The cloud deployment provider will begin suspending services on December 1, with a complete shutdown scheduled by year-end, after attackers accessed customer data, credentials and infrastructure in two incidents.
Cloud deployment provider Zeabur is winding down its platform after two security incidents in less than two months exposed weaknesses in its infrastructure and credential management, forcing customers to migrate their workloads before the end of the year.
In an announcement on October 17, founder Yuanlin Lin said Zeabur would begin shutting down services on December 1, with all dedicated servers and shared clusters scheduled to stop operating by December 31. The decision followed an October 14 attack that compromised parts of the company’s internal systems and customer infrastructure, after an earlier breach in August had exposed project environment variables and other sensitive information.
The company’s preliminary report on the October incident, published October 19, said an attacker accessed Zeabur’s shared cluster, 101 Google Cloud Platform (GCP) dedicated servers and the platform database. The investigation remains ongoing, and the company said some aspects of the attack and the extent of data exposure could not be conclusively established.
“Protecting your services and data is our responsibility, and we have fallen short,” Lin wrote in the shutdown announcement.
October breach exposed credentials and customer data
According to Zeabur’s preliminary incident report, the attacker used internal AWS credentials and shared-cluster administrator tokens to access infrastructure across nine regions. The credentials were stored in plaintext in a private configuration repository, while the cluster’s administrative interface was accessible from the public internet and its tokens did not expire.
A separate attack path involved GCP dedicated servers. The attacker obtained root-level access to 101 servers, using an older GCP key and root passwords stored in server initialization settings, according to the report.
The two paths converged when the attacker used internal network administrator credentials obtained through the shared-cluster compromise to add a node to Zeabur’s internal network. Network rules allowed that node to connect to the platform database, enabling the attacker to read customer and project information.
Zeabur confirmed that the attacker read 3,218,965 records containing service environment variables and accessed account, project, environment and service data associated with 321,810 accounts. The environment variables could contain API keys, cloud credentials, database passwords and other secrets.
The attacker also accessed 865 database services in the shared cluster, although Zeabur said its audit logs did not record the output of database commands, leaving the extent of data actually extracted uncertain. The company assessed that the attacker may have accessed database contents, including third-party credentials, user information and workflows.
All 101 GCP servers were classified as affected hosts with possible data exposure. On 50 of those servers, the attacker added SSH public keys under their control, potentially enabling continued access. Zeabur also reported that the attacker created five virtual machines in its GCP project and attached 16 copies of customer server disks to them.
The report identified additional exposure involving 566 zSend API keys, which were revoked, and 11,536 platform access tokens, all of which were revoked. The access tokens were stored as hashes that Zeabur said could not be reversed.
The company said it found no use of the compromised private key for its GitHub application, which could access repositories authorized by users, but was still seeking complete audit logs from GitHub. It also could not confirm whether the attacker downloaded certain database backups.
August breach exposed gaps in isolation and access controls
The October incident followed an August 27 breach in which an attacker exploited a vulnerability in a publicly accessible service deployed on Zeabur’s shared cluster.
According to Zeabur’s September 7 report, the attacker exploited a remote-code-execution vulnerability associated with NextChat v2.16.1, identified as CVE-2026-7644. The attacker then moved across multiple system boundaries, reaching the shared cluster’s internal network, platform accounts, AWS infrastructure and the production environment.
The August attack exposed part of the production database, including account information and project environment variables containing third-party API keys, database passwords and other service credentials.
Zeabur subsequently rotated internal credentials it had identified as compromised, disabled legacy API keys and advised customers to replace exposed credentials and move sensitive environment variables to their own dedicated servers.
However, the October investigation found that the earlier credential rotation had not covered the cluster administrator tokens and AWS keys stored in the configuration repository. Root passwords in GCP server initialization settings had also remained unaddressed.
Zeabur acknowledged that its earlier statement that all internal administrator keys had been disabled or rotated was incomplete.
The October report also identified excessive permissions, inadequate separation between internal and customer services, secrets stored in cluster backups and gaps in security monitoring. More than 16 hours of attack activity on October 14 did not trigger alerts, the company said; it identified the incident the following day after receiving a user report.
Customers face December migration deadline
Zeabur has stopped accepting purchases of new dedicated servers and domains and is accepting requests for account balance refunds. Customers can transfer domains purchased through the platform to other registrars.
From December 1, dedicated server renewals will be disabled, and individual servers will shut down on their respective expiration dates during December. Services running on shared clusters will be paused from that date, although customers will be able to restart them manually to back up their data.
All dedicated servers and shared clusters are scheduled to cease operating by December 31. Zeabur cautioned customers not to assume every service would remain available until the final date.
The company has published migration guidance and said it is preparing additional documentation and instructions that can be used with coding agents such as Claude Code and Codex. It is also accepting compensation claims from customers who suffered losses related to the security incidents, separately from account balance refund requests.
The final data deletion date, deadline for exporting data and date when customer support will close have not yet been announced.
Lin said the company had also been reassessing its long-term business prospects as AI tools made deployment easier and demand for cloud deployment evolved. But the two incidents, together with the growing complexity of its rapidly developed platform, were central to the decision to wind down.
Following the October breach, Zeabur said it had revoked exposed credentials, restricted access to administrative interfaces, reset affected server passwords and tightened database access. It continues to investigate how the credentials used in the attack were initially obtained and the full extent of the compromise.
