Zeabur Shuts down after second security breach in two months

Plaintext credentials and unrotated administrator tokens enabled the second breach, which exposed 321,810 accounts and 3.2 million environment variables.

Zeabur, a developer hosting and deployment platform, announced on Oct. 17, 2026, that it will shut down effective Dec. 1, 2026, with all services ceasing by Dec. 31, 2026. The shutdown follows two security breaches in two months, the most recent of which occurred on Oct. 14–15, 2026, when attackers used leaked internal credentials stored in plaintext to compromise infrastructure and exfiltrate data.

The October breach exposed data for 321,810 accounts and 3.2 million environment-variable records, including API keys, database connection strings, and other secrets. Zeabur says the October incident affected a broader scope than the August incident, and the investigation was ongoing when the shutdown announcement was published.

Zeabur began emergency response as soon as unusual activity was detected during the October incident, and it has taken measures to contain all known attack paths while continuing to monitor for unusual activity. The October breach saw attackers gain root access to 101 Google Cloud Platform servers, add SSH keys to 50 servers, and attach 16 customer disk copies to their own virtual machines. Zeabur confirmed root sign-ins on 101 GCP servers by 92 users during the October incident. The breach affected shared clusters across nine regions.

Zeabur’s administrator tokens had no expiration date, were not rotated since January 2024, and were excluded from the post-August rotation. Its administrator portals remained publicly accessible from the internet, increasing the risk of unauthorized access. Zeabur’s internal credentials were stored in plaintext, a critical security failure that allowed attackers to reuse them after the August breach. Zeabur believes the credentials used in the October breach were obtained during the August breach, though this has not been confirmed.

The first breach occurred in late August 2026, when attackers exploited a flaw in a customer’s NextChat application and moved through poorly isolated internal systems. In that incident, hackers stole AWS credentials, accessed the production database, and exposed account information, API keys, and other stored secrets. Zeabur’s environment variables that had previously been migrated to customers’ own servers during the August incident response were not exposed in the latest breach, though compromised hosts could still pose a risk.

Zeabur will disable renewals for dedicated servers starting Dec. 1, 2026, with all servers shutting down by their expiration dates between December 1 and December 31. The platform will pause all running services on shared clusters starting Dec. 1, 2026, though users can manually restart services to back up data. Zeabur will stop accepting purchases of new dedicated servers and domains immediately and begin processing account balance refunds. It will provide a migration guide to assist customers in moving their services and data off the platform, including a Markdown version for coding agents such as Claude Code and Codex.

The migration guide will be updated to cover more commonly used services and migration scenarios. Zeabur said users may be given additional time for data migration, though no concrete timelines have been provided. Domains purchased through Zeabur can be transferred out from the Dashboard, and Zeabur will help transfer them to another registrar. Account balance refunds and incident compensation claims are separate requests through Zeabur Support, and customers must specify which they are requesting.

Zeabur’s founder, Yuanlin Lin, apologized for the security failures and acknowledged the burden placed on customers due to the shutdown. In a statement, Lin said, “I’m sorry we weren’t able to prevent what happened, and that we won’t be able to keep Zeabur going.” Zeabur had operated for about three and a half years, and the past year brought its fastest growth, but growth has run into limits. The company said scaling to meet market demand made the project increasingly complex and difficult to maintain.

Zeabur’s system began as a project built quickly three and a half years ago, and architecture changes made it increasingly complex and difficult to maintain. AI tools such as n8n, OpenClaw, and vibe coding created high demand for cloud deployment, while AI also made deployment easier, forcing the company to rethink its lasting value. Zeabur’s shutdown is a cautionary tale for developer platforms and DevOps vendors about the risks of poor credential management and inadequate security practices.

The incident underscores the need for encrypted credential storage, regular rotation, and zero-trust security models. Zeabur will issue a follow-up announcement explaining how unresolved cases will be handled regarding support arrangements, and it promised updates on the full scope of impact and a more complete report as the investigation progresses.

Zeabur expects higher support request volume and warns replies may take longer than usual. If migration within the timeline is difficult, customers can contact Zeabur Support early to discuss options individually. Customers can also e-mail founder Yuanlin Lin directly at yuanlin@zeabur.com for general messages, though he may reply more slowly than Zeabur Support.

Customers who use Zeabur should change any exposed credentials and secrets immediately, cancel all active sessions, and rebuild any compromised GCP servers, Zeabur said. Customers should verify backups are complete and that services work in the new environment after migration, rather than waiting for a data deletion deadline that has not been finalized.