[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_w6tRMuVmLNEirJlkvE1wYehQpi5nzFUTzsUCHXQwsI":3},{"article":4,"iocs":49,"watch_terms":54,"solutions":55,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"43cf62f5-42a6-4611-8695-f275cb66c6ad","Railway breach leads to $740,000 in fraudulent AI charges","railway-breach-leads-to-740-000-in-fraudulent-ai-charges-43b501","Cloud hosting provider Railway says hackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and generate approximately $740,000 in fraudulent AI usage, potentially exposing credentials for up to 100,000 workspaces. [...]","Cloud hosting provider Railway disclosed a breach where hackers exploited vulnerabilities in its build infrastructure to steal customer authentication secrets. The attackers gained access to internal source code and customer environment variables for up to 100,000 workspaces, which were then used to generate approximately $740,000 in fraudulent AI usage. Railway is reimbursing affected customers and has remediated the exploited vulnerabilities.","Railway suffered a breach exposing customer secrets, leading to $740K in fraudulent AI charges.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fapple\u002Frailway-breach-leads-to-740-000-in-fraudulent-ai-charges\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F22\u002Frailway.jpg","2026-11-10T22:20:19+00:00","2026-11-10T23:00:23.307901+00:00",8,[17,20,23],{"name":18,"type":19},"Railway","vendor",{"name":21,"type":22},"Black October","campaign",{"name":24,"type":25},"AI","technology","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":26,"icon":28,"name":29,"slug":30},null,"Breaches","breaches",[32,37,39,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50],{"type":51,"value":52,"context":53},"malware","ARTEX","Mentioned as a similar harness used by attackers.",[18],{"controls":56,"vendors":144},[57,86,115],{"slug":58,"name":59,"problem":60,"products":61},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":87,"name":88,"problem":89,"products":90},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":116,"name":117,"problem":118,"products":119},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",[],{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":155},"build-infrastructure-breach-exposes-100000-customer-secrets-to-ai-fraud","Build Infrastructure Breach Exposes 100,000 Customer Secrets to AI Fraud","Attackers exploited vulnerabilities in Railway's build infrastructure to extract customer authentication secrets and environment variables from up to 100,000 workspaces — credentials that should never be accessible outside their intended runtime context. The root failure was an unpatched or misconfigured build pipeline that allowed lateral movement from infrastructure to sensitive customer data. This matters because build systems are high-value targets: they touch source code, secrets, and deployment credentials simultaneously, making a single compromise catastrophic in scope. The $740,000 in fraudulent AI charges illustrates how stolen API keys and tokens can be monetized rapidly, long before victims detect the abuse.",[150,151,152,153,154],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 18: Penetration Testing","NIST SP 800-53 SI-3: Malicious Code Protection","NIST CSF 2.0 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":156,"CIS Control 18: Penetration Testing":157,"NIST SP 800-53 SI-3: Malicious Code Protection":158,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":159,"NIST CSF 2.0 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed":160},"NIS2 requires security in acquisition, development, and maintenance including vulnerability handling, meaning the exploited build infrastructure vulnerabilities should have been identified and remediated before attackers could leverage them.","Regular penetration testing of the build pipeline would have surfaced the vulnerability attackers exploited before it could be used to steal 100,000 workspaces' worth of secrets.","NIST SP 800-53 SA-15 (Development Process) and secret handling controls require that build systems protect sensitive artifacts — the absence of such controls allowed authentication secrets to be harvested from build infrastructure.","The build infrastructure was exploitable because its configuration allowed unauthorized access to customer secrets — CIS Control 4 requires hardening configurations to prevent exactly this kind of lateral exposure.","Build pipeline service accounts had access to customer environment variables they did not need; enforcing least-privilege access entitlements would have contained the breach to infrastructure alone."]