application platform (PaaS)
Railway: security status
Summary
PaaS. PHP runs in the customer's container and the customer updates it. Railway's blog had no php2shell notice as of 2026-10-24.
Customer action:
For services that use PHP, update PHP in the image or build settings to a fixed release (8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or later) and redeploy.
Verified: 2026-10-24
Railway runs the customer's containers; the customer chooses and updates PHP. Sites proxied through Cloudflare show Cloudflare in DNS and are recognised by Railway's response headers.
The provider's own security incidents
October 2026 security incident (environment variables exposed)
in progressofficial notice · 2026-10-26Summary
Official preliminary report (Oct 22, updated through Oct 26): from Oct 20 13:58 to Oct 22 03:32 UTC an attacker was inside Railway's internal systems, pulled encrypted environment variables and decrypted some of them. At most 1.85% of workspaces (about 100,000) may have had variables exposed, but which variables were decrypted cannot be determined. The attacker was after AI provider API keys. Running services stayed up; builds and deploys were back on every plan by Oct 23. Notices to workspaces judged high-risk were completed at 18:57 UTC on Oct 23; workspaces without a notice are not confirmed safe. On Oct 26 Railway said the incident is resolved for existing users; new signups stay paused and are to reopen this week. It says it cannot refund spend run up on other platforms with the stolen API keys.
Customer action:
Railway customers who signed up before Oct 21: revoke the API keys, database passwords, registry credentials and other secrets stored in environment variables at their source, then set new values and redeploy (changing the value on Railway alone leaves the old key valid). Remove public network access to databases and check GitHub, AI and cloud provider activity for anything unusual. If stolen keys ran up AI charges, contact that AI provider first, then file a Railway support request with the evidence. If an agency runs the site, ask whether it uses Railway and what it has done.
Source: https://blog.railway.com/p/preliminary-report-october-security-incident
Verified: 2026-10-28
How this tool recognises the provider
- AS numbers
AS400940- CNAME
*.railway.app- Response headers (names)
x-railway-request-idx-railway-edge