Thought Leadership
Attackers accessed 3.2 million environment variable records and data belonging to 321,810 accounts. The credentials were apparently obtained in an incident in August.
Taiwan-founded developer platform Zeabur is shutting down. The company plans to begin discontinuing services on December 1, 2026, with all dedicated servers and shared clusters scheduled to be taken offline by December 31. Zeabur is popular among developers who use AI-assisted tools to build and deploy applications, a practice known as vibe coding. The shutdown follows a second security incident in just two months.
“On October 14–15, 2026, an attacker used leaked Zeabur internal credentials to break into the shared cluster, some Dedicated Servers, and Zeabur internal systems, and eventually read the platform database.””
Zeabur
3.2 Million Environment Variable Records Exposed
The attacker accessed approximately 3.2 million environment variable records and data belonging to 321,810 accounts. Developers commonly use environment variables to store database credentials, API keys, and other secrets.
Shared clusters in nine regions were affected. The attacker also gained root access to 101 servers in Google Cloud that Zeabur manages for its customers. The intruder added their own SSH keys and attached copies of customer disks to virtual machines under their control. According to Zeabur, these copies have since been deleted.
Credentials Were Never Rotated
Zeabur believes the credentials used in the attack originated from an earlier incident in August 2026. Internal AWS keys, cluster management tokens, and Google Cloud keys had been stored in plaintext in a configuration repository. Although Zeabur rotated one key after the first incident, it failed to update the credentials stored in the repository. Administrator tokens had remained unchanged since January 2024, and the cluster management interface was accessible from the internet.
The company also cited growing operational complexity as a reason for shutting down. Over the past three and a half years, its growth had made the platform increasingly difficult to manage. The security incidents exposed these underlying problems. Zeabur has not announced a deadline for deleting customer data or specified how much time customers will have to export their data.
Rotate All Secrets
Security experts advise users to rotate every credential that has ever been stored in Zeabur environment variables, including those already changed after the August incident. Customers must also migrate to another provider by the end of the year. In the same week, hosting platform Railway also reported the theft of customers’ secret keys.
(Editorial Team)
