Do Son 
Zeabur Will Close Its Hosting Services
Developer deployment platform Zeabur will stop its shared cluster and dedicated server services by the end of December 2026. Security problems are the main reason. The company says it can no longer provide good service after repeated data breaches.
Earlier, an attacker read 3.21 million environment variable records and 321,800 account records from Zeabur’s databases. Zeabur says these incidents exposed deep security and operations problems, and they pushed the team to end operations.
How Plaintext Credentials Opened the Door
Zeabur’s preliminary incident report describes what happened between October 14 and 15. The attacker used internal AWS keys, cluster management tokens, and GCP keys. With them, the attacker entered the shared clusters, some dedicated servers, and internal systems.
Weak Credential Hygiene
The report points to several basic failures:
- The credentials sat in plaintext in a configuration repository.
- The cluster management interface was open to the public internet.
- The management tokens stayed valid for a long time and were never rotated.
What the Attacker Took
The attacker read 3.21 million environment variable records from the platform database. The attacker also read 321,800 account records, which hold email addresses, usernames, and phone numbers.
In addition, 566 zSend API keys and 11,536 platform access tokens fell within the scope of the breach.
Root Access to Dedicated Servers
The attacker logged in with root privileges to 101 GCP dedicated servers that Zeabur manages. On 50 of them, the attacker added their own SSH public key. Moreover, the attacker mounted disk copies of 16 customer servers onto virtual machines that the attacker had created.
What Zeabur Users Should Do
Zeabur advises users to replace the secrets they stored on the platform without delay. That covers API keys, cloud credentials, and database passwords.
Users of GCP dedicated servers should treat their hosts as compromised. They should back up their data and rebuild the servers.
A Lesson for Platform Customers
The case shows why customers should not place blind trust in any hosting platform. Plaintext credentials and tokens that never rotate are basic security failures. Over time, such habits make a breach likely, not just possible.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
