Zeabur Security Review After October 2026 Breach and Shutdown

Zeabur suffered unauthorized access between October 14 and 15, 2026, that exposed 3.2 million environment variable records and prompted the platform's complete shutdown by the end of the year. The incident followed an August breach and stemmed from long-lived administrative credentials stored in plaintext. Users must rotate every secret and complete migrations before December 31 to avoid data loss.

Zeabur Security Review of the October 2026 Incident

Attackers used compromised internal credentials to reach shared clusters across nine regions, dedicated GCP servers, and the platform database. Zeabur confirmed that cluster admin tokens created in January 2024 had never expired and remained in a private config repository. Partial fixes after the August incident left several keys unrotated, including shared cluster tokens and certain AWS and GCP credentials.

The company stated that an internal network node added from a compromised GCP server allowed read access to the database. Zeabur published a preliminary report on October 19 and declared the incident resolved on October 20 after revoking credentials and rotating its signing key. Founder Yuanlin Lin accepted responsibility for the root cause in credential handling.

Zeabur also confirmed root sign-ins on 101 GCP dedicated servers belonging to 92 users. Attackers added SSH keys to 50 of those servers and attached 16 customer disk copies to their own virtual machines. Logging limitations prevent full confirmation of how much data was copied from the 865 database services that received read commands.

Data Exposure and User Impact

The breach affected 3,218,965 environment variable records containing both names and values. It also exposed 321,810 accounts with email addresses, usernames, phone numbers, and project metadata. In addition, 566 plaintext zSend API keys and 11,536 hashed platform access tokens were accessed before revocation.

Zeabur advised every user to rotate passwords, API keys, and secrets across all connected services, including third-party providers such as OpenAI and Anthropic. Owners of dedicated GCP servers received instructions to reset root passwords, remove unknown SSH keys, and rebuild from clean images where necessary.

Users can submit claims for losses related to the incident through Zeabur support until November 30, 2026. Refunds for unused service time follow the same deadline. The company has stopped all new dedicated server and domain purchases.

Platform Shutdown Timeline and Migration Steps

Zeabur announced its wind-down in mid-October 2026, citing ongoing security and operational challenges after two breaches within two months. Dedicated server renewals stop on December 1, 2026, and all such servers expire by December 31. Shared cluster services pause on the same date, with limited options for manual backup resumption.

All platform services cease operation on December 31, 2026, followed by data deletion. Zeabur offers migration assistance and recommends that users complete backups and transfers by late November or early December. No further official updates on the investigation have been published as of October 27, 2026.