Zeabur's Fatal Second Breach: How Plaintext Credentials and Unrotated Tokens Brought Down a Cloud Platform
In October 2026, cloud developer platform Zeabur suffered its second major security breach within two months. Attackers leveraged plaintext administrator credentials and cloud access keys—likely stolen during a prior August 2026 breach—to compromise shared hosting clusters across nine global regions, 321,810 user accounts, and approximately 3.2 million environment-variable records. Threat actors gained root access to 101 GCP servers, added SSH keys to 50 servers, and attached 16 customer disk copies to attacker-controlled virtual machines. The root cause included unrotated admin tokens created in January 2024, publicly accessible admin portals, and credentials stored in plaintext. Following this second breach, Zeabur announced a full platform shutdown by December 31, 2026. This incident highlights an accelerating pattern of credential-reuse attacks targeting cloud-native developer platforms. As organizations consolidate infrastructure on shared PaaS environments, unrotated secrets, plaintext credential storage, and overly permissive admin interfaces create compounding blast radii. Regulatory scrutiny of cloud platform providers is intensifying, making credential hygiene and zero-trust segmentation urgent priorities across the industry.
Kill Chain
