INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Zeabur suffers second security breach in two months

| 2026-10-20 19:33 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
On October 14-15, 2026, an attacker used leaked Zeabur internal credentials to break into the shared cluster, some Dedicated Servers, and Zeabur internal systems, eventually reading the platform database. The attackers exploited a flaw in a customer's NextChat application in late August 2026, leading to the theft of AWS credentials and access to the production database. This incident affected over 321,810 accounts and roughly 3.2 million environment-variable records across nine regions. Zeabur is a developer hosting and deployment platform that lets developers connect a GitHub repository and have the platform handle deployment, databases, HTTPS, and infrastructure management. The attackers used stolen administrator credentials and cloud access keys to compromise Zeabur's shared hosting infrastructure and dedicated servers. As a result of this incident, Zeabur will shut down its services starting December 1, 2026, with completion by December 31, 2026.
Technical Mitigations AI-generated
• Use a secure password manager to store and rotate administrator account credentials, as Zeabur failed to do so since January 2024. • Regularly monitor for SSH keys added to servers and customer disk copies attached to virtual machines, as attackers did in the recent incident. • Implement a rotation policy for admin tokens with expiry dates to prevent prolonged access to sensitive data.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope technologytechnology
Incident Timeline
‎October 14–15, 2026
An attacker used leaked Zeabur internal credentials to break into the shared cluster, some Dedicated Servers, and Zeabur internal systems.
‎January 2024
Admin tokens created in January 2024 had not been rotated, contributing to the second security breach at Zeabur.
‎late August 2026
Threat actors exploited a flaw in a customer's NextChat application to gain unauthorized access, then moved through poorly isolated internal systems.
‎August 2026
Attackers compromised Zeabur's systems, obtaining AWS credentials and accessing production database secrets through a broader breach affecting shared clusters across nine regions.
organisation AWS
This led to the theft of AWS credentials and access to the production database, exposing account information, API keys, and other secrets stored there.
organisation API
This led to the theft of AWS credentials and access to the production database, exposing account information, API keys, and other secrets stored there.
organisation GCP
Also, Zeabur confirmed root sign-ins on 101 GCP servers by 92 users, with the attackers adding SSH keys to 50 servers and attaching 16 customer disk copies to their own virtual machines.
organisation SSH
Also, Zeabur confirmed root sign-ins on 101 GCP servers by 92 users, with the attackers adding SSH keys to 50 servers and attaching 16 customer disk copies to their own virtual machines.
infrastructure 101 GCP servers
Also, Zeabur confirmed root sign-ins on 101 GCP servers by 92 users, with the attackers adding SSH keys to 50 servers and attaching 16 customer disk copies to their own virtual machines.
victims 92 users
Also, Zeabur confirmed root sign-ins on 101 GCP servers by 92 users, with the attackers adding SSH keys to 50 servers and attaching 16 customer disk copies to their own virtual machines.
infrastructure 50 servers
Also, Zeabur confirmed root sign-ins on 101 GCP servers by 92 users, with the attackers adding SSH keys to 50 servers and attaching 16 customer disk copies to their own virtual machines.
data_breach 3.2 variable records
In the latest incident, Zeabur says the compromise was broader, affecting shared clusters across nine regions, 321,810 accounts, and roughly 3.2 million environment-variable records.
‎2026/10/20
Threat actors used leaked internal credentials stored in plaintext to compromise Zeabur's infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts.
organisation HTTPS
Attack chain Source: Zeabur Zeabur is a developer hosting and deployment platform that lets developers connect a GitHub repository and have the platform handle deployment, databases, HTTPS, and infrastructure management.
data_breach 3.2 variable records
Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts.
‎December 1, 2026
Zeabur will shut down its services from December 1, 2026 to December 31, 2026 following a second security breach in two months.
industry Technology
General Document Context
‎December 1
Zeabur will disable renewals and pause all running services on shared clusters starting December 1.
‎December 31, 2026
Zeabur will shut down its services from December 1, 2026 to December 31, 2026 following a second security breach in two months.
industry Technology
General Document Context
organisation The Blue Report 2026
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Tactical Metrics
Metrics
infrastructure
101
Gcp Servers
Also, Zeabur confirmed root sign-ins on 101 GCP servers by 92 users, with the attackers adding SSH keys to 50 servers and attaching 16 customer disk copies to their own virtual machines.
Metrics
victims
92
Users
Also, Zeabur confirmed root sign-ins on 101 GCP servers by 92 users, with the attackers adding SSH keys to 50 servers and attaching 16 customer disk copies to their own virtual machines.
Metrics
infrastructure
50
Servers
Also, Zeabur confirmed root sign-ins on 101 GCP servers by 92 users, with the attackers adding SSH keys to 50 servers and attaching 16 customer disk copies to their own virtual machines.
Metrics
data_breach
3,200,000
Variable Records
Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts.
In the latest incident, Zeabur says the compromise was broader, affecting shared clusters across nine regions, 321,810 accounts, and roughly 3.2 million environment-variable records.
Intelligence Sources
BleepingComputer 2026-10-20