Railway said it detected unauthorized access to systems storing customer environment variables, with an intruder possibly viewing decrypted secrets such as API keys and database credentials for some accounts. The company has paused all deployments during its investigation and is urging all users to rotate environment variables and registry credentials as a precaution, even though it believes impact may be limited to a subset of accounts.
blog.railway.com
· 2026-10-21
Developer hosting platform Zeabur disclosed that attackers used leaked internal credentials stored in plaintext to break into its shared clusters, dedicated servers and internal systems between October 14-15, 2026, eventually reading its production database. The breach exposed over 3.2 million environment-variable records and data for 321,810 accounts, with attackers gaining root access to 101 GCP servers, adding SSH keys to 50 servers, and attaching 16 customer disk copies to their own virtual machines. This follows an earlier August 2026 breach in which hackers exploited a flaw in a customer's application to steal AWS credentials and access the same production database.
bleepingcomputer.com
· 2026-10-20
GoKawiil