Zeabur, a hosting and deployment platform that lets developers connect a GitHub repository and have the platform run their apps and databases, has disclosed a second breach in two months and announced it is shutting down. In its incident report, Zeabur says that on October 14-15, 2026 an attacker used leaked internal credentials to get into its shared cluster, some dedicated servers and internal systems, and eventually read the platform database. According to BleepingComputer, that exposed information for 321,810 accounts and more than 3.2 million environment-variable records, which commonly hold API keys, cloud keys and database passwords.
Zeabur says the root cause was its own: long-lived admin credentials were stored in plaintext in a private configuration repository, and the admin interface of its shared cluster was open to the public internet. The admin tokens had no expiry and had not been rotated since January 2024, so they were not covered by the credential rotation done after the August incident. Zeabur says it cannot confirm how the attacker first obtained them but suspects a link to a GitHub App private key leaked in August. BleepingComputer also reports root sign-ins on 101 GCP servers by 92 users. Zeabur says it will shut its services down starting December 1, 2026, finishing by December 31.
How to check if you’re affected
Affected products are any apps, databases or servers you run on Zeabur, mainly on the shared cluster and on GCP dedicated servers. Zeabur says projects that moved their environment variables to their own dedicated server after the August incident were outside the platform-database read, though a compromised host could still expose them. Zeabur told users to act now rather than wait for an email.
- Replace every credential stored in Zeabur environment variables (API keys, cloud keys, database passwords, signing and encryption keys): revoke the old one with the service provider first, then create a new one and redeploy. Do this even if you already did it after August.
- Sign in again and recreate your Zeabur access tokens; all old ones were revoked.
- GitHub users: check your GitHub audit log for actions by the Zeabur GitHub App between October 15, 15:05 and 18:54 (look for unexpected clones or pushes, new deploy keys, changed webhooks).
- Check bills and usage for each service from October 14 onward; for GCP dedicated servers, go back to September 1.
- Shared-cluster users: change passwords inside your databases (changing the variable on Zeabur does not change the database password), and revoke any stored user sessions or tokens. For n8n, replace the encryption key and recreate third-party credentials; for new-api/one-api, revoke upstream AI service keys. Treat database backups in the Taipei (tpe1) and Hong Kong (hkg1) regions as leaked.
- GCP dedicated server users: treat the server as compromised, back up data and rebuild it. If you cannot yet, remove any
authorized_keysentry commented@zeabur-pentestor that you do not recognize, and check sudoers, crontab and systemd services.