Railway Hack and Zeabur Breach: Your AI Keys May Be Exposed

On October 21, 2026, Railway, a hosting service (a company that runs other businesses' apps), warned its users about the Railway hack. Someone may have read the secret settings customers keep there, some in readable form. A week earlier, Zeabur, another hosting service, had a break-in, and its attacker went looking for AI keys.

We read both reports, Railway's recovery guides and two more October disclosures to show what each company confirmed.

Below, we cover what happened, why API keys (secret codes that let software use an account) were the target, and how to fix it.

The Railway Hack Puts Every Stored Secret at Risk

Railway's October 21 disclosure says an outsider may have reached the system that holds customers' environment variables (settings and secrets passed to running software), and decrypted (turned back into readable text) some of them.

The disclosure says the harm may be limited to a subset of users. Even so, it tells everyone to replace every stored variable, every API key and any private registry login (the login used to download private software packages). Railway will email the customers it confirms were affected.

Railway believes this is part of a series of attacks on platform companies, aimed at AI inference providers (the services that run AI models and answer requests). It says it told those providers to cancel keys, but it did not name them. When we checked on October 22, there was no full incident review yet.

Railway also paused new deployments (putting new versions of software live) while it worked. Our timeline below puts the main steps from Railway's status page in order (all times UTC, the world standard time).

• Railway cancelled all of its own API tokens (access codes for its own tools). Anyone using them needs new ones.
• It reset the keys for every storage bucket (a hosted folder of files). Services need to be redeployed to pick up the new keys.
• It reset its GitHub connections and removed stored GitHub registry tokens. Those removed tokens still work on GitHub until you cancel them there.
• Its AI recovery guides cover OpenAI, Anthropic, Grok and OpenRouter keys.

The Zeabur Hack Exposed Millions of Stored Settings

Zeabur's incident report confirms that an attacker read 3,218,965 stored settings and data linked to 321,810 accounts during a break-in on October 14 and 15.

Zeabur takes the blame in plain words. Long-lived admin logins (master logins that never expired) were stored in plain text and could be used from the open internet. Zeabur says it cannot confirm how the attacker first got them.

The report says the attacker was mainly hunting for keys they could use straight away, most of all keys for AI services. The attacker also tried to use Zeabur's own Amazon keys on Amazon Bedrock (Amazon's service for AI models). Every one of those tries failed, and no charges were made.

Zeabur is also shutting down. Some services start closing on December 1, 2026, and all dedicated servers (computers kept for one customer) and shared clusters (groups of computers that host many customers) close by December 31.

• 566 keys for zSend, Zeabur's email service, were stored in plain text. All of them are now cancelled.
• 11,536 platform access tokens were read, but only as hashes (scrambled copies that cannot be turned back). All are cancelled.
• Projects that moved their settings to their own server after an earlier August incident were outside this database read.
• Zeabur asks every user to replace their keys again, even if they already did so in August.

Two More Key Leaks Hit the Same Month

OVHcloud, a cloud hosting company, and PingCAP, which runs the TiDB Cloud database service, both disclosed leaks on October 19 or 20, and each one came through a different door.

The OVHcloud advisory says someone used a developer's GitHub account to swap the files of its CLI (a tool you control by typing commands) for harmful ones. Only versions v0.11.0 to v0.15.0 downloaded on October 19, between 14:47 and 16:21 Paris time, were affected. Version v0.16.0 is clean.

PingCAP's update says stolen service-account logins (logins used by software, not a person) gave an outsider access from September 9 to October 7. The copied data included a locked table of TiDB Cloud API keys. One tested key could not be used, and investigators found no sign that data stored in TiDB was touched.

A group called FulcrumSec claims it took far more from PingCAP. Dark Reading says it did not confirm those claims on its own, so we treat them as claims only.

• OVHcloud says its source code and build system were not touched. Only the download files were swapped.
• The harmful OVHcloud files looked for cloud logins, SSH keys (keys used to log in to servers) and other secrets on the computer.
• PingCAP also confirms that business, billing and saved database query text was copied.
• PingCAP is still working out which customers were affected and will tell them directly.

AI Keys Are the Prize Because They Spend Your Money

Railway's AI guides tell users to look for requests and spending they do not recognise, and Zeabur says its attacker was mainly hunting for AI keys.

An AI key works like a prepaid card for AI. Whoever holds it can send requests that are billed to your account. That is why Railway's OpenAI and Anthropic guides ask you to check usage by key and compare the models, requests and costs with your normal use.

Other keys open other doors. A storage key can open your files, and a database password can open the data that account can reach. Railway's bucket guide asks you to look for files you do not recognise or files that are missing.

We wrote about a similar case earlier this month. The OpenCode breach also exposed AI keys that people had saved in a hosted tool, though nobody has linked it to these attacks.

• Zeabur's attacker read saved logins inside n8n (a tool that links apps together) at scale, not just platform settings.
• In 602 of the 607 n8n setups Zeabur checked, the lock key sat in a stored setting, so the saved logins inside were as good as plain text.
• The attacker also read AI key managers called new-api and one-api, which hold keys for many AI services in one place.
• A registry token can let someone download your private software, and removing it from a dashboard does not cancel it.

Fix It by Cancelling Each Key Where It Was Made

Railway and Zeabur both ask you to replace exposed secrets, and Zeabur says to cancel the old ones with the company that issued them first.

Start with a list of every key and password you kept on the platform. Give each one an owner on your team, and write down when the old one stopped working. This is our suggestion for keeping the work in order.

Railway's credential reset guide lists what Railway already reset and what you must still do. It reset bucket keys and GitHub tokens, so keys from companies such as OpenAI are yours to replace. Update your settings, redeploy when your plan can build again, reconnect GitHub, and cancel old registry tokens on GitHub.

Check your bills and usage while you work, and save any odd records for the provider's support team. Our guide on local vs cloud AI explains why where your AI runs matters too.

• Railway AI keys: cancel them at OpenAI, Anthropic, Grok or OpenRouter, make new ones, update your settings and check usage.
• Railway buckets and GitHub: redeploy to load the new bucket keys, reconnect GitHub, and check your files and audit logs (records of account actions).
• Zeabur: replace every stored key and password and check your bills. Changing a setting does not change a password inside a database, so change it there too.
• OVHcloud and PingCAP: if you installed an affected OVHcloud CLI, replace the secrets on that computer and move to v0.16.0. PingCAP customers should watch for its direct notice.

Elephas Keeps Your Documents Stored on Your Mac, Not on Hosted Servers

Every tool that keeps your keys or files on servers you cannot see is one more place a break-in can reach, and the same is true of the AI tools you use for work.

With ChatGPT, Gemini and Claude, your questions and uploaded files go to their servers. Depending on your plan and settings, chats can be kept and may be used to train their models. Elephas is private AI for your documents, and you choose where each answer is made.

With Railway and Zeabur, Stored AI Keys Became the Target

With Elephas, the on-computer model (an AI model that runs on your Mac) answers without sending your questions or documents anywhere, and it needs no AI key at all. There is no key sitting on a server for anyone to take.

With Railway and Zeabur, Secrets Sat on Hosted Servers

With Elephas, your documents stay stored on your Mac. When you do use a cloud model, Elephas hides names, email addresses and phone numbers on your Mac before the question leaves, then puts them back in the answer. You can open a short note under each answer to see what was hidden.

With Elephas AI, your question and the passages it picked go through the Elephas gateway (the service that passes the request on) to open-source models in Elephas's own cloud. They are not stored and are not used to train AI models.

With Railway and Zeabur, Every Stored Key Had to Be Replaced

With Elephas, the Team plan gives everyone one shared, managed setup. Staff do not need to paste their own AI keys into different tools, and the owner decides whether members can use on-computer models.

• Every answer cites the passage from your files, so you can check it.
• Your document index and chats are kept in an encrypted database on your computer.
• Elephas asks before it installs an update and checks the update before applying it.
• It runs on Apple Silicon Macs with macOS 14 or later, and Windows is coming soon. Plans start at $19 a month, and Team costs $29 per person per month. Try Elephas with a 7-day free trial.

Conclusion

• Railway's warning applies to every user, even if the impact turns out to be limited. Replace your stored secrets and check your usage now.
• Zeabur confirmed reads of millions of stored settings, and the service closes by December 31, 2026. Replace your keys.
• For each platform, cancel the old key where it was made. Getting your service back online does not undo a copied key.
• For a more private choice than ChatGPT, Gemini and Claude, Elephas hides personal details on your Mac before any cloud model sees them, and its on-computer model needs no AI key.

Written by

Selvam Sivakumar

Founder, Elephas.app

Selvam Sivakumar is the founder of Elephas and an expert in AI, Mac apps, and productivity tools. He writes about practical ways professionals can use AI to work smarter while keeping their data private.

LinkedInFollow