Developer hosting platform Zeabur has disclosed a second security incident in as many months and announced it will shut down entirely rather than continue operating. The company says attackers used leaked internal credentials, stored in plaintext, to break into its infrastructure and steal more than 3.2 million environment-variable records along with data tied to 321,810 accounts.
According to Zeabur, the intrusion occurred on October 14 and 15, 2026, when an attacker used stolen administrator credentials and cloud access keys to compromise the shared hosting cluster, several dedicated servers, and internal systems, ultimately reading the production database. The breach affected shared clusters across nine regions.
Zeabur confirmed root sign-ins on 101 Google Cloud Platform servers by 92 separate users. The attackers added SSH keys to 50 servers and attached 16 copies of customer disks to their own virtual machines, giving them broad access to hosted data.
Tied to the August breach
Zeabur believes, though has not confirmed, that the credentials used in this latest attack were obtained during an earlier breach in late August 2026. That incident began when attackers exploited a flaw in a customer’s NextChat application and pivoted through poorly isolated internal systems, eventually stealing AWS credentials and accessing the production database, exposing account information, API keys, and other secrets.
The company admitted that administrator account credentials were never fully rotated after the August incident, and admin portals remained reachable from the public internet. Zeabur said admin tokens had no expiry, had not been rotated since their creation in January 2024, and were excluded from the post-August credential rotation.
Environment variables that customers had already migrated to their own servers following the August response were not exposed in this latest database compromise, although hosts that were compromised directly could still leak that data.
Shutdown planned for December
Zeabur announced it will cease operations starting December 1, 2026, with renewals disabled and shared cluster services paused that day. Dedicated servers will expire and shut down by the end of December, at which point all shared clusters will stop entirely. The company said users may receive additional time for data migration, though no firm timeline has been set.
Zeabur described the decision as the result of scaling difficulties following 3.5 years of growth, saying the recent security failures reflected an operation that had become too complex to maintain responsibly.
Affected users are urged to immediately rotate exposed credentials and secrets, revoke all active sessions, and rebuild any compromised GCP servers.
