Zeabur has disclosed a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure, stealing more than 3.2 million environment variable records and information tied to 321,810 accounts. The development hosting and deployment platform said the intrusion occurred on October 14 and 15, 2026. According to the company, the attacker broke into its shared cluster, some dedicated servers and internal systems, and eventually read the platform database.
The attackers relied on stolen administrator credentials and cloud access keys to reach Zeabur's shared hosting infrastructure and dedicated servers before gaining access to the production database. Zeabur said the compromise affected shared clusters across nine regions. The company also confirmed root sign-ins on 101 GCP servers by 92 users, with the attackers adding SSH keys to 50 servers and attaching 16 customer disk copies to their own virtual machines.
Zeabur said the credentials used in this attack were likely obtained during an earlier breach in late August 2026, when hackers exploited a flaw in a customer's NextChat application and moved through poorly isolated internal systems. That incident led to the theft of AWS credentials and access to the production database, exposing account information, API keys and other secrets. Zeabur has not confirmed the link between the two incidents.
The company acknowledged that it failed to store credentials in encrypted form and did not rotate all administrator account credentials after the August incident, while administrator portals remained reachable from the public internet. Zeabur said the admin tokens had no expiry, had not been rotated since they were created in January 2024, and were not included in the post-August rotation. Users are being urged to rotate exposed credentials and secrets immediately, revoke all active sessions and rebuild compromised GCP servers.
Variables that had been migrated exclusively to customers' own servers during the August response were not exposed in the latest platform database leak, though compromised hosts could still expose them. Zeabur announced over the weekend that it will shut down its services starting December 1, 2026, and complete the wind-down by December 31, 2026. The company said scaling the project to meet market demand had grown increasingly complex and difficult to maintain, and that the recent security failures reflected that.
After the August incident, Zeabur said it spent a long time discussing what to do next, and following the latest incident it reassessed what keeping the service running would require and what responsibilities its team could carry. It ultimately decided to wind down. Renewals will be disabled on December 1 and all running services on shared clusters will be paused; by the end of the year, all dedicated servers will expire and shut down and all shared clusters will stop. Users may receive additional time for data migration, but no concrete timelines have been provided.
More cybersecurity news from TechManNews.
