Railway Platform Outage

Timeline

1. 07:24 UTC Railway status page · Reported Railway Platform Outage
2. 00:51 UTC Railway status page · Identified There are no meaningful changes since our last update. Builds and deployments for Enterprise, Pro, Hobby, Trial and Free workspaces are proceeding normally. We are continuing to work on completing our Preliminary Incident Report and will share it here when it is published. New signups remain temporarily paused while we focus on existing customers. We will provide another update by 02:00 UTC on October 23 at the latest.
3. 02:00 UTC Railway status page · Identified We had been targeting publication of our Preliminary Incident Report tonight, but we need more time before it is ready to publish. We are notifying customers with high likelihood of impact by email now. Builds and deployments for Enterprise, Pro, Hobby, Trial and Free workspaces remain available and are proceeding normally. New signups remain temporarily paused while we focus on existing customers. We will share further updates as new information becomes available and link to the report here when it is published.
4. 02:19 UTC Railway status page · Identified We are continuing to notify customers with a high likelihood of impact by email. We will update this status page as soon as all notification emails have been sent. We will post an update not later than 03:00 UTC on October 23.
5. 03:00 UTC Railway status page · Identified We are continuing to send notification emails to customers with high likelihood of impact. At the current pace, we expect this to take at least several more hours, but we cannot give a reliable estimate for when all emails will be sent. We will post an update once sending is complete, or sooner if there are any material changes. We apologize that we cannot provide a more definite timeline. We still plan to publish our Preliminary Incident Report around midday Eastern Time on October 23.
6. 07:37 UTC Railway status page · Identified Builds may stay in a queued state while the Railway team deploys an upgrade to the build system. This update is not related to the security disclosure. New signups remain temporarily paused while we focus on existing customers.
7. 08:09 UTC Railway status page · Identified Builds and deployments for Enterprise, Pro, Hobby, Trial and Free workspaces are proceeding normally. New signups remain temporarily paused while we focus on existing customers. We have notified customers with a very high likelihood of impact by email. We are still conducting forensic analysis to find more cohorts of likelihood of impact. The team still expects the preliminary report by noon EST.
8. 09:34 UTC Railway status page · Identified Reminder: if you are facing issues with deployments, you may need to disconnect and reconnect your GitHub integration. Redeploying code from before the incident would not work and result in an error. Builds and deployments for workspaces continue to run normally, and there is no other change since our last update.
9. 16:15 UTC Railway status page · Identified We are in the process of publishing the preliminary report. A clarifying addendum on outreach emails, the Railway engineering team has performed preliminary forensics on the intent of the attacker, as such, we have bucketed customers based on risk of exposure based on logs and data we have collected over the last 48 hours. We have already sent the emails to highest risk targeted workspaces. We are now actively sending emails to the remaining buckets of users where they are considered at risk. If you have known compromised use of a token, please reach out to support@railway.com which will…
10. 16:38 UTC Railway status page · Identified The preliminary report is now available: https://blog.railway.com/p/preliminary-report-october-security-incident Our investigation is still ongoing and we are still reaching out to customers we believe are at risk. Our team will remain engaged on the matter until we have notified everyone we believe is at risk.
11. 19:18 UTC Railway status page · Monitoring We’ve published our preliminary report on the October 21 security incident. This is an update on the existing incident, not a new incident. As of October 23 at 18:57:54 UTC, we have completed notifications to users whose workspaces met our criteria for increased risk. No further higher-risk notifications are pending based on our findings as of that time. If new findings change our assessment of your workspace, we will contact you directly. Workspaces outside those higher-risk groups are not confirmed safe from compromise. If you have not already done so, please rotate sensitive credentials…
12. 20:43 UTC Railway status page · Monitoring Builds are operational, but they may take longer than usual to start or finish while we work through redeploys across the platform. The Railway API and dashboard are fully functional. Our support and community site, station.railway.com, remains unavailable while we work on restoring our remaining non-critical services. For help in the meantime, contact support@railway.com. New signups remain temporarily paused while we focus on existing customers. We will continue to monitor and post another update once build times are back to normal.
13. 22:06 UTC Railway status page · Resolved This incident has been resolved. Builds, deployments, the Railway API, and the dashboard are operating normally. New signups remain temporarily paused while we focus on existing customers. station.railway.com remains unavailable, and we are tracking it in a separate notice here https://status.railway.com/incident/ZEO9X68O Our preliminary report on the October 21 security incident is available at https://blog.railway.com/p/preliminary-report-october-security-incident. If you have not already done so, please rotate sensitive credentials stored in Railway environment variables, revoke the old…