Zeabur to Shut Hosting Services After Breaches Expose Data and Servers

Summary

Zeabur says repeated breaches led it to shut shared-cluster and dedicated-server services by the end of December 2026. An attacker accessed millions of records and gained root access to 101 managed GCP servers.

Key points

• Zeabur says it will end shared-cluster and dedicated-server services by the end of December 2026, citing repeated breaches and security problems.
• According to Zeabur’s preliminary report, an attacker used internal AWS and GCP keys and cluster-management tokens to access shared clusters, some dedicated servers, and internal systems.
• The attacker read 3.21 million environment-variable records and 321,800 account records containing email addresses, usernames, and phone numbers.
• The breach also put 566 zSend API keys and 11,536 platform access tokens within scope.
• The attacker reportedly obtained root access to 101 Zeabur-managed GCP dedicated servers, added SSH keys to 50, and mounted disk copies of 16 customer servers.
• Zeabur advises users to replace stored secrets; users of GCP dedicated servers should treat them as compromised, back up data, and rebuild the servers.
• The report cites plaintext credentials in a configuration repository, a publicly accessible cluster-management interface, and long-lived, unrotated tokens.

Vendors

Products

Related Articles

• Zeabur to Shut Down After Second Breach Exposes 3.2 Million Environment RecordsZeabur