Railway
Railway is a cloud infrastructure and application deployment platform for developers, offering streamlined application hosting, database management, and continuous deployment services. Users can deploy code to the cloud through the platform without manually configuring complex server infrastructure. Railway centers on developer experience, supports multiple programming languages and frameworks, and is suited for personal projects and small-team application deployment and operations.
Timeline (last 90 days)
The attribution for the prolonged deployment unavailability in the Railway incident (platform operational capability vs. a pure hacker attack) comes from a single source's personal experience and needs more independent evidence.
In the Railway incident, attackers accessed encrypted environment variables and decrypted part of the contents, which may have included API keys and database credentials, while deployment services were unavailable for an extended period.
Railway and OpenCode suffered real intrusion incidents, with API keys stolen and deployment environments compromised.
Railway is often categorized as a "vibe-coding" platform, emphasizing rapid deployment and low operational burden.
Railway's architecture stores user secrets in encrypted form, so in theory the platform itself cannot directly read the plaintext.
Railway did not disclose the specific number of affected users.
The Railway platform issued an urgent security notice requiring all users to immediately revoke and rotate their private keys.
The hackers successfully decrypted the confidential information of some Railway customers.
For teams using Railway, the most urgent task right now is completing key rotation, not waiting for more information to be disclosed.
Railway has not yet disclosed the full technical details of the attack or the specific scope of affected users.
40 more timeline events
All Facts (20)
Vercel、Railway、Render等新一代部署平台大幅降低了个人开发者和小团队的运维门槛
85%UnverifiedVercel、Netlify、Railway、Render等零配置部署平台提供了'代码上传即上线'的体验，免费套餐足以支撑个人项目长期运行
85%UnverifiedThe attribution for the prolonged deployment unavailability in the Railway incident (platform operational capability vs. a pure hacker attack) comes from a single source's personal experience and needs more independent evidence.
50%UnverifiedRailway is often categorized as a "vibe-coding" platform, emphasizing rapid deployment and low operational burden.
50%UnverifiedRailway did not disclose the specific number of affected users.
50%UnverifiedRailway's architecture stores user secrets in encrypted form, so in theory the platform itself cannot directly read the plaintext.
50%UnverifiedFor teams using Railway, the most urgent task right now is completing key rotation, not waiting for more information to be disclosed.
50%UnverifiedRailway has not yet disclosed the full technical details of the attack or the specific scope of affected users.
50%UnverifiedThe hackers successfully decrypted the confidential information of some Railway customers.
50%UnverifiedRailway is a developer-oriented cloud application deployment platform that supports rapid deployment of online services from code repositories, and it belongs to the PaaS (Platform as a Service) category.
50%UnverifiedCompeting platforms in the same PaaS category as Railway include Render, Fly.io, and Vercel.
50%Unverified8 of the 12 takedowns never produced a public GitHub DMCA notice, because these ports ran on their own domains or on hosting services such as Railway and Cloudflare Pages.
50%UnverifiedRailway CEO Jake Cooper said on The Register that if an agent has authenticated and called a delete, we will honor that request.
50%UnverifiedRailway maintains two kinds of backups: user-scheduled backups on the dashboard, and disaster backups retained off-site regardless of settings; the old API path performed a cascading delete that made user backups appear unavailable in the UI, and Railway says it will now delay deleting the backups themselves.
50%UnverifiedRailway's authentication guide says the me query only resolves for account tokens, and that authorization failures are returned as HTTP 200 with an errors array.
50%UnverifiedRailway says the customer is back up and running with data intact, but Crane told Decrypt there are still significant data gaps and that he has hired a lawyer.
50%UnverifiedThe agent found a Railway API token in an unrelated file; the token had originally been created to add and remove custom domains via the Railway CLI, but it could perform any operation, including destructive ones.
50%UnverifiedRailway has four types of API credentials, from broadest to narrowest: account-level, workspace-level, project-level and OAuth.
50%UnverifiedRailway's backup documentation explicitly states in one case that erasing a volume deletes all backups.
50%UnverifiedRailway's official postmortem states that before this week, the GraphQL volumeDelete mutation called via the API would execute the deletion immediately and could not be undone, whereas the same operation on the dashboard had long had a 48-hour undo window.
50%