Zeabur to wind down after breach exposes 3.2 million environment-variable records

On 20 October 2026, Zeabur — a developer hosting platform that builds, deploys and runs applications connected from a GitHub repository, handling databases, HTTPS and infrastructure on a user's behalf — disclosed that an attacker had used leaked internal credentials to break into the shared cluster underpinning its service, and said it would wind the company down by the end of the year. It was the platform's second security breach in two months.

Zeabur said the attacker used stolen administrator credentials and cloud access keys to reach shared hosting infrastructure, some dedicated servers, and the production database, affecting shared clusters across nine regions. The intrusion exposed more than 3.2 million environment-variable records and information for 321,810 accounts. The company confirmed root sign-ins on 101 Google Cloud servers by 92 distinct users, said the attackers had added SSH keys to 50 servers, and found that 16 customer disk copies had been attached to the intruders' own virtual machines.

How the attacker got in

By Zeabur's own account, the compromise was rooted in weak credential hygiene. The internal credentials were stored in plaintext and were likely obtained during an earlier breach in August 2026, when attackers exploited a flaw in a customer's NextChat application, moved through poorly isolated internal systems, and stole AWS credentials and production database access. Administrator credentials were not fully rotated after that incident, administrator portals remained reachable from the public internet, and the company acknowledged that "the admin tokens had no expiry, had not been rotated since they were created in January 2024."

Shutdown and remediation

Rather than rebuild, Zeabur announced it would close. It said renewals would be disabled and running services on shared clusters paused on 1 December 2026, and that all dedicated servers and shared clusters would expire and shut down by 31 December 2026, with some additional time possible for data migration. The company urged users to rotate any exposed credentials, revoke active sessions, and rebuild servers that may have been compromised. Variables that customers had moved onto their own servers after the August incident were not exposed in the latest platform database breach, though any host the attackers reached could still leak them.