Railway Cloud Platform Breach and LLMjacking Campaign

On October 21, 2026, the cloud hosting platform Railway disclosed a significant security breach where an unauthorized third party compromised servers storing customer environment variables. The attackers successfully decrypted sensitive secrets, including database passwords and API keys for payment processors and AI inference providers such as OpenAI, Anthropic, and Grok. Railway noted that this incident appears to be part of a wider coordinated campaign targeting cloud platforms to facilitate 'LLMjacking'—the theft of AI credentials to resell access or run expensive model compute at the victim's expense.

Simultaneously, critical vulnerabilities were disclosed in two foundational web technologies: the 'PHP2Shell' flaws (CVE-2026-109618, CVE-2026-109619) and a Node.js remote code execution flaw (CVE-2026-111497). While no direct link between these vulnerabilities and the Railway breach has been confirmed, their concurrent exploitation window has created a high-risk environment for web-based services. The breach has already led to service shutdowns for some developers and reports of real-time credit drain on AI service accounts.

This incident highlights a shift in adversary motivation toward stealing 'AI credit' as a high-value liquid asset. For organizations, the impact involves direct financial loss from unauthorized API usage and potential secondary data breaches if stolen database credentials are used to access customer records. Immediate rotation of all platform-stored secrets is required.