Zeabur shuts its deployment platform by 31 December after a breach

Zeabur shuts its deployment platform by 31 December after a breach

19 October 2026: Zeabur, an app deployment platform founded in Taiwan about three and a half years ago, is winding down: new dedicated servers and domains can no longer be bought, running services on its shared clusters pause from 1 December 2026, and every dedicated server and shared cluster stops by 31 December. The decision follows its second security incident of the year, in which an attacker read 3,218,965 environment variables stored on the platform.

Not yet independently verified. The incident figures come from Zeabur's preliminary report, which it says will be updated as the investigation continues; the data deletion date and final export deadline have not been announced. We will update this when it can be confirmed, and remove this note.

The shutdown timeline

Founder Yuanlin Lin announced the closure on 17 October. The confirmed dates are:

• Now: no new dedicated servers or domains; balance refunds, incident compensation and migration help through Zeabur Support; domains can be transferred out from the dashboard.
• From 1 December: dedicated server renewals stop and each server shuts down on its own expiry date during December; services on the shared clusters are paused but can be restarted manually to back up data.
• 31 December: everything stops.

The data deletion date, the final export deadline and the date Zeabur Support closes are still to be announced, and Zeabur tells customers to plan around their own expiry dates rather than wait for them. Lin wrote that growth had run into limits as AI made deployment itself easier, that a system built quickly had become hard to maintain, and that the two incidents exposed the gaps.

What the attacker reached in October

Zeabur's preliminary report, published on 19 October, says the attacker used leaked internal credentials stored in plain text, including shared-cluster admin tokens with no expiry on an admin interface open to the internet, and an old cloud key that could read root passwords from server set-up data. Between 14 and 15 October the attacker reached the shared cluster in nine regions, ran commands inside 865 customer database containers, signed in as root to 101 dedicated servers on Google Cloud and added SSH keys on 50 of them, and read Zeabur's platform database. The report counts 321,810 accounts and 566 plaintext API keys for its zSend service among the data read. Of the n8n instances on PostgreSQL it checked, 602 of 607 kept their encryption key in an environment variable, so the third-party credentials inside those workflows were effectively exposed. Rotations after the August incident did not cover the credentials used this time.

What customers need to do before December

Zeabur asks every customer to replace every password and key stored on the platform, even ones rotated after August, to sign in again and recreate platform tokens, and, on Google Cloud dedicated servers, to back up data and rebuild the server instead of cleaning it. Teams that ran n8n there should treat every connected service account as compromised. All users have already been signed out and all platform access tokens revoked. Vercel, Netlify, Heroku and Railway are among the deployment platforms we list, and our DevOps software category holds 16 products.

Sources

• Zeabur: Zeabur is shutting down, what happens next, 17 October 2026
• Zeabur: October 2026 security incident (preliminary report), 19 October 2026
• iThome: Zeabur incident report coverage, 20 October 2026