{ "version": 1, "event_id": "evt_9e5b3a6ca4227247", "url": "https://xiyu.news/events/evt_9e5b3a6ca4227247/", "json": "https://xiyu.news/api/events/evt_9e5b3a6ca4227247.json", "type": "security_incident", "status": "developing", "category": "technology", "title": { "zh": "Railway曝安全事件：部分密钥明文恐遭窃取，攻击疑似瞄准AI服务商", "en": "Railway曝安全事件：部分密钥明文恐遭窃取，攻击疑似瞄准AI服务商" }, "current_state": { "zh": "Railway 在披露环境变量存储遭未授权访问后，进一步向使用谷歌云服务账号密钥的用户发布密钥轮换、凭据更换、重新部署及云审计排查指引；该事件仍被报道为可能与 Swell DAO 管理员密钥疑似泄露相关。", "en": "After disclosing unauthorized access to its environment-variable storage, Railway issued guidance for users with Google Cloud service-account keys to rotate credentials, redeploy, and audit cloud activity; the incident remains reported as possibly linked to the suspected Swell DAO admin-key compromise." }, "first_seen_at": "2026-10-22T06:31:29.129518+00:00", "last_updated_at": "2026-10-22T13:44:18.537616+00:00", "last_material_change_at": "2026-10-22T13:44:18.537616+00:00", "confidence": 0.75, "updates_count": 2, "sources_count": 2, "entities": [ "railway" ], "identifiers": [], "topics": [ "ai-infrastructure", "cloud-infrastructure", "cloud-security", "credential-exposure", "defi-exploit", "key-management", "railway", "security-incident", "swell-dao" ], "updates": [ { "update_id": "upd_bbfc8f97af434ea0", "event_id": "evt_9e5b3a6ca4227247", "occurred_at": "2026-10-22T05:19:02Z", "published_at": "2026-10-22T05:19:02Z", "first_seen_at": "2026-10-22T06:31:29.129518Z", "time_precision": "published", "update_type": "initial", "material_change": true, "title_zh": "Railway曝安全事件：部分密钥明文恐遭窃取，攻击疑似瞄准AI服务商", "title_en": "Railway曝安全事件：部分密钥明文恐遭窃取，攻击疑似瞄准AI服务商", "what_changed_zh": "Railway 披露其环境变量存储中存在未经授权的活动，可能暴露了加密的以及可能明文的客户机密，促使所有用户轮换密钥，并暂时停止全平台的构建和部署。", "what_changed_en": "Railway disclosed unauthorized activity in its environment-variable storage that may have exposed encrypted and possibly plaintext customer secrets, prompting all users to rotate keys and temporarily halting platform-wide builds and deployments.", "current_state_zh": "Railway 披露其环境变量存储中存在未经授权的活动，可能暴露了加密的以及可能明文的客户机密，促使所有用户轮换密钥，并暂时停止全平台的构建和部署。", "current_state_en": "Railway disclosed unauthorized activity in its environment-variable storage that may have exposed encrypted and possibly plaintext customer secrets, prompting all users to rotate keys and temporarily halting platform-wide builds and deployments.", "detailed_summary_zh": "Railway disclosed unauthorized activity in its environment-variable storage that may have exposed encrypted and possibly plaintext customer secrets, prompting all users to rotate keys and temporarily halting platform-wide builds and deployments.", "detailed_summary_en": "Railway disclosed unauthorized activity in its environment-variable storage that may have exposed encrypted and possibly plaintext customer secrets, prompting all users to rotate keys and temporarily halting platform-wide builds and deployments.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.75, "story_ids": [ "telegram:theblockbeats:201793" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/373134?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_f7e93706b9c20c9b", "event_id": "evt_9e5b3a6ca4227247", "occurred_at": "2026-10-22T10:42:05Z", "published_at": "2026-10-22T10:42:05Z", "first_seen_at": "2026-10-22T13:44:18.537616Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "【Railway 建议用户排查谷歌云异常访问，并更换可能泄露的服务账号密钥】", "title_en": "【Railway 建议用户排查谷歌云异常访问，并更换可能泄露的服务账号密钥】", "what_changed_zh": "Railway 发布后续安全指引，要求使用谷歌云服务账号密钥的用户禁用并轮换可能泄露的密钥、重新部署服务，并检查云审计日志与账单；报道还称该事件可能与 Swell DAO 的 swETH/rswETH 管理员密钥疑似泄露相关。", "what_changed_en": "Railway issued follow-up guidance for users with Google Cloud service-account keys to disable and rotate potentially leaked keys, redeploy services, and audit cloud logs and billing; the report also links the incident to the suspected compromise of Swell DAO swETH/rswETH admin keys.", "current_state_zh": "Railway 在披露环境变量存储遭未授权访问后，进一步向使用谷歌云服务账号密钥的用户发布密钥轮换、凭据更换、重新部署及云审计排查指引；该事件仍被报道为可能与 Swell DAO 管理员密钥疑似泄露相关。", "current_state_en": "After disclosing unauthorized access to its environment-variable storage, Railway issued guidance for users with Google Cloud service-account keys to rotate credentials, redeploy, and audit cloud activity; the incident remains reported as possibly linked to the suspected Swell DAO admin-key compromise.", "detailed_summary_zh": "Railway issued security guidance telling users to disable and rotate potentially leaked Google Cloud service-account keys and audit for unauthorized activity, following its October 21 incident that is linked to the suspected compromise of Swell DAO's swETH/rswETH admin keys and malicious upgrade contracts that could drain ~2,500 ETH.", "detailed_summary_en": "Railway issued security guidance telling users to disable and rotate potentially leaked Google Cloud service-account keys and audit for unauthorized activity, following its October 21 incident that is linked to the suspected compromise of Swell DAO's swETH/rswETH admin keys and malicious upgrade contracts that could drain ~2,500 ETH.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.9, "story_ids": [ "telegram:foresightnews:121067" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/115768", "label": "foresightnews", "source_type": "telegram", "official": false } ] } ] }