Zeabur to Shut Down Following Major Security Breaches
Zeabur, a development platform, has disclosed details of a cybersecurity incident that has led to its decision to shut down operations. An attacker exploited leaked internal credentials stored in plaintext to compromise the platform's infrastructure, resulting in the theft of over 3.2 million environment variable records and information for 321,810 accounts.
The breach occurred when the attackers used stolen administrator credentials and cloud access keys to infiltrate Zeabur's shared hosting infrastructure and dedicated servers. This breach allowed them access to the production database, significantly compromising user data.
According to Zeabur's announcement, the incident took place on October 14-15, 2026, when the attackers gained entry into the shared cluster and internal systems. The company noted that the attackers likely obtained the credentials used in this second attack during a previous breach in late August 2026, which had already exposed AWS credentials and other sensitive information.
In the earlier incident, hackers exploited a vulnerability in a customer's NextChat application, which allowed them to navigate through poorly isolated internal systems. This breach led to the theft of API keys and other secrets stored in the production database.
The recent compromise was broader than the previous one, affecting shared clusters across nine regions and exposing a significant amount of sensitive data. Zeabur confirmed that root sign-ins were recorded on 101 GCP servers by 92 users, with attackers adding SSH keys to 50 servers and attaching 16 customer disk copies to their own virtual machines.
Security Oversights Intensify Breach Consequences
Zeabur's failure to store credentials securely and to rotate administrator account credentials since the August incident contributed to the severity of the breach. The company acknowledged that the admin tokens had no expiry and had not been rotated since their creation in January 2024.
In light of these incidents, users are advised to rotate any exposed credentials and secrets immediately, revoke all active sessions, and rebuild compromised GCP servers. Although some variables were migrated to customers' own servers as part of the response to the August incident, the latest exposure still poses risks.
Following the discovery of the latest breach, Zeabur announced that it will begin shutting down its services starting December 1, 2026, with all operations concluding by December 31, 2026. This decision comes after 3.5 years of growth, including a record year in 2026. However, the company stated that scaling the project to meet market demand has become increasingly complex and difficult to maintain, and the recent security failures reflect that.
Cleared for Release
After the August incident, Zeabur spent considerable time evaluating its future. Ultimately, the company decided to wind down operations, stating that the responsibilities of maintaining the platform had become unmanageable.
As the shutdown approaches, renewals will be disabled on December 1, and all running services on shared clusters will be paused. Users may be granted additional time for data migration, although specific timelines have not yet been provided.
