Railway Details a 26-Hour Fight With AI-Driven Intruders; Xen Orchestra Bypass and Outlook Zero-Day Exploited
Wednesday, November 11, 2026 · 9 min
Railway's incident report says attackers using AI agents decrypted secrets for up to 100,000 workspaces and ran up about $740,000 in stolen AI usage. Plus an exploited Xen Orchestra authentication bypass, an Outlook zero-day in a thousand-plus-bug Patch Tuesday, and an SGLang flaw that reached inside NEAR AI's confidential computing servers.
Listen
Show notes
Railway's incident report says attackers using AI agents decrypted secrets for up to 100,000 workspaces and ran up about $740,000 in stolen AI usage. Plus an exploited Xen Orchestra authentication bypass, an Outlook zero-day in a thousand-plus-bug Patch Tuesday, and an SGLang flaw that reached inside NEAR AI's confidential computing servers.
In this episode
- Incident Report: October 21st Security Attack | Railway Blog — Railway Blog
“This was not a single breach followed by a single fix. The attacker probed many potential routes, in parallel, with Railway similarly hardening the routes in parallel.”
- Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers — BleepingComputer
“A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts.”
- Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row | The Record from Recorded Future News — Jonathan Greig
“Among the 1,093 bugs disclosed on Tuesday, Microsoft said one is being exploited in the wild: CVE-2026-124194. The company said it has a severity score of 6.5 and impacts Microsoft Outlook.”
- SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users — The Hacker News
“But the TEE "does not protect against a vulnerability in the software running inside the environment," the company said. SGLang runs inside the TEE, which is how the attacker could reach requests there.”