Zeabur to shut down after second breach in two months

Developer hosting and deployment platform Zeabur has disclosed a cyberattack in which an intruder used leaked internal credentials — stored in plaintext — to break into the company's infrastructure. The attacker made off with more than 3.2 million environment-variable records and information on 321,810 accounts.

According to Zeabur, on October 14–15, 2026, the attacker used stolen administrator credentials and cloud access keys to compromise the shared cluster, some dedicated servers, and internal systems, eventually reading the production database.

Zeabur lets developers connect a GitHub repository, after which the platform handles deployment, databases, HTTPS, and infrastructure management.

A familiar story

This is already the second incident in a short span. In late August 2026, hackers exploited a flaw in a customer's NextChat application and then moved through poorly isolated internal systems. That breach led to the theft of AWS credentials and access to the production database, exposing account data, API keys, and other secrets.

The latest compromise was broader, affecting shared clusters across nine regions. The company confirmed root sign-ins on 101 GCP servers by 92 users; the attackers added SSH keys to 50 servers and attached 16 copies of customer disks to their own virtual machines.

Zeabur believes the credentials used in the second attack were likely obtained during the August breach, though it has not confirmed this.

A chain of lapses

The company's failures went beyond storing credentials unencrypted. After the August incident, Zeabur did not rotate all administrator credentials, and admin portals remained reachable from the public internet. By its own account, the admin tokens had no expiry, had not been rotated since they were created in January 2024, and were left out of the post-August rotation.

Users are urged to rotate exposed credentials and secrets immediately, revoke all active sessions, and rebuild affected GCP servers.

The decision to close

After discovering the latest incident, Zeabur announced it will shut down: services will begin going offline on December 1, 2026, with the wind-down complete by December 31. The decision follows 3.5 years of continuous growth, including a record 2026, but the company says scaling to meet demand made the platform increasingly complex to maintain — something it says the recent security failures reflect.

"After the August incident, we spent a long time discussing and struggling with what to do next," the company explained. "Following this latest incident, we reassessed what it would take to keep operating and the responsibilities our team could carry. We ultimately decided to wind down."

On December 1, renewals will be disabled and all running services on shared clusters paused; by year's end, dedicated servers will expire and shut down. Users may be given extra time to migrate their data, though no concrete timelines have been offered yet.

Source: Bleeping Computer