Railway pauses deployments after unauthorized access to customer environment variables

On October 22, 2026, cloud hosting platform Railway warned its users that an unauthorized third party may have obtained the decrypted contents of environment variables stored on its platform, including API keys and registry credentials. Rotate all your secrets now, starting with the keys of AI inference providers.