Railway details breach exposure and approximately $740,000 in fraudulent AI usage

Image: Primary

Published Tuesday, November 10, 2026 · 9:33 PM EST

Railway's new incident report says attackers obtained access to decrypted customer environment variables for at most 1.85% of its workspaces, or approximately 100,000, and generated approximately $740,000 in unauthorized AI usage. The report expands on the cloud hosting provider's October 22 breach disclosure. Attackers escaped filesystem isolation in build infrastructure, obtained internal source code and exploited a second vulnerability involving an improperly configured trust relationship to reach decryption credentials. Railway says the workspace count is a maximum potential exposure, not confirmed theft from every workspace. It reset exposed linked-account tokens for 1,852 users and says it will cover fraudulent charges that providers decline to refund.

Sources

BleepingComputer

Published by Tech & Business, a media brand covering technology and business. This story was sourced from BleepingComputer and reviewed by the T&B editorial agent team.

Back to Newswire

Keep reading

Full wire

Security

Microsoft patches 1,093 vulnerabilities, including exploited Outlook flaw

Microsoft released updates fixing 1,093 vulnerabilities in Windows and supported software, including an Outlook spoofing flaw already being exploited, Krebs on Security reported.

Capital Infrastructure

Tendrils raises $30 million for parallel processor development

Tendrils says it has completed a $30 million financing round led by Benchmark to develop a general-purpose processor built around thousands of cores operating in parallel. Other participants include Visionaries Club and the UK Sovereign AI Fund.

Security

Git releases fixes for six vulnerabilities, including recursive-clone code execution

The Git project released patches for six security vulnerabilities, including a flaw that can execute attacker-controlled code when a user recursively clones a malicious repository, GitHub announced. Fixes are available in Git 2.56.1 and six maintenance releases.

Security Capital

Daylight raises $80M Series B led by Goldman Sachs Alternatives

New York-based Daylight raised an $80M Series B led by Goldman Sachs Alternatives, the Wall Street Journal reported. Sources put its valuation at approximately $400M. Daylight provides managed security through a platform that pairs AI agents with human experts.

AI Capital

Odessia founder says OpenAI acquired travel startup as its tool shuts down

OpenAI has acquired AI travel startup Odessia, founder Francis Davidson said in an announcement. Davidson has joined OpenAI to work on travel, and an OpenAI spokesperson confirmed his hire to TechCrunch. The deal's terms were not disclosed.

Capital Security

Dreeze emerges from stealth with $33M seed funding

Dreeze has emerged from stealth with $33M in seed funding, CTech reported. Zerto founders Ziv and Oded Kedem joined Avi Raichel to launch the company, which aims to help businesses recover from cyberattacks by restoring entire cloud applications.