Zeabur to shut down after second security breach in two months

Developer hosting platform Zeabur says it will wind down its services after disclosing a second security breach in two months. The company plans to begin shutting down on December 1, 2026, and finish by December 31, 2026.

Zeabur said an attacker used leaked internal credentials to access shared clusters, some dedicated servers and internal systems on October 14–15, 2026, and then read its production database. The incident affected shared clusters across nine regions, information for 321,810 accounts and more than 3.2 million environment-variable records.

The company also confirmed root sign-ins on 101 GCP servers by 92 users. Attackers added SSH keys to 50 servers and attached 16 customer disk copies to their own virtual machines. Zeabur said the credentials used in the latest attack may have been obtained in its August 2026 breach, but it has not confirmed that link.

Zeabur said administrator tokens had no expiry and had not been rotated since they were created in January 2024. The company also said it had not rotated all administrator credentials after the August breach.

Starting December 1, renewals will be disabled and services on shared clusters paused. By December 31, dedicated servers will expire and shut down, and shared clusters will stop. Zeabur may allow more time for data migration, but has not provided a schedule. The company said the recent security failures and growing complexity contributed to its decision to wind down.