● Covered by 1 source · 1 reportMedium impact1 negative
Zeabur to shut down after second security breach exposes 3.2 million environment variables
Key points
- Zeabur suffered a second major security breach.
- Attackers stole 3.2 million environment variables and 321,810 account records.
- Leaked plaintext internal credentials were used in the attack.
- Zeabur failed to rotate admin credentials after a prior August breach.
Second Major Breach Leads to Shutdown
Development platform Zeabur has announced its shutdown following a significant cybersecurity incident. Attackers gained access to Zeabur's infrastructure and production database using internal credentials stored in plaintext. This compromise resulted in the theft of over 3.2 million environment variable records and information pertaining to 321,810 user accounts.
Attack Vector and Scope
The attackers utilized stolen administrator credentials and cloud access keys to breach Zeabur's shared hosting infrastructure and dedicated servers. The incident, occurring on October 14–15, 2026, allowed access to the platform's database. The compromise affected shared clusters across nine regions and involved root sign-ins on 101 GCP servers, with SSH keys added to 50 servers and 16 customer disk copies attached to attacker virtual machines.
Prior Incident and Security Failures
This latest breach follows a previous security incident in late August 2026, where hackers exploited a flaw in a customer's application to access AWS credentials and the production database. Zeabur indicated that the credentials used in the second attack were likely obtained during the August breach. Critical security failures included storing credentials in unencrypted form, failing to rotate all administrator account credentials after the August incident, and leaving administrator portals accessible on the public internet. Admin tokens had no expiry and had not been rotated since January 2024.
User Actions Required
Users are advised to immediately rotate any exposed credentials and secrets, revoke all active sessions, and rebuild any compromised GCP servers. While some variables were migrated to customer-owned servers after the August incident and thus escaped this latest exposure, compromised hosts could still pose a risk.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
Development platform Zeabur is shutting down after a second security breach in two months, where attackers used leaked plaintext credentials to access infrastructure and steal over 3.2 million environment variable records and 321,810 account details. This incident follows a previous breach in August, highlighting critical security failures including unencrypted credentials and unrotated administrator tokens.