.jpg "Second Zeabur Breach Exposes Cloud Infrastructure Weaknesses")
.jpg)
Zeabur, a cloud development platform, has announced plans to shut down their services following a second major security breach in less than two months. A malicious attack occurred on October 14-15, 2026, which resulted in unauthorized access to internal systems, compromised hosting infrastructure, and the reading of sensitive information belonging to more than 321,000 accounts.
As stated by Zeabur's preliminary incident report, the attacker was able to gain access to shared hosting clusters in nine regions as well as several dedicated servers by using leaked administrator credentials and cloud access keys. An internal configuration repository contained plaintext credentials, and administrator tokens were still active without expiration and had not been rotated since January 2024.
Approximately 3.2 million environment-variable records including application settings, API keys, and other secrets were exposed in the breach, along with account information for 321,810 users. Zeabur further confirmed that 92 Google Cloud Platform (GCP) servers were accessed unauthorizedy by root accessers. In addition to adding their own SSH keys to 50 servers, hackers attached 16 copies of customer server disks to virtual machines that were under their control with their own SSH keys.
During the investigation, records indicate that the attacker compromised both shared infrastructure as well as dedicated servers, and gained access to the production database through their internal network. Insufficient audit logs, Zeabur observed, prevent the full extent of data exposure from being confirmed. The attacker read service configurations, searched for API keys, and accessed data within hundreds of database services.
Security Failures Linked to Earlier Breach
A separate security breach occurred in August 2026, when attackers exploited a vulnerability in the NextChat application of a customer, then migrated through internal systems that were insufficiently isolated.
In the incident, Amazon Web Services credentials, API keys, and other sensitive information were exposed Zeabur believes the credentials used in the latest attack may have been obtained during the earlier breach, although a connection has not been confirmed.
In its August response, the company acknowledged that not all affected credentials were addressed, resulting in the activation of certain administrator tokens and cloud keys.
As part of the investigation, the investigator identified public administrator interfaces, plaintext storage of sensitive credentials, and excessive cloud permissions as factors contributing to the severity of the attack.
The attack began on October 14, but was only identified following a user report on October 15.
In response to discovery, the company revoked compromised access tokens and cloud keys, blocked public SSH access to affected GCP servers, and restricted internal access to internal systems.
Users have been advised to replace passwords, API keys, and other secrets, revoke existing sessions, and rebuild compromised servers.
There is also concern about the security of shared cloud hosting environments following the breach, which can expose multiple customer workloads with only a single compromised set of credentials.
Zeabur's shutdown program will commence on December 1, when renewals are disabled and services running on shared clusters are paused.
However, all remaining infrastructure is scheduled to cease operation by December 31, 2026, despite remaining dedicated servers remaining available until their respective expiration dates.
As the company has not yet provided a final date for data export or deletion, customers who need additional time to migrate their data are advised to contact customer service for further assistance.
During the investigation, Zeabur also revealed gaps in its monitoring and incident response systems. It took 36 hours for the investigation to begin after the attacker's first known use of credentials on October 14 was revealed.
During that time, no alerts were triggered; a user report was the cause of the investigation.
A two-part attack converged within Zeabur's internal network as the attacker gained access to shared clusters and Google Cloud servers managed by customers. The attacker is believed to have acquired root passwords stored in plaintext in server initialization settings by using an older Google Cloud key.
It was then the attacker's responsibility to add SSH keys to 50 servers to maintain access, as well as attach copies of customer disks to virtual machines within Zeabur's own cloud project. These disk copies have since been deleted by Zeabur, which believes the credentials used in October were obtained during the August incident, during which an attacker accessed Zeabur's GitHub private key.
With that key, access was granted to code repositories, including a private repository containing the exposed credentials and administrator tokens. Despite Zeabur replacing the GitHub App key on August 31st, the credentials stored in the repository were not altered, making it possible to retrieve previously copied secrets.
There is no evidence of a direct connection between the two incidents, nor did the IP addresses of the attackers overlap.
All users were notified that Zeabur has revoked their access tokens in response to the latest security breach. Customers were advised to replace credentials and secrets stored on the platform, including those changed after the August incident, and to re-create their access tokens.
The owners of affected Google Cloud servers were also advised to make a backup of their data and rebuild their systems to prevent any unauthorized access remaining.
Following 3.5 years of growth, the company decided to close after citing increasing operational complexity and difficulty maintaining its platform as factors.
As a result of these two breaches, credential management, infrastructure isolation, and security monitoring vulnerabilities were also exposed, raising concerns concerning the potential risks associated with maintaining sensitive deployment secrets across shared cloud environments.
Zeabur's incidents highlight the risks associated with unrotated credentials, publicly exposed administrative interfaces, and inadequate security monitoring in cloud computing facilities.
A shutdown like this also emphasizes the importance of securing resources, managing secrets securely, and detecting incidents promptly in order to ensure that customer data is protected.
