Zeabur breached twice in two months via leaked plaintext credentials; 321,810 accounts exposed, platform shutting down
Zeabur, a developer hosting and deployment platform, disclosed that on October 14-15, 2026 an attacker used leaked internal credentials stored in plaintext to compromise its shared clusters, some Dedicated Servers and internal systems, and ultimately read the production database. The breach affected shared clusters in nine regions, 321,810 accounts and roughly 3.2 million environment-variable records. It is the second incident in two months, after an August 2026 breach that began with exploitation of a flaw in a customer's NextChat application and led to theft of AWS credentials. Zeabur says the attackers likely obtained the credentials during the August breach, but this is unconfirmed. Following the incident, Zeabur announced it will wind down, with services paused from December 1, 2026 and the shutdown completed by December 31, 2026.
Technical Details
- Attackers used stolen administrator credentials and cloud access keys to compromise shared hosting and dedicated servers, then accessed the production database.
- Zeabur confirmed root sign-ins on 101 GCP servers by 92 users, SSH keys added to 50 servers, and 16 customer disk copies attached to the attackers' own virtual machines.
- Root causes: credentials not stored in encrypted form; admin tokens had no expiry, had not been rotated since creation in January 2024 and were excluded from the post-August rotation; administrator portals were reachable from the public internet.
- Variables previously migrated exclusively to customers' own servers after the August incident were not exposed in the database, although compromised hosts could still expose them.
Remediation
- Rotate all exposed credentials and secrets immediately.
- Revoke all active sessions.
- Rebuild compromised GCP servers.
- Plan data migration off the platform ahead of the December 2026 shutdown.
Linha do tempo
-
Zeabur breached twice in two months via leaked plaintext credentials; 321,810 accounts exposed, platform shutting down
ler a análise desta fonte ocultar
Zeabur, a developer hosting and deployment platform, disclosed that on October 14-15, 2026 an attacker used leaked internal credentials stored in plaintext to compromise its shared clusters, some Dedicated Servers and internal systems, and ultimately read the production database. The breach affected shared clusters in nine regions, 321,810 accounts and roughly 3.2 million environment-variable records. It is the second incident in two months, after an August 2026 breach that began with exploitation of a flaw in a customer's NextChat application and led to theft of AWS credentials. Zeabur says the attackers likely obtained the credentials during the August breach, but this is unconfirmed. Following the incident, Zeabur announced it will wind down, with services paused from December 1, 2026 and the shutdown completed by December 31, 2026.
Technical Details
- Attackers used stolen administrator credentials and cloud access keys to compromise shared hosting and dedicated servers, then accessed the production database.
- Zeabur confirmed root sign-ins on 101 GCP servers by 92 users, SSH keys added to 50 servers, and 16 customer disk copies attached to the attackers' own virtual machines.
- Root causes: credentials not stored in encrypted form; admin tokens had no expiry, had not been rotated since creation in January 2024 and were excluded from the post-August rotation; administrator portals were reachable from the public internet.
- Variables previously migrated exclusively to customers' own servers after the August incident were not exposed in the database, although compromised hosts could still expose them.
Remediation
- Rotate all exposed credentials and secrets immediately.
- Revoke all active sessions.
- Rebuild compromised GCP servers.
- Plan data migration off the platform ahead of the December 2026 shutdown.