Loading content...
Loading content...
Railway, Zeabur, ConnectWise and OpenCode all lost customer credentials in October 2026. What went wrong, and how to design so one platform breach does not become yours.
Developer platforms hold what attackers want most: API keys, database passwords and cloud tokens, stored as environment variables. In October 2026 several of them were hit in the same fortnight.
Zeabur disclosed unauthorised access on 14-15 October, its second incident in two months. Reporting indicates attackers read 321,810 account records and 3,218,965 environment-variable records. Credentials were reportedly stored in plaintext, and admin tokens had never expired and had not been rotated since January 2024. The founder announced the platform will shut down, with some services ending 1 December and all servers by 31 December 2026.
Railway disclosed on 21 October that an unauthorised party accessed systems storing customer environment variables, and that some encrypted variables were decrypted. Builds and deployments were paused, customers were told to rotate variables, API keys and registry credentials, and all Railway API tokens were revoked. Builds returned for Pro and Enterprise plans by 22 October. The number of affected customers has not been disclosed.
Stolen credentials for the backup application (formerly SkyKick) were used to access customers' Microsoft 365 environments. ConnectWise confirmed unauthorised sign-ins in 162 corporate tenants as of 16 October, with higher numbers reported later, and one partner tenant gained Global Administrator rights. ConnectWise has said a China state-aligned group used an open agentic AI framework; that attribution has not been independently confirmed.
OpenCode reported that OpenAI, Anthropic and Google API keys may have leaked from a legacy system, affecting about 1.4% of cloud console users. Some users reported unexpected charges. Keys used only in the local CLI and desktop app were reportedly unaffected.