#cloud-hosting

Cloud hosting platform Railway disclosed on October 21 that it detected anomalous activity in systems that store customer environment variables. Its investigation so far indicates an unauthorized third party may have accessed encrypted environment variables and, for some, obtained the decrypted contents. Those variables can hold API keys and database and registry credentials.

Railway says it believes this is part of a series of attacks on platform companies aimed at compromising AI inference providers, and that it has asked those upstream providers to revoke keys proactively. While the impact may be limited to a subset of users, it recommends that all customers immediately rotate every environment variable and private registry credential stored on Railway and check logs for unusual activity.

All deployments were paused during the investigation, so customers could not roll out new versions until builds resumed. Railway says it will email affected customers directly; on October 22 it published follow-up guidance on checking for anomalous AWS and Google Cloud access.

GMO Internet's Onamae.com Desktop Cloud, a Japanese virtual private server service marketed for running automated FX trading software, says a third party gained unauthorized access and installed malicious programs in some customers' server environments. Its notice lists 26,739 servers as possibly affected.

To prevent further damage, the company began shutting down customer servers from 04:00 local time on October 21, affecting all Desktop Cloud plans, with no restart date given. BleepingComputer reports the company says data stored on the servers may have been exposed but it has not confirmed misuse, and that payment details are kept on separate infrastructure.

Customers who stored passwords or other secrets on their servers are advised to change them, and the company warns of phishing that may exploit the incident, saying it will never ask for passwords or card numbers by email or phone.