Railway potentsial buzilishdan so'ng dasturchilarni maxfiy kalitlarni aylantirishga chaqirdi

Bill Toulas

2026-yil 22-oktabr

17:25

Bulutli xosting provayderi Railway ushbu haftaning boshida mijozlar muhit o'zgaruvchilarini saqlaydigan tizimlarida shubhali faoliyatni aniqlaganidan so'ng foydalanuvchilarga shoshilinch ogohlantirish e'lon qildi.

Kompaniya o'z tekshiruvi natijalariga ko'ra, ba'zi hollarda ruxsatsiz uchinchi tomon shifrlangan muhit o'zgaruvchilariga kirishgan va ularning ba'zilari uchun shifrlangan mazmunni olgan bo'lishi mumkinligini aytadi va barcha foydalanuvchilardan maxfiy kalitlar va hisob ma'lumotlarini faol ravishda aylantirishni so'raydi.

"Bugungi kunga qadar o'tkazilgan tekshiruvimiz natijalariga ko'ra, ruxsatsiz uchinchi tomon shifrlangan muhit o'zgaruvchilariga kirishgan va ularning ba'zilari uchun shifrlangan mazmunni olgan bo'lishi mumkin", — deydi Railway.

"Muhit o'zgaruvchilari API kalitlari yoki ma'lumotlar bazasi va registratsiya hisob ma'lumotlari kabi maxfiy ma'lumotlarni o'z ichiga olishi mumkin", — deb aniqlaydi kompaniya.

Railway dasturchilar ilovalar, API'lar, ma'lumotlar bazalari va turli orqa tomon xizmatlarini joylashtirish va ishga tushirish uchun bulutli platformadir. Uning taxminan 4,8 million foydalanuvchisi bor va 16 milliondan ortiq xizmatni joylashtiradi.

Xizmat joylashtirish bilan bog'liq konfiguratsiya sozlamalari va hisob ma'lumotlarini muhit o'zgaruvchilarida saqlaydi, bu esa hodisa natijasida fosh bo'ldi.

Railway hodisa AI xulosa provayderlariga qaratilgan hujumlar seriyasining bir qismi ekanligini va ular bevosita xabardor qilingan hamda ehtiyot chorasi sifatida barcha kalitlarini bekor qilish tavsiya etilganini aytdi.

AI xulosa provayderlari — bu AI modellarini ishga tushiradigan va Railway'da joylashtirilgan ilovalarga javob qaytaradigan xizmatlardir.

Dastlabki tahlil faqat foydalanuvchilarning kichik bir qismi ta'sirlangan bo'lishi mumkinligini ko'rsatsa-da, Railway barcha foydalanuvchilardan platformada saqlanadigan muhit o'zgaruvchilari va maxfiy ma'lumotlarni, shu jumladan shaxsiy registratsiya hisob ma'lumotlarini zudlik bilan aylantirishni va tegishli xizmat jurnallarini g'ayrioddiy faoliyat uchun tekshirishni so'raydi.

Railway shuningdek, tekshiruv yakunlanguncha barcha joylashtirishlar to'xtatilganini, shuning uchun foydalanuvchilar bu vaqtda yangi versiyalarni chiqarish mumkin emasligini aytdi.

So'nggi holat sahifasi yangilanishiga ko'ra, 22-oktabr soat 08:44 UTC holatiga ko'ra, Railway Pro va Enterprise ish maydonlari uchun qurilishlarni tiklagan, ammo joylashtirishlar hali ham kechiktirilgan va ko'plari navbatda qolgan.

Hobby, Free va Trial ish maydonlari uchun qurilishlar hali tiklanmagan, tiklanish shu tartibda rejalashtirilgan.

Railway o'z hisoblari buzilgan deb tasdiqlangan foydalanuvchilarga bevosita xabar berishini va qo'shimcha tafsilotlar taqdim etishini aytdi.

Hujumchilar haqiqiy hisob ma'lumotlariga ega bo'lgach, ularning harakatlarining faqat 37 foizi bloklanadi

Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy hisob ma'lumotlaridan foydalanganda, oldini olish keskin pasayadi.

Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnikadan texnikaga himoyani o'lchaydi.

Hisobotni oling

Tegishli maqolalar:

Yuzlab sizib chiqqan AWS kalitlari korporativ hisoblar ustidan to'liq nazorat beradi

Google Chrome Gemini yordamida firibgarlikni aniqlashni qo'shdi, foydalanuvchilarni ClickFix hujumlaridan ogohlantiradi

Yaponiyaning Onamae Desktop Cloud buzildi, 27 000 tagacha server ta'sirlandi

OpenAI agentlari xavfsizlik monitoringini o'chirib qo'yishdi, biri bu haqda yolg'on gapirdi

O'g'irlangan UpdraftCentral kalitlari WordPress saytlarini orqa eshik bilan ta'minlash uchun ishlatildi

The original text is in EN, taken from the source site. Source ↗

Railway warns devs to rotate secrets after potential breach

By Bill Toulas

October 22, 2026

05:25 PM

Cloud hosting provider Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week.

The company says its investigation indicates that, in some cases, an unauthorized third party may have obtained decrypted variables and urges all users to proactively rotate secrets and credentials.

“Our investigation to date indicates that an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents,” Railway says.

“Environment variables may contain secrets such as API keys or database and registry credentials,” the company clarifies.

Railway is a cloud platform for developers to deploy and run applications, APIs, databases, and various backend services. It has around 4.8 million users and hosts more than 16 million services.

The service stores deployment-related configuration settings and credentials in environment variables, which the incident exposed.

Railway says the incident was part of a series of attacks targeting AI inference providers, which were notified directly and advised to revoke all their keys as a precaution.

AI inference providers are services that run AI models and return answers to Railway-hosted applications.

Although initial analysis suggests only a subset of users may be affected, Railway urges all users to immediately rotate environment variables and secrets stored on the platform, including private registry credentials, and check associated service logs for unusual activity.

Railway also said it has paused all deployments until the investigation completes, so users cannot roll out new versions during this time.

According to the latest status page update, as of October 22 at 08:44 UTC, Railway had restored builds for Pro and Enterprise workspaces, but deployments remained delayed, with many queued.

Builds had not yet resumed for Hobby, Free, and Trial workspaces, with restoration planned in that order.

Railway said it will directly notify users whose accounts are confirmed to be compromised and provide further details.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report

Hundreds of leaked AWS keys give full control over corporate accounts

Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks

Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected

OpenAI agents disabled safety monitoring, one lied about it

Stolen UpdraftCentral keys used to backdoor WordPress sites