Zeabur to shut down after second security breach leaks millions of user records

Development platform failed to rotate credentials after August hack, leading to broader October breach and company shutdown

By LineZotpaper

Published20 October 2026

Read Time2 min

Developer platform Zeabur announced it will shut down all services by the end of December, following a second major security breach in as many months. The company disclosed that attackers exploited leaked plaintext credentials, believed obtained from an August incident, to steal over 3.2 million environment variable records and data from 321,810 accounts, prompting the company to cease operations entirely.

Zeabur, a developer hosting and deployment platform, has disclosed a second cybersecurity breach in two months and announced it will shut down by the end of 2026.

The company revealed that on October 14-15, 2026, an attacker used leaked internal credentials, stored in plaintext and believed obtained from the initial August breach, to access its shared hosting cluster and production database. This resulted in the theft of over 3.2 million environment variable records and data belonging to 321,810 user accounts. The attackers also achieved root access on 101 GCP servers and attached customer disk copies to their own machines.

Zeabur acknowledged that after the August incident, the company failed to rotate administrator credentials. It noted that admin tokens had not expired or been changed since creation in January 2024, were not included in the post-August rotation, and administrator portals remained internet-facing.

"Following this latest incident, we reassessed what it would take to keep operating and the responsibilities our team could carry. We ultimately decided to wind down," the company stated.

Services will begin pausing on December 1, 2026, with full closure scheduled for December 31. Zeabur urged users to rotate exposed credentials, revoke active sessions, and rebuild any compromised servers immediately.

Analysis

Why This Matters

The breach highlights the cascading risks of poor security hygiene in the developer tools supply chain, where platforms managing environment variables are high-value targets for attackers.
Tens of thousands of developers now face an urgent migration off the platform while assessing whether their own secrets have been compromised downstream.
The case demonstrates that specific post-breach security practices, particularly credential rotation and encryption, are essential for a company's survival after an initial compromise.

Background

Zeabur is a developer hosting and deployment platform that automates hosting, databases, HTTPS setup, and infrastructure management for projects connected via GitHub. In late August 2026, the company suffered its first breach when hackers exploited a flaw in a customer's NextChat application, moved laterally through poorly isolated internal systems, and stole AWS credentials along with production database records. The company did not rotate admin credentials, store them in encrypted form, or introduce token expiry after this initial incident.

Key Perspectives

Zeabur: The company states that scaling the platform to meet market demand increased complexity and operational burden beyond what the team could maintain securely. The second breach demonstrated these failures were not isolated, leading to the decision to wind down operations rather than attempt further recovery. Affected Users: Developers who trusted the platform now face an emergency migration scenario. They must quickly identify and rotate every compromised environment variable, API key, and credential stored in Zeabur while managing the operational disruption of a year-end platform shutdown.

What to Watch

December 1, 2026: Zeabur will pause renewals and shared cluster services. User migration must accelerate significantly before this deadline.
How quickly downstream attacks occur as threat actors weaponize the 3.2 million environment variable records and 321,810 account records stolen in the breach.
Whether this incident sparks wider industry debate around liability standards and security baselines for cloud development infrastructure platforms.

Sources

Zeabur shutting down after second security breach in two months · BleepingComputer

Checked

12 claims in this story checked against 1 source: 8 supported.

Show each claim

SupportedZeabur will shut down after a second breach exposed millions of user records.BleepingComputer: “Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts.”
Partly supportedThe company’s failure to rotate credentials after the August breach led to the broader October breach and the shutdown.BleepingComputer: “The company says that attackers likely obtained the credentials they used in the second attack during the August breach, though it hasn’t confirmed this. [...] scaling the project to meet market demand has made it increasingly complex and difficult to maintain, and the recent security failures reflect that.”
SupportedZeabur disclosed a second major breach in two months.BleepingComputer: “Zeabur shutting down after second security breach in two months. Development platform Zeabur has disclosed details of a cybersecurity incident”
SupportedThe October attacker used leaked internal credentials stored in plaintext, believed to have been obtained in the August incident.BleepingComputer: “The company says that attackers likely obtained the credentials they used in the second attack during the August breach, though it hasn’t confirmed this. Beyond failing to store credentials in encrypted form”
SupportedThe breach exposed over 3.2 million environment-variable records and data for 321,810 accounts.BleepingComputer: “In the latest incident, Zeabur says the compromise was broader, affecting shared clusters across nine regions, 321,810 accounts, and roughly 3.2 million environment-variable records.”
Partly supportedThe breach prompted Zeabur to cease operations entirely.BleepingComputer: ““Following this latest incident, we reassessed what it would take to keep operating and the responsibilities our team could carry. We ultimately decided to wind down.” [...] scaling the project to meet market demand has made it increasingly complex and difficult to maintain”
SupportedThe October 14–15 attacker accessed the shared cluster and production database using leaked internal credentials.BleepingComputer: ““On October 14–15, 2026, an attacker used leaked Zeabur internal credentials to break into the shared cluster, some Dedicated Servers, and Zeabur internal systems, and eventually read the platform database,””
Partly supportedAttackers achieved root access on 101 GCP servers and attached customer disk copies to their own machines.BleepingComputer: “Zeabur confirmed root sign-ins on 101 GCP servers by 92 users, with the attackers adding SSH keys to 50 servers and attaching 16 customer disk copies to their own virtual machines.”
SupportedZeabur failed to rotate administrator credentials after the August incident; admin tokens had no expiry, had not been rotated since January 2024, and were left out of the post-August rotation.BleepingComputer: ““The admin tokens had no expiry, had not been rotated since they were created in January 2024, and were not included in the post-August rotation,” explained Zeabur.”
SupportedZeabur said: “Following this latest incident, we reassessed what it would take to keep operating and the responsibilities our team could carry. We ultimately decided to wind down.”BleepingComputer: ““Following this latest incident, we reassessed what it would take to keep operating and the responsibilities our team could carry. We ultimately decided to wind down.””
SupportedServices will begin pausing on December 1, 2026, with full closure scheduled for December 31.BleepingComputer: “Zeabur announced over the weekend that it will shut down its services starting December 1, 2026, and finish by December 31, 2026.”
Partly supportedZeabur urged users to rotate exposed credentials, revoke active sessions, and immediately rebuild any compromised servers.BleepingComputer: “Users are urged to rotate exposed credentials and secrets immediately, revoke all active sessions, and rebuild compromised GCP servers.”