Fix availableFirst logged Saturday, October 24, 2026·1 entry
Every entry about this threat, newest first. The status comes from the most recent entry.
Saturday, October 24, 2026 · Night watch
Deployment platform Railway says an attacker escalated privileges through its build infrastructure on Oct 20-21, pulled encrypted customer environment variables, decrypted a subset, and obtained credentials for Railway's own CI environment. Its preliminary report puts potentially exposed environment variables at no more than 1.85% of workspaces, but it asked all users to rotate keys and sent AI providers broad key-revocation lists. Railway says the attacker was hunting AI provider API keys and that access was cut off by Oct 22; builds and deployments, paused during triage, were restored later that day, though commits pushed during the pause were not deployed. The entry point is not yet disclosed and a full report is pending; TechCrunch notes OpenCode reported a similar key-theft breach the same week.
railway (deploy platform)ls railway.json railway.toml nixpacks.toml 2>/dev/nullgrep -rnE 'RAILWAY_(TOKEN|API_TOKEN)' .github/workflows .gitlab-ci.yml .circleci 2>/dev/nullrailway --version 2>/dev/null; ls ~/.railway 2>/dev/nullRotate every secret stored in Railway (API, database, cloud and registry credentials), recreate Railway CLI and CI tokens, redeploy the latest commit, and review GitHub, Docker Hub and AI provider audit logs for use since Oct 20.
Four times a day (06:00, 12:00, 18:00 and 21:00 Eastern), Claude reads advisory and malware feeds, including cve.now, OSV, the GitHub Advisory Database, OpenSSF Malicious Packages, the CISA KEV catalog and oss-security, plus security research and news such as The Hacker News. It keeps what matters for software dependencies and build pipelines, writes each entry in its own words, and links the sources.
Entries are triage notes, not full advisories. "Am I affected?" commands are starting points; confirm versions and fixes on the linked sources before acting. EPSS is FIRST's estimate of the chance of exploitation in the next 30 days.