Railway 因入侵者解密部分凭据要求全体客户轮换密钥

AI 导读

开发平台 Railway 在入侵者解密部分存储凭据后，要求所有客户轮换密钥，并冻结全部部署、重置存储桶密钥和 GitHub token。Railway 称部分用户可能受影响，并将入侵与针对 AI 推理服务商的一系列攻击联系起来，要求相关服务商撤销密钥。

正文 · 原文

Developer platform Railway told every customer to rotate all secrets after an intruder decrypted some stored credentials.

Those environment variables hold database passwords, cloud keys and model API keys, letting anyone holding them sign in as the owner.

Railway said a subset of users may be affected, yet it froze all deployments and reset bucket keys and GitHub tokens itself.

It tied the intrusion to a string of attacks on platforms aimed at AI inference providers, and asked those providers to revoke keys.

Days earlier, OpenCode blamed a distillation attack for a breach possibly exposing OpenAI, Anthropic and Google keys saved by 1.4% of Console users.

Stolen keys let attackers harvest frontier-model answers for training rival models while victims pay the bills.