Technology · 2026-10-22 · Afternoon briefing

Railway freezes apps, tells all users to rotate keys after breach

The developer platform Railway has paused all customer deployments, effectively freezing websites and apps, after confirming a cyberattack. The company stated on Wednesday that unidentified hackers may have accessed encrypted environment variables and successfully decrypted some of them. It has urged all users to rotate their API and cloud keys as a precaution against a broader data breach.

The incident follows a similar attack earlier this week on OpenCode, an open-source AI coding tool, in which hackers stole more than 1% of its customers' API keys. It also comes shortly after the U.S. cybersecurity agency, CISA, warned that AI companies based in China are conducting large-scale attacks on US firms with the aim of improving their own models.

Railway's breach appears unrelated to two critical vulnerabilities in the PHP programming language, dubbed 'PHP2Shell', disclosed this week. While patches for that bug were released on Wednesday after a coordinated global effort, security researchers at Amazon found evidence of it being actively exploited four days before the fixes were made public.

Summary written by Cup of News with AI from the sources below. Check the originals for the full story.

Read the sources

• Railway freezes builds and tells all users to rotate keys after possible breach

More stories in this edition

1. Two killed in Houthi attack on eastern Saudi airport
2. Flooding from Storm Adam leaves four dead in France
3. Germany arrests Ukrainian man suspected of spying for Russia
4. AI's thirst for water sparks backlash in South America
5. Fusion firm Helion wins $175m for power-doubling chips
6. Nasdaq drops 2.1% on AI spending fears, oil price jump
7. Japan to arrange $6.35bn in private investment for Bangladesh
8. Senegal faces general strike over disputed new labour laws
9. Ebola spreads to Nigeria as Kenya hunts for missing contact

Read the whole edition