Daily Cyber Threat Brief — October 25, 2026: Railway breach exposes up to 100,000 workspaces' secrets as AI-key theft campaign widens

The detail that elevates this above a routine platform incident is the attacker's apparent motive. Railway says the intruder was hunting AI inference credentials — keys that let the holder run up bills on someone else's AI account or quietly siphon model access. That explains why the response reached beyond Railway's own users: the company notified AI inference providers directly and asked them to revoke keys, and it told every customer to rotate secrets and check service logs for unusual usage.

The response timeline shows how disruptive a secrets incident is even before any customer data is confirmed stolen. Railway paused all deployments on detection, invalidated OAuth sessions on October 21 at 20:19 UTC, killed every API token platform-wide on October 22 at 04:17 UTC, and reset bucket and GitHub credentials. Builds came back in stages — Enterprise first, then Pro — while Hobby, Free and Trial workspaces waited. A follow-up post on October 23 added insult to the outage: code committed during the freeze was never deployed, so developers must redeploy manually, reconnect GitHub integrations and recreate CLI and CI credentials issued in that window.

What remains unknown is the part customers most need: how the intruder reached the environment-variable systems, and whether the "subset" framing holds. Railway has described effects — anomalous activity, impact from adjacent cache systems — but no root cause and no attacker name. Until that lands, the safe reading is the company's own: rotate everything stored on Railway, including database credentials for PostgreSQL, MongoDB, Redis and MySQL, and audit usage with OpenAI, Anthropic, xAI, OpenRouter, Stripe, GitHub, AWS and GCP. A secret that was only ever stored on Railway should be treated as exposed until proven otherwise.

Kaspersky's research, published October 22, describes a UEFI bootkit deployed in early 2026 against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan, attributed with medium confidence to APT41, the Chinese state-backed group also known as Brass Typhoon. BlackX exploits Baton Drop (CVE-2022-21894), a Secure Boot bypass from 2022, to enroll custom Machine Owner Keys and load arbitrary EFI files before Windows starts — then drops a kernel driver designed to interfere with security products from Kaspersky and Avast, and follow-on espionage tooling that uses cloud services such as Google Drive and OneDrive for command and control.

The uncomfortable part is that the victims were fully patched. The Baton Drop fix only blocks the vulnerable boot files once an administrator manually applies Microsoft's revocation mitigations under KB5025885 — adding the "Windows Production PCA 2011" certificate to the Secure Boot forbidden list — and those protections are not enabled by default. Patching without the revocation step leaves the door exactly where the attacker found it.

BlackX is closely related to BlackLotus, the bootkit advertised on underground forums in October 2022 and confirmed by ESET in March 2023. Kaspersky found BlackX code that is missing from the BlackLotus source code leaked in July 2023, which means the operator either reverse-engineered BlackLotus or bought its source. Either way, a four-year-old bypass is doing new espionage work in 2026 — and the defense is a manual step many teams never took. Any organization that could interest a state actor should apply the KB5025885 revocations now rather than waiting for Microsoft to enforce them.

A joint advisory from CISA, the FBI, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz and two UK law enforcement agencies puts a number on SafePay: at least 600 organizations across critical-infrastructure sectors in North America, South America, Europe and Australia since August 2024, making it one of the most active ransomware operations running today. SafePay appeared in mid-2024 and, unusually, operates without affiliates — no franchise model, just its own operators.

The access playbook is unglamorous and therefore hard to stop with a single control: exposed credentials, brute-force password attacks and VPN access, with Mullvad VPN addresses noted in the group's traffic. Once inside, SafePay runs classic double extortion — exfiltrate, then encrypt — and deliberately deletes shadow copies and wipes network-attached storage backups to break recovery. The advisory's findings draw on FBI, Secret Service and German investigations through August 2026.

The strategic read is that SafePay grew as BlackCat and LockBit declined, absorbing their oxygen rather than their code. For defenders, the advisory's mitigations point at identity first: credential hygiene, phishing-resistant authentication on VPN and remote access, and backups that cannot be wiped from the same network they protect. A group that walks in with valid credentials will not be stopped by an edge patch.

CISA added CVE-2026-110447, a critical OS command injection (CVSS 9.2) in Collabora Online's Built-in CODE Server for Nextcloud, to its Known Exploited Vulnerabilities catalog on October 23, with a remediation deadline of October 26 for federal agencies — a deadline every other operator should treat as its own. The flaw sits in the app's proxy.php, which passed request data into a Bash command without sanitization in versions up to 26.4.302. Unauthenticated attackers can execute commands as the web server user when the local CODE server is stopped, such as during a restart, upgrade or crash.

Exploitation has been observed since September 2026: attackers plant PHP web shells, steal configuration files carrying database and mail credentials, and hunt for password-manager files and cryptocurrency wallets. The fix is version 26.4.303 or later — and disabling the app is not enough, since the vulnerable script runs through the web server without loading Nextcloud's code. Standalone Collabora servers are not affected.

The hunting checklist writes itself: check whether the "Collabora Online – Built-in CODE Server" app is installed even if disabled, update or remove it, look in the apps/richdocumentscode folder for PHP files that do not belong, run Nextcloud's integrity check, and search web-server logs back to September 10 for requests to proxy.php with odd characters in the path. Anything the web-server account could read should be treated as exposed if a shell is found.

Two days after the PHP2Shell emergency patches, PHP disclosed a third remote code execution flaw in the same session-upload-progress feature, tracked as CVE-2026-115560. Unlike its predecessors, this one ships with no emergency patch — the project says it will be fixed in the next routine release — and with no CVSS score and no published list of affected versions, leaving operators to manage risk without the standard tools.

The one piece of good news is mitigation overlap: the same step that blunted PHP2Shell — setting session.upload_progress.enabled to 0 — also blocks this flaw, and the PHP team has confirmed that anyone who applied the mitigation on October 21 needs no further action. The vulnerable configuration reportedly requires a specific call sequence in application code, which narrows but does not eliminate exposure.

The pattern is the concern: three RCE-capable flaws in 48 hours, all tied to one optional feature, with the third disclosed but unpatched and unscored. Teams that have not yet disabled session upload progress should do so now rather than waiting for the routine release, and teams that did should keep the mitigation in place until the fix ships.