Railway 遭入侵后要求全体客户轮换密钥
Developer platform Railway told every customer to rotate all secrets after an intruder decrypted some stored credentials.
开发者平台 Railway 在入侵者解密部分存储凭证后，要求所有客户轮换全部密钥。这些环境变量包含数据库密码、云密钥和模型 API 密钥，持有者可以以所有者身份登录。Railway 称可能只有部分用户受影响，但自行冻结了所有部署并重置了存储桶密钥和 GitHub token，同时将此次入侵与一系列针对 AI 推理服务平台的攻击联系起来，要求相关提供商吊销密钥。数天前 OpenCode 将一次泄露归因于蒸馏攻击，可能暴露了 1.4% Console 用户保存的 OpenAI、Anthropic 和 Google 密钥。
正文
Developer platform Railway told every customer to rotate all secrets after an intruder decrypted some stored credentials.
Those environment variables hold database passwords, cloud keys and model API keys, letting anyone holding them sign in as the owner.
Railway said a subset of users may be affected, yet it froze all deployments and reset bucket keys and GitHub tokens itself.
It tied the intrusion to a string of attacks on platforms aimed at AI inference providers, and asked those providers to revoke keys.
Days earlier, OpenCode blamed a distillation attack for a breach possibly exposing OpenAI, Anthropic and Google keys saved by 1.4% of Console users.
Stolen keys let attackers harvest frontier-model answers for training rival models while victims pay the bills.