys. Railway says the impact may be limited to a subset of users, but it recommends that all users immediately rotate every secret stored in Railway. If your website, store backend or app runs on Railway, treat those keys as exposed and replace them today.
What happened
- The breach. Railway says it detected anomalous activity involving the systems that store customer environment variables, and that an unauthorized third party may have accessed encrypted variables and obtained the decrypted contents of some. Railway says these can include "API keys or database and registry credentials." (Railway)
- Who was behind it. Railway believes it is part of a series of attacks on platform companies aimed at AI service providers, and says it has asked those providers to revoke keys. (Railway)
- What Railway has done. Railway paused all deployments while it investigated, reset storage bucket credentials and the GitHub tokens it held, and invalidated all Railway API tokens. As of 2:30 PM ET on October 22, Railway said builds were running again for Pro and Enterprise workspaces, with Hobby, Free and Trial still to follow. (Railway status)
- Who will hear from Railway. Railway says it will email the customers it confirms were affected. Do not wait for that email. Railway recommends every user act now. (Railway)
Who should worry
- Your website, online store backend, booking system or app runs on Railway.
- Your agency or developer hosts client projects on Railway.
- You are not sure where your developer hosts your app. Ask.
A stolen payment key can let someone read your customer and payment records, issue refunds or tamper with payouts. A stolen database password can expose customer records. Railway's own Stripe guide tells users to check for charges, refunds, payouts and bank accounts they do not recognize. (Railway Stripe guide)
What to do now
Do these today.
- Ask the question. Send the message below to your developer or agency. You need a clear yes or no: does anything we run live on Railway?
- Rotate every secret stored in Railway. Start with payment keys (Stripe and others), then database passwords, then email, shipping and other API keys. Rotating means creating a new key and turning the old one off. (Railway)
- Redeploy so your app uses the new keys. Then confirm the old keys no longer work.
- Check for misuse. In Stripe, look at request logs for the old key and at payments, refunds, payouts, bank accounts, webhooks and team members you do not recognize. Check database and email logs too. (Railway Stripe guide)
- Create new Railway API tokens and reconnect GitHub if you use them. Railway has already turned the old ones off. (Railway status, Railway)
What to send your developer or agency
On October 21, 2026, Railway disclosed that an unauthorized third party may have accessed customers' encrypted environment variables and decrypted some of them. Railway recommends that all users immediately rotate every environment variable and API key stored in Railway, plus private registry credentials, and review logs for unusual activity. Please confirm whether any of our sites, stores or apps run on Railway. If so, please rotate all secrets today, starting with payment provider keys and database passwords, redeploy, check the old keys' logs for misuse, and tell us what you find. Sources: Railway, Railway status.
Technical steps
Step 1. List every variable in every Railway service and environment, including shared variables.
Step 2. Rotate at the provider first (Stripe, database, email, cloud storage), then update the Railway variable and deploy. Stripe lets you rotate a key with an overlap window; for a confirmed leak, Railway's guide says to expire the old key now. (Railway Stripe guide)
Step 3. Redeploy services that use storage buckets to pick up the new bucket credentials Railway generated. Reconnect GitHub. (Railway)
Step 4. Review provider logs for activity from unfamiliar IP addresses, and check the Railway audit log. Railway publishes guides for Stripe, PostgreSQL, MySQL, MongoDB, Redis, AWS, Google Cloud, GitHub and AI providers on its status page. (Railway status)
Common questions
Has my business been hacked?
This notice does not mean your business has been hacked. Railway says its initial analysis suggests the impact may be limited to a subset of users, and it will email those it confirms. (Railway) But Railway recommends that every user rotate their secrets as a precaution, and so do we.
Can EverThread tell me if I am affected?
No. EverThread checks websites from the outside, the way a browser sees them. We cannot see your hosting account, your environment variables or your payment provider's logs, so we cannot tell whether your keys were exposed or used. Your developer and your payment provider can check that. Our free scan looks at your home page from the outside for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.
My site is not on Railway. Do I need to do anything?
Not for this incident. If you are not sure where your site or app is hosted, ask your developer.
Where can I follow official updates?
Railway's security disclosure and its status page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Railway: Security Disclosure: Wednesday October 21st, October 21, 2026
- Railway status: Railway Platform Outage, updated October 22, 2026
- Railway: Security Disclosure Recommendation: Check for Unexpected Usage in Stripe, October 22, 2026
- Railway: Security Disclosure Recommendation: Redeploy Buckets and Reconnect GitHub After the Credential Reset, October 22, 2026