Zeabur shutting down after second security breach in two months

In October 2026, Zeabur disclosed a cybersecurity incident where attackers leveraged leaked internal credentials, stored in plaintext and not rotated since January 2024, to compromise shared clusters and dedicated servers across nine regions. The attackers accessed the production database, stealing over 3.2 million environment variable records and information for 321,810 accounts. They performed root sign-ins on 101 Google Cloud Platform servers, added SSH keys to 50 servers, and attached 16 customer disk copies to their own virtual machines. The credentials used were likely obtained during an earlier August 2026 breach, where attackers exploited a flaw in a customer's application and moved laterally through poorly isolated internal systems. Zeabur's failure to rotate admin tokens and secure admin portals contributed to the severity of the breach. In response, Zeabur decided to shut down its platform by December 31, 2026.

The breach resulted in the theft of sensitive environment variables and account information for over 321,000 users, potentially exposing API keys, secrets, and other confidential data. Attackers gained root access to multiple cloud servers and compromised infrastructure integrity. The exposure of plaintext internal credentials and failure to rotate them increased the attack surface and facilitated the breach. The incident forced Zeabur to cease operations, impacting its user base and service availability.

Zeabur has announced it will shut down its services by December 31, 2026. Users are urged to immediately rotate all exposed credentials and secrets, revoke active sessions, and rebuild any compromised Google Cloud Platform servers. Since the vendor is discontinuing the platform, no further patches or fixes will be provided. Users should prioritize data migration and securing their environments independently.