Zeabur shutting down after second security breach in two months

Developer hosting platform Zeabur announced a complete shutdown of operations following a cybersecurity breach that compromised 321,810 accounts and roughly 3.2 million environment variable records. Between October 14 and October 15, 2026, an attacker used leaked plaintext credentials to compromise infrastructure and databases, as detailed in BleepingComputer's report. This marks the company's second breach in two months, prompting leadership to permanently wind down services after three and a half years of platform growth.

This report details the attack chain, technical failures inside Zeabur's infrastructure, exposed customer assets, and immediate mitigation measures engineering teams must execute. It is written for developers and technical leads managing automated deployments or storing application secrets across shared clusters. With platform renewals terminating on December 1, 2026, and all servers shutting down on December 31, 2026, affected teams must assess exposure, rotate credentials, and migrate workloads.

What broke in Zeabur shutting down after second security

The primary breakdown stemmed from administrator access tokens that were never expired or rotated after an earlier breach. Zeabur created administrator tokens in January 2024 without expiration dates, stored credentials in unencrypted plaintext, and left administrative portals open to the public internet. When the company suffered an initial intrusion in late August 2026, security staff rotated various credentials but omitted these original administrator tokens. Consequently, attackers maintained persistent access that bypassed perimeter defenses and enabled lateral movement into production systems across nine distinct hosting regions.

Infrastructure isolation also collapsed beneath rapid platform scaling. Strong growth across a record-setting 2026 created operational complexity that overwhelmed internal maintenance capabilities. Weak barriers between hosted customer applications and core management systems allowed the intruder to leverage stolen cloud access keys and administrator credentials to penetrate internal clusters. Attackers escalated privileges, signed in as root on 101 Google Cloud Platform servers assigned to 92 users, and attached 16 customer disk copies directly to attacker-controlled virtual machines, demonstrating complete administrative control.

Who is exposed by Zeabur shutting down after second security

The incident directly impacted account records for 321,810 users registered across Zeabur's hosting network. Because developers connect GitHub repositories to automate application deployments, infrastructure secrets and configuration parameters stored inside the platform were widely exposed. The exfiltrated production database contained roughly 3.2 million environment variable records tied to active services. Any developer utilizing the service to deploy web applications, manage databases, or automate HTTPS routing within the platform's nine hosting regions had their stored environment variables, API tokens, and operational parameters exposed to the intruder.

Users managing dedicated cloud infrastructure experienced severe system-level exposure. Zeabur confirmed that the attacker gained root access on 101 Google Cloud Platform servers utilized by 92 accounts. Attackers also installed unauthorized SSH keys on 50 servers to establish persistence and copied 16 customer disk volumes to external virtual machines. Environment variables previously migrated to customers' own servers during August remediation escaped the database dump, but remained vulnerable if their dedicated host was compromised. Every organization hosting dedicated instances faces deep exposure.

What to do now about Zeabur shutting down after second security

Engineering teams must immediately rotate all credentials and secrets to prevent downstream account takeovers. Users should revoke and reissue every API key, private token, database password, and webhook secret stored within Zeabur environment variables. Because application environments frequently store credentials for external platforms like AWS, GitHub, and payment systems, teams must treat all exposed variables as compromised. Organizations should also terminate active user sessions, revoke connected OAuth authorizations, and audit external cloud logs for anomalous calls originating from the nine affected regions.

For compute infrastructure, administrators must rebuild compromised Google Cloud Platform instances from clean machine images. Zeabur recommends completely reinstalling affected hosts because attackers embedded unauthorized SSH keys across 50 servers to retain persistent access. Meanwhile, engineering teams must transition workloads to alternative hosting providers before platform operations cease. Zeabur will disable renewals and pause all services on shared clusters on December 1, 2026. All dedicated servers will expire and shut down by December 31, 2026, leaving limited time to export application databases and update DNS configurations.

How the Zeabur shutting down after second security issue works

The breach developed as a multi-stage intrusion stemming from vulnerabilities exposed during an earlier incident. In late August 2026, attackers exploited a flaw in a customer's NextChat deployment and traversed poorly isolated internal networks. That initial attack exposed AWS credentials and granted access to the central production database. Although Zeabur responded, unencrypted administrator tokens created in January 2024 were left unrotated. On October 14 and October 15, 2026, attackers used these leaked credentials to access public-facing administrative portals, gaining privileged entry without needing to bypass firewalls or exploit zero-day bugs.

With administrative privileges secured, the intruder used cloud keys and administrator credentials to compromise shared clusters and dedicated instances across nine regions. Attackers logged in as root on 101 Google Cloud Platform servers, added SSH keys to 50 machines, and attached 16 customer disk copies directly to their own virtual instances. They subsequently read the production database to exfiltrate 3.2 million environment variable records and 321,810 user profiles. When attackers hold valid administrative credentials, traditional security systems block only 37 percent of malicious actions.

What is still unknown about Zeabur shutting down after second security

Several critical technical aspects of the security incident remain unconfirmed by Zeabur. Although investigators suspect the attackers obtained the plaintext administrative tokens during the August NextChat intrusion and AWS compromise, the company has not confirmed this transmission path. Furthermore, the identities and origins of the threat actors behind the August and October attacks remain unknown. Zeabur has not published attribution details identifying who executed the unauthorized root logins, installed persistent SSH keys on 50 servers, or attached the 16 customer disk volumes to external virtual machines.

Significant uncertainty also remains regarding customer transition timelines and data retention policies. While Zeabur indicated that users might receive additional time beyond the December deadlines to complete data migrations, the company has not published specific schedules or technical extension procedures. Additionally, Zeabur has not clarified whether external forensic investigators or law enforcement agencies are handling the breach. Questions also persist concerning how the company will securely wipe residual data, orphaned customer disk copies, and exfiltrated database records when all infrastructure operations permanently terminate on December 31, 2026.