Triple blow: Railway breached, customer env vars and secrets stolen; QUIC 0-day can remotely kill processes; GitLab discloses CVSS 10.0 flaw affecting all versions since 2014
Railway disclosed on October 21 that it detected anomalous activity in systems storing customer environment variables and secrets, urging immediate attention. Separately, FoxIO researchers documented QPACK amplification attacks against HTTP/3 servers over QUIC, and GitLab issued a critical patch release covering versions 18.11.13 through 19.5.1, urging all self-hosted instances to upgrade immediately. The cluster matters because leaked env vars can cascade into full infrastructure compromise, while the QUIC and GitLab flaws expose broadly deployed infrastructure to remote attack.
SOURCES
- LinuxDo2026-10-22 03:35