Zeabur Shuts Down After Second Security Breach
Development platform Zeabur has announced it is permanently shutting down its operations following a devastating second cybersecurity incident in the span of two months.
Radwan AbdulhadiEditor and technology writer
The October Security Incident
Development and hosting platform Zeabur has disclosed details of a major cybersecurity incident that occurred between October 14 and 15, 2026. According to <a href="https://zeabur.com/blogs/october-2026-security-incident">Zeabur’s announcement reads</a>, an attacker used leaked internal credentials stored in plaintext to compromise the platform's shared cluster, dedicated servers, and internal systems before ultimately reading the main production database.
The attackers utilized stolen administrator credentials and cloud access keys to penetrate Zeabur's infrastructure. This breach exposed information for 321,810 accounts and over 3.2 million environment variable records, affecting shared clusters across nine distinct regions. Furthermore, the company confirmed root sign-ins on 101 Google Cloud Platform (GCP) servers by 92 users, with unauthorized actors adding SSH keys to 50 servers and attaching 16 customer disk copies to their own virtual machines.
Prior Vulnerabilities and August Breach
The latest intrusion follows a previous event that occurred in late August 2026, when the company <a href="https://zeabur.com/blogs/august-2026-security-incident">suffered another security breach</a> after hackers exploited a flaw in a customer's NextChat application and moved through poorly isolated internal systems.
That initial incident led to the theft of AWS credentials and granted unauthorized access to the production database, exposing API keys, account information, and other stored secrets. Zeabur noted that attackers likely obtained the credentials used in the subsequent October attack during the August breach, though this has not been definitively confirmed.
Investigations revealed glaring security lapses during the interim period. Beyond failing to store sensitive credentials in an encrypted form, Zeabur neglected to rotate all administrator account credentials following the August incident, leaving administrative portals directly accessible to the public internet. Administrative tokens lacked expiry dates, had remained unrotated since their creation in January 2024, and were excluded from post-August rotation protocols.
Decision to Wind Down Operations
Following the culmination of these security failures and mounting maintenance challenges, the platform <a href="https://zeabur.com/blogs/zeabur-is-shutting-down">explained Zeabur</a> that it has made the definitive decision to close its doors permanently.
Although the project experienced 3.5 years of continuous growth including a record year in 2026, scaling the infrastructure to meet market demand proved increasingly complex. The recent security failures highlighted the unsustainable nature of maintaining the platform under current conditions. Company leadership noted that after long discussions and struggling with what steps to take following the August event, the latest incident forced a reassessment of operational responsibilities, leading to the choice to wind down.
Shutdown Timeline and User Guidance
The wind-down process is scheduled to begin officially on December 1, 2026, when service renewals will be disabled and all running services on shared clusters will be paused. By December 31, 2026, all dedicated servers will expire and shut down completely, and shared clusters will cease to function entirely. Additional time for data migration may be granted to users, though concrete timelines for extensions have not yet been finalized.
In the meantime, affected users are strongly advised to take immediate protective measures. Recommendations include rotating exposed credentials and secrets right away, revoking all active sessions, and rebuilding any compromised GCP servers to ensure unauthorized access points are completely eradicated.
Sources
- BleepingComputerZeabur shutting down after second security breach in two months
Continue chronologically
Related entity coverage
Related stories
Securing Quick Access from Corporate Networks With AWS PrivateLink
Learn how to connect on-premises data sources to Amazon Quick privately using AWS PrivateLink, keeping enterprise analytics traffic off the public internet.
Building Ultra-Low-Latency Voice AI on AWS
Discover how Cartesia utilizes State Space Models and AWS infrastructure to deliver sub-100ms voice AI experiences globally.
Deploying NVIDIA Nemotron 3.5 Super VL on AWS EKS and SageMaker
Learn how to deploy the NVIDIA Nemotron 3.5 Super VL mixture-of-experts model on Amazon EKS, EKS Auto Mode, and SageMaker HyperPod EKS.
AWS Named Leader in 2026 Gartner CCaaS Magic Quadrant
Amazon Web Services has been recognized as a Leader in the 2026 Gartner Magic Quadrant for Contact Center as a Service for Amazon Connect.
