# Developer Platform Zeabur Reportedly Closing Following Credential Attack

Development platform Zeabur has announced it will shut down by year-end following a breach in which attackers used leaked internal credentials stored in plaintext to compromise infrastructure and steal over 3.2 million environment variable records. The October 14 to 15 incident affected 321,810 accounts, shared hosting clusters across nine regions, and dedicated servers. Zeabur cited the complexity of maintaining secure infrastructure at scale and repeated security failures as reasons for winding down operations after 3.5 years. The company will disable renewals on December 1 and stop all services by December 31.

## October Breach Details

Between October 14 and 15, attackers used leaked Zeabur internal credentials to break into the shared cluster, some dedicated servers, and internal systems, eventually reading the platform database. The credentials were stored in plaintext.

The breach affected shared clusters across nine regions and exposed information for 321,810 accounts. Attackers obtained roughly 3.2 million environment-variable records. Zeabur confirmed root sign-ins on 101 GCP servers by 92 users, with SSH keys added to 50 servers and 16 customer disk copies attached to attacker virtual machines.


## Connection to Earlier Incident

Zeabur suffered a breach in late August when attackers exploited a flaw in a customer's NextChat application and moved through poorly isolated internal systems. That incident led to theft of AWS credentials and production database access.

The company stated attackers likely obtained the credentials used in October during the August breach, though it has not confirmed this. Admin tokens had no expiry, had not been rotated since creation in January, and were not included in the post-August rotation. Administrator portals remained accessible to the public internet.


## Credential Management Failures

Zeabur stored internal credentials in plaintext rather than encrypted form. Admin tokens lacked expiration dates and were not rotated after the August incident, leaving attackers with persistent access through credentials that should have been invalidated.

Variables previously migrated exclusively to customer servers as part of the August response escaped this platform database exposure, although compromised hosts could still expose them.


## Platform Security Gaps

The August incident demonstrated weak isolation between customer workloads and internal systems. When attackers possess valid credentials, their activity appears legitimate and evades many detection mechanisms.

Zeabur's disclosure includes technical details and timelines. The company acknowledged that failing to rotate administrator credentials and leaving admin portals publicly accessible compounded the impact of plaintext storage.


## Required User Actions

Zeabur has urged users to rotate exposed credentials immediately. Anyone who reused credentials across multiple services faces additional risk, as attackers often test stolen keys against popular APIs and cloud providers soon after a breach.
1. Rotate all credentials and secrets that were stored as environment variables on the platform
2. Revoke all active sessions
3. Rebuild compromised GCP servers
4. Enable audit logging on connected services to detect unauthorized access attempts
5. Review recent activity for anomalies

## Shutdown Schedule

Zeabur will disable renewals on December 1 and pause all services running on shared clusters. All dedicated servers will expire and shared clusters will stop by December 31.

The company stated that scaling the project to meet market demand made operations increasingly complex and difficult to maintain, and that recent security failures reflect that. Users may be given additional time for data migration, though no concrete timelines have been provided.


## What data did attackers access in the October breach?

Attackers accessed information for 321,810 accounts and approximately 3.2 million environment-variable records. Zeabur confirmed root sign-ins on 101 GCP servers, with SSH keys added to 50 servers and 16 customer disk copies attached to attacker-controlled virtual machines.

## Were credentials from August reused in the October attack?

Zeabur stated that attackers likely obtained the credentials used in October during the August breach, though the company has not confirmed this. Admin tokens had not been rotated since January and were not included in the post-August rotation.

## What should users do if environment variables were exposed?

Users must rotate all credentials and secrets stored as environment variables, revoke all active sessions, and rebuild any compromised GCP servers. Enable audit logging on connected services and review recent activity for unauthorized access attempts.

## When will Zeabur services stop?

Zeabur will disable renewals and pause shared-cluster services on December 1. All dedicated servers will expire and shared clusters will shut down by December 31. The company may provide additional migration time but has not published specific timelines.

## Why is plaintext credential storage particularly risky?

Plaintext storage means anyone who gains read access to internal files or databases immediately obtains valid credentials without needing to crack encryption. Combined with tokens that never expire and publicly accessible administrator portals, plaintext credentials create a straightforward path for attackers to maintain persistent access even after an initial breach is discovered.

Source: BleepingComputer
Published: 2026-10-21T01:29:45+00:00