Railway says stolen customer AI keys drove $740,000 in unauthorized charges
An attacker decrypted secrets in at most about 100,000 workspaces; Railway will cover some charges providers will not refund.
Stories per day · 30 days
2 RSS
Relatedrailway2secrets2api-keys1container-escape1credential-theft1cryptocurrency1llmjacking1unauthorized-charges1
4 stories, newest first · one card per story
Stories tagged #paas
Railway says intruder may have read customer environment secrets
A subset of Railway users may have had decrypted API keys and credentials exposed; the company urges rotation and has revoked its own tokens.
VU#280377: Dokploy is vulnerable to OS command injection
CERT/CC details an OS command injection in Dokploy letting authenticated users execute commands as root; patched in 0.29.13.
1
Outsider Phishing Kit Survives Takedown With 700 New Pages
Group-IB found the Outsider phishing kit kept generating 700+ new phishing pages within a month of Operation Ghost Hook's takedown.