Cloud deployment platform Zeabur says a second security breach in less than two months exposed 3,218,965 environment-variable records and information linked to 321,810 accounts. The company disclosed the October 14–15 intrusion in a preliminary incident report, which details how attackers used internal credentials to reach shared infrastructure, dedicated servers and the platform database.
Zeabur said the exposed platform database records included account details such as email addresses, usernames and phone numbers, along with project, environment and service information. The attackers also read the names and values of environment variables stored on the platform, which can contain API keys, database passwords and other application secrets. The company confirmed that 566 plaintext zSend API keys were exposed and revoked, while 11,536 platform access tokens were stored only as hashes and have also been revoked.
The company traced the intrusion to long-lived administrative credentials stored in plaintext in an internal configuration repository. The cluster administration interface was reachable from the public internet, and the relevant tokens had no expiration date. Zeabur said it could not confirm how the attackers initially obtained the credentials. It also said the credential rotation carried out after an August breach did not cover the keys used in the October incident, so it has not established that the earlier attack directly enabled the second one.
Attackers signed in with root privileges to 101 Google Cloud dedicated servers associated with 92 users. Zeabur said they added their own SSH keys to 50 of those servers, created five virtual machines in the company’s cloud project and attached 16 copies of customer server disks to those machines. The attackers also ran commands inside 865 database services, but the company’s audit logs did not retain command output, so it could not determine exactly how much data was retrieved from each database.
Zeabur has told affected users to replace all passwords and keys stored in environment variables, recreate revoked platform access tokens and review GitHub audit logs for unexpected activity involving the company’s GitHub App. Customers whose services ran on the affected Google Cloud dedicated servers are being told to treat those hosts as compromised and rebuild them where possible. The company says it has revoked the credentials used in the intrusion, removed the attacker’s SSH keys and restricted access to internal systems.
Zeabur announced in its official shutdown notice that it has stopped accepting new dedicated-server and domain purchases. Starting December 1, dedicated-server renewals will be disabled and running services on shared clusters will be paused so customers can restart them to back up their data. All dedicated servers and shared clusters are scheduled to stop operating by December 31, 2026. Founder Yuanlin Lin said the two security incidents, along with growing system complexity and operational challenges, led the company to wind down. Zeabur says it will continue helping customers migrate and processing account-balance refunds and security-incident compensation. The repeated exposure of API keys and service credentials has made secret rotation a central part of its instructions to customers.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
