[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-railway-tells-all-users-to-rotate-keys-after-cyberattack":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},12151,"railway-tells-all-users-to-rotate-keys-after-cyberattack","Railway Tells All Users to Rotate Keys After Cyberattack","Hackers decrypted some customer secrets on the vibe-coding platform, and the company wants every user to revoke and replace private keys.","If you deploy anything on Railway, revoke and rotate your private keys now. The company said all of its customers should do so after hackers were able to decrypt some customer secrets.\n\n\"Secrets\" are the credentials a project needs to run: API keys, database passwords, access tokens. Railway, which describes itself as a vibe-coding platform (one where much of the code is generated by AI prompts), stores them for customers in encrypted form. The attackers got past that protection for some of them. \"Rotating\" means generating a new key and cancelling the old one, so a stolen copy stops working.\n\nThe company's wording is the notable part. It asked all users to act, not only those whose secrets were decrypted. That suggests a precaution rather than a precise list of victims, though that is our reading, not something the company has laid out. Also unclear is how many customers were affected and how the attackers got in.\n\nThe practical burden falls on customers. Railway cannot rotate a key issued by a cloud provider, payment processor or database host. Each user has to log in to every connected service, issue a replacement and update their deployments.\n\nBlanket rotation requests are a familiar, if unwelcome, pattern. CircleCI, a continuous-integration service, asked its customers to rotate every secret after a breach in January 2023. In both cases the platform holds the keys to its customers' other systems, which is why one incident can spread. The open question for Railway is whether it will explain how the decryption happened, since that determines how far customers can trust the fix.","[\"railway\",\"cyberattack\",\"secrets-management\",\"vibe-coding\"]","2026-10-22T14:03:00.000Z","2026-10-22T14:26:35.850Z","2026-10-22T14:26:36.086Z","published",null,[],"security",[26,27,28,29],"railway","cyberattack","secrets-management","vibe-coding",[31],{"name":32,"url":33},"TechCrunch","https:\u002F\u002Ftechcrunch.com\u002F2026\u002F10\u002F22\u002Fdeveloper-platform-railway-urges-all-users-to-revoke-secret-keys-after-cyberattack\u002F",0,{"sections":36},[37,42,46,51,56,61,66,71,76,81,86,91,96,101],{"name":38,"slug":39,"count":40,"latest_published_at":41},"AI","ai",7062,"2026-10-22T17:00:39.000Z",{"name":43,"slug":24,"count":44,"latest_published_at":45},"Security",1042,"2026-10-22T15:11:26.000Z",{"name":47,"slug":48,"count":49,"latest_published_at":50},"Policy","policy",570,"2026-10-22T16:00:29.000Z",{"name":52,"slug":53,"count":54,"latest_published_at":55},"Deals","deals",558,"2026-10-22T13:00:00.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Hardware","hardware",287,"2026-10-22T16:18:47.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Consumer Tech","consumer-tech",281,"2026-10-22T14:09:11.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Science","science",214,"2026-10-22T14:59:28.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Startups","startups",142,"2026-10-22T16:05:08.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Software","software",138,"2026-10-22T04:52:10.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Dev Tools","dev-tools",122,"2026-10-21T16:00:00.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"General","general",96,"2026-10-22T16:00:00.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"Gaming","gaming",86,"2026-10-22T13:17:59.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]