The leaders of two major decentralized AI projects issued warnings on social media after a breach at cloud-hosting company Railway and a critical flaw in PHP, the programming language behind much of the web, sent developers scrambling this week.
"Env vars on Railway apps are compromised. Rotate your Keys ASAP," Greg Osuri, founder of Akash Network, a decentralized marketplace for cloud computing, wrote on X on Wednesday. "Env vars" is short for environment variables, the behind-the-scenes settings where apps store sensitive information like passwords and the keys they use to connect to other services.
"Opsec stress is about to get worse," Osuri added in a follow-up post. "Opsec" is short for operational security, the day-to-day habits people and companies use to keep their systems and information safe.
Railway said an intruder may have read hidden settings its customers' apps run on, including passwords and API keys, the digital keys apps use to reach other services. It paused all deployments, told every user to swap out those keys and said the attack appeared aimed at AI providers. Days earlier, AI coding tool OpenCode said hackers took users' AI keys and ran up their bills, TechCrunch reported.
Separately, PHP's maintainers rushed out fixes for two flaws that let attackers take over web servers without logging in. PHP runs about seven in 10 websites with a known server language, including WordPress sites, and attacks are already underway, according to cybersecurity firm Tenable.
The takeaway: Anyone running an app online should update now and replace their keys.
NEAR Protocol co-founder Illia Polosukhin called it "Security Armageddon" in an X post early Thursday. He urged a shift from simple keys to cryptography-based access, hosting that protects software even from the host, and less-restricted AI models to help defenders keep up.
The DeAI angle: Decentralized AI projects argue that when one company holds many customers' keys, it becomes one big target. Still, decentralized networks run the same open-source software, PHP included.
HOW AI WAS USED IN THE PRODUCTION OF THIS PIECE: I drafted this story on Claude using custom skills, and then filed the story directly to DeAI News on the web app DistroVerse using the Distro Publisher MCP connector.