By ByteBot
Zeabur, a developer hosting and deployment platform, is shutting down after its second major security breach in under two months. The October 14–15 incident exposed 321,810 accounts and more than 3.2 million environment variable records — API keys, database credentials, application secrets, all of it. The platform will go dark on December 31, 2026. If you used Zeabur, rotate everything you stored there now.
How the October Breach Unfolded
The attack started at 01:36 UTC on October 14. Attackers used AWS keys that had been leaked in August’s breach — keys that Zeabur said it had rotated, but hadn’t fully. Within an hour, they had deployed a shared cluster admin token sitting in a plaintext config repository, unchanged since January 10, 2024. No expiry date. Nearly three years of exposure.
By 12:39 UTC, attackers had read every service setting and secret on the shared cluster. A second path opened at 13:40 UTC via plaintext GCP root passwords flagged as exposed on September 3 — six weeks earlier — and never fixed. That gave root access to 101 GCP servers across 92 customer accounts, with SSH keys added to 50 servers and 16 customer disk images copied to attacker-controlled virtual machines. The main database breach — 3.2 million environment variable records and 321,810 accounts — happened between 16:10 and 16:47 UTC. No alerts fired throughout 16-plus hours of activity.
August Set the Stage
Zeabur’s first breach came in August 2026. Attackers exploited a flaw in a customer’s NextChat application to access poorly isolated internal systems, then stole AWS credentials and reached the production database. Zeabur’s post-incident statement said all internal admin keys had been “disabled or rotated.” That turned out to be incomplete.
The company’s own post-mortem explains the gap: “The August rotation was scoped to keys confirmed as leaked. Plaintext credentials spread across configuration repository, code, build jobs, server initialization settings and backups sat outside that scope.” In short, they rotated what they knew about. The attacker used what they missed. Partial rotation after a breach creates a false sense of closure — and that gap is exactly what the second attacker walked through.
The Real Failure: Credential Hygiene Basics
Nothing about this attack was sophisticated. An admin token created in January 2024 — nearly three years before the breach — sat in plaintext with no expiry date. Admin portals were accessible from the public internet with no VPN or IP restriction. GCP root passwords known to be exposed for six weeks went unfixed. This is the foundational security hygiene that every platform handling developer secrets must get right, and Zeabur failed it twice.
Zeabur’s funding context matters: the company raised $2 million in seed funding. Vercel raised $300 million in its Series F. Render has taken $258 million total. That funding gap translates into security infrastructure — dedicated security teams, automated rotation pipelines, monitoring that catches 16-hour intrusions. According to BleepingComputer’s coverage, Zeabur’s founder acknowledged the platform “began as a project built quickly three and a half years ago,” with architecture complexity that outpaced the team’s capacity to secure it.
Related: LiteLLM PyPI Supply Chain Attack: Rotate Your Keys Now
What You Need to Do
If you stored credentials on Zeabur — and environment variables mean you almost certainly did — treat them as compromised. Rotate every secret immediately: database passwords, API keys, OAuth tokens, service account credentials. Don’t wait to confirm your account was in the 321,810. Assume it was. The TEISS report on the breach confirms the scope is broad.
For users with dedicated servers: check for unauthorized SSH keys, rebuild compromised servers from scratch rather than attempting cleanup, and verify no attacker-controlled GCP nodes were added to your infrastructure. The timeline shows attackers had root access for hours before hitting the platform database.
On migration: Zeabur disables renewals on December 1. All services shut down December 31. That gives you roughly ten weeks to move workloads. Start now — not because the deadline is close, but because you should not run live traffic on a platform with two confirmed breaches and a shutdown in progress. For best practices on secret storage going forward, env.dev’s environment variable guide covers the managed secrets approach (AWS Secrets Manager, HashiCorp Vault) that prevents this class of attack.
Key Takeaways
- Rotate all Zeabur-stored secrets immediately — database passwords, API keys, OAuth tokens, everything
- After any breach, rotate credentials an attacker could have reached, not just those confirmed leaked
- Admin tokens need expiry dates; credentials in plaintext config repos are liabilities, not just bad practice
- Developer platforms storing secrets are high-value targets — this is the third credential-leak story this week after Railway and LiteLLM
- Zeabur services end December 31, 2026; migrate workloads before December 1 when renewals are disabled
