Zeabur, a developer hosting and deployment platform, is shutting down after a second security breach in two months. On 14–15 October an attacker used leaked internal credentials — stored in plaintext — and cloud access keys to break into its shared cluster, some dedicated servers and internal systems, and ultimately read the production database, exposing more than 3.2 million environment-variable records and information tied to 321,810 accounts across nine regions. The company also confirmed root sign-ins on 101 Google Cloud servers by 92 users, SSH keys added to 50 servers and 16 customer disk copies attached to attacker virtual machines. Administrative tokens had no expiry, had not been rotated since they were created in January 2024 and were excluded from the post-August rotation, and administrator portals remained reachable from the public internet; Zeabur believes the attacker likely obtained the credentials in the August breach, when a customer's NextChat flaw led to stolen AWS credentials. Services end on 1 December 2026 and close on 31 December; users are urged to rotate exposed secrets, revoke sessions and rebuild compromised servers.

• Source article