Zeabur (developer hosting platform) breached again on 14–15 October with leaked plaintext admin credentials: 321,810 accounts and 3.2 million stored environment-variable records read, root logins on 101 customer GCP servers; the company is shutting down by 31 December
Developer hosting and deployment platform Zeabur published a preliminary report on 19 October 2026 on a second breach in two months. It says that on 14–15 October an attacker used leaked Zeabur internal credentials (AWS keys and shared-cluster admin tokens stored in plaintext in a private configuration repository, with no expiry and never rotated since January 2024) to break into its shared clusters in nine regions, some customer Dedicated Servers and internal systems, and eventually read the platform database. Zeabur says the root cause was its own: long-lived admin credentials stored in plaintext and usable from the public internet, which its rotation after the late-August breach did not cover. Confirmed exposure includes 3,218,965 service environment-variable records (names and values), account, project and service data for 321,810 accounts, and 566 plaintext zSend API keys (revoked). The attacker ran commands inside 865 customer database services, including n8n instances whose encryption keys sat in environment variables (602 of 607 checked), so their stored third-party credentials were effectively exposed, and planted a program that called back to an external host in at least two PostgreSQL databases in Tokyo. The attacker signed in as root to 101 customer servers on Google Cloud using root passwords stored in plaintext in server initialisation settings, added their own SSH keys on 50 of them, and attached 16 copies of customer disks to five virtual machines they created. They also read about 53 production secrets, including the Zeabur GitHub App private key (rotated; no use found), and tokens for managing customer servers at Hetzner and DigitalOcean leaked with the database (revoked 16 Oct). Database backups in the Taipei and Hong Kong regions may have been downloaded. More than 16 hours of activity on 14 October raised no alerts; Zeabur learned of it from a user report. Zeabur has signed out all users, revoked all platform access tokens and leaked keys, and blocked public SSH to admin interfaces. On 17 October founder Yuanlin Lin announced the platform will wind down: new purchases have stopped, shared-cluster services pause and server renewals stop from 1 December, and everything shuts down by 31 December 2026. No country breakdown of affected users has been published. Primary: Zeabur preliminary report (19 Oct) and shutdown notice (17 Oct); wire: BleepingComputer (20 Oct).
- Product
- Zeabur developer hosting platform (shared clusters in nine regions, Dedicated Servers on GCP, Hetzner, DigitalOcean and others; zSend; GitHub App)
- Versions
- n/a — cloud platform incident
- Exploited in Australia?
- unknown
- Patch to
- If you deploy on Zeabur: replace every password, API key and token stored in Zeabur environment variables, even if you rotated them after August, and change passwords inside your databases too (changing the variable alone does not). For n8n, replace the encryption key and recreate all stored credentials; for new-api/one-api, revoke upstream AI service keys. Treat GCP Dedicated Servers as compromised: back up and rebuild, or at minimum remove SSH keys labelled zeabur-pentest or unrecognised, check cron, systemd, sudoers and k3s workloads, change root and disable SSH password login. Review bills from 14 October (GCP server users from 1 September), check GitHub repositories linked to the Zeabur app for unexpected deploy keys, webhooks or pushes, and plan migration before services pause on 1 December 2026.
Primary: Zeabur — October 2026 security incident (preliminary report, 19 Oct 2026) · Vendor: Zeabur — Zeabur is shutting down: what happens next (17 Oct 2026); status: status.zeabur.com · BleepingComputer — Zeabur shutting down after second security breach in two months (20 Oct 2026)