Developer Platform Zeabur Will Close After a Second Breach
Developer hosting and deployment platform Zeabur has disclosed a breach on October 14–15, 2026 in which an attacker used leaked internal credentials, stored in plaintext, to compromise its infrastructure. The company says it can no longer maintain the platform and will shut down.
What Was Taken
- About 3.2 million environment-variable records
- Information for 321,810 accounts
- Access across shared clusters in nine regions
- Root sign-ins on 101 GCP servers by 92 users
- SSH keys added to 50 servers
- 16 customer disk copies attached to attacker-controlled virtual machines
How the Attacker Got In
The attacker used stolen administrator credentials and cloud access keys to move through the shared cluster, some dedicated servers and internal systems, then read the platform database. Zeabur says the credentials were likely obtained during the earlier August breach, though that is unconfirmed.
Several basic control failures made the second incident possible:
- Admin tokens had no expiry and dated from January 2024
- Tokens were not rotated after the August incident
- Administrator portals were reachable from the public internet
The August breach began with a flaw in a customer's NextChat application. The attacker then moved through poorly isolated internal systems, stole AWS credentials and accessed the production database, exposing account details, API keys and other secrets.
Shutdown Timeline
- December 1, 2026: renewals disabled and running services on shared clusters paused
- December 31, 2026: dedicated servers expire and shared clusters stop
Zeabur says extra time for data migration may be offered but has given no timeline. Variables that customers had already moved to their own servers after August were not in the latest database exposure, although compromised hosts could still expose them.
What Customers Should Do
- Rotate every credential and secret that was stored as a Zeabur environment variable (API keys, database passwords, cloud keys).
- Revoke active sessions and tokens tied to your account.
- Rebuild any compromised GCP servers rather than cleaning them in place.
- Plan migration off the platform before the shutdown dates.
Takeaways
Rotate secrets after any incident, set expiry on administrative tokens, never store credentials in plaintext, and keep admin interfaces off the public internet. A second breach through credentials left over from the first is a preventable failure.
Source: BleepingComputer.