Zeabur compromise and announced service shutdown
Report edition: 22 October 2026 · PDF page 13
Research reviewed 22 October 2026 · Evidence and editorial planning guidance are distinguished below.
- Operational priority
- Critical
- Evidence
- Vendor-confirmed intrusion
October incident; shutdown phases begin 1 December 2026
Priority is conditional on actual exposure. An asterisk highlights especially conditional exposure; these are editorial judgments, not CVSS scores.
Explore this topic in depth
Ten detailed reports: four shared analyses and six audience perspectives. Research reviewed 22 October 2026; the original PDF account remains below as a dated snapshot.
Research update and qualifications
Zeabur describes compromised internal credentials and access paths involving shared infrastructure, dedicated servers and stored environment data, with different levels of certainty. Its separate shutdown notice sets December service deadlines. Customers therefore need both an incident response and a verified exit plan.
Zeabur October security incident · Vendor incident and shutdown notices revisited.
Do not apply a finding from one infrastructure category to every tenant. A migration deadline does not settle whether exported data or credentials are trustworthy.
The original PDF snapshot
What the report establishes
Zeabur confirms that leaked internal credentials enabled shared-cluster, dedicated-server and platform-database access. Its report lists 3,218,965 environment-variable records and 321,810 account records read. It also describes replacement credentials being exposed through backups, demonstrating why rotation must include every path that can read the new secrets.
Impact and potential reach
These are vendor-reported record/account counts, not unique people or confirmed downstream breaches. Shared clusters and GCP Dedicated Servers are central to the reported scope. Variables previously moved to customers' own dedicated servers were outside the platform-database read.
Required actions
Platform owners: replace stored credentials and investigate affected hosts and databases. Prepare verified exports, replacement hosting and tested cutover. Zeabur says server renewals stop and shared-cluster services pause from 1 December; all dedicated servers and shared clusters stop by 31 December. Confirm the separate export and deletion deadlines when announced.
Six perspectives on this topic
For the business manager
Own the operational migration checklist alongside the incident response. A replacement homepage is not evidence that all work moved. Include staff routines, scheduled reports, order exceptions and the support history needed to keep commitments during the transition.
Read the business manager report for priorities, evidence and a decision checkpoint.
For the business owner
Treat the provider exit as a continuity deadline with security conditions. Assign a decision maker who can resolve scope and spending quickly without accepting unverifiable data or recycled credentials. Include an exit capability in the next supplier decision.
Read the business owner report for priorities, evidence and a decision checkpoint.
For the technical manager
Track incident scope and migration readiness as related but separate workstreams. Service category matters to exposure, while business dependencies determine cutover order. Preserve evidence without delaying urgent containment and maintain an independent administrative path.
Read the technical manager report for priorities, evidence and a decision checkpoint.
For the software engineer
Make the replacement reproducible from reviewed configuration and clean artifacts. Reconcile business semantics, not just database row counts: timestamps, identifiers, callbacks and scheduled work can change during a move. Keep production secrets out of migration notes.
Read the software engineer report for priorities, evidence and a decision checkpoint.
For the customer service
Prepare for the customer consequences of a platform move: delayed processing, account recovery changes and inconsistent history during cutover. Give customers specific instructions only after the business has approved them. Avoid making the vendor shutdown sound like termination of customer rights.
Read the customer service report for priorities, evidence and a decision checkpoint.
For the customer
A supplier’s hosting move should come with clear continuity instructions from the business you use. Keep records of open orders and use known support channels if the service changes. You should not need to reveal existing passwords to complete a migration.
Read the customer report for priorities, evidence and a decision checkpoint.
In this section
- Zeabur: Evidence and scopeDo not apply a finding from one infrastructure category to every tenant. A migration deadline does not settle whether exported data or credentials are trustworthy.
- Zeabur: Business impact and costsInvestigation competes with a fixed exit timetable. Rushed migration can lose orders, miss background processes or carry compromised credentials into the replacement. Continuity planning must budget for both clean rebuilding and data reconciliation.
- Zeabur: Technical exposure and controlsMap each service to its hosting category and incident evidence. Identify data exports, credentials, deployment definitions, domains and scheduled tasks needed to recreate the business workflow independently.
- Zeabur: Response and recoveryApprove exit only when the replacement supports essential operations, the data exceptions are understood and the business can operate without the departing provider.
- Zeabur: Business manager reportWhat work occurs outside the visible application that the replacement must still perform?
- Zeabur: Business owner reportCan we continue trading if the old provider becomes unavailable before our preferred migration date?
- Zeabur: Technical manager reportWhich assumption about the old platform would prevent us from rebuilding independently?
- Zeabur: Software engineer reportWhat would we need to reconstruct this service if the old control panel disappeared now?
- Zeabur: Customer service reportCan we resolve an old order after the hosting account is closed?
- Zeabur: Customer reportHow will the business preserve my open order or support request through the move?