GoKawiilZeabur to shut down after second breach exposes 3.2 million records
Developer hosting platform Zeabur disclosed that attackers used leaked internal credentials stored in plaintext to break into its shared clusters, dedicated servers and internal systems between October 14-15, 2026, eventually reading its production database. The breach exposed over 3.2 million environment-variable records and data for 321,810 accounts, with attackers gaining root access to 101 GCP servers, adding SSH keys to 50 servers, and attaching 16 customer disk copies to their own virtual machines. This follows an earlier August 2026 breach in which hackers exploited a flaw in a customer's application to steal AWS credentials and access the same production database.
GoKawiil's interpretation of the reporting above, not reported fact.
The repeat breach, allegedly stemming from credentials stolen in the first incident, suggests Zeabur failed to rotate administrator credentials or encrypt sensitive data after its initial warning, raising questions about its internal security practices. For customers who relied on Zeabur for hosting secrets and environment variables, the exposure could mean compromised API keys and downstream risk to their own applications. The decision to shut down signals the incident may have been severe enough to undermine confidence in the platform's viability.
- Attackers exploited plaintext-stored credentials to breach Zeabur's infrastructure in October 2026, just months after an August breach.
- Over 3.2 million environment-variable records and 321,810 accounts' data were exposed, with root access gained on 101 GCP servers.
- Zeabur had not rotated all administrator credentials since the earlier breach, and is now shutting down the platform.
YubiKey 5C NFC Security Key — Breaches like Zeabur's often trace back to leaked or reused credentials, which hardware security keys can help prevent for admins and developers. A YubiKey adds strong phishing-resistant two-factor authentication to logins, cloud consoles, and admin panels. It's a simple way to harden infrastructure access against the kind of credential theft described in this story.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-20
Published there as: “Zeabur shutting down after second security breach in two months”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.