Vibe coding platform Zeabur collapses after back-to-back breaches expose 3.2M records

Zeabur, the embattled AI cloud platform popular with vibe coders, hit by two breaches in a row, is shutting down, leaving over 321,000 users only weeks to determine if their data was compromised – and find a new home in cyberspace.

After releasing a preliminary investigation report on the second cyberattack, which took place on October 14th-15th, Zeabur followed up by announcing it would be closing its proverbial doors on December 31st.

"After careful consideration, we've decided to wind down Zeabur.

Some services will begin shutting down on December 1, 2026, and all dedicated servers and shared clusters will be permanently shut down by December 31,

Zeabur wrote in a X post, announcing the decision on October 19th.

【Zeabur Is Shutting Down】 After careful consideration, we've decided to wind down Zeabur. Some services will begin shutting down on December 1, 2026, and all dedicated servers and shared clusters will be permanently shut down by December 31. If you're currently hosting services on Zeabur, please back up your data and migrate as soon as possible to avoid service disruptions or data loss. We'll continue providing migration assistance and processing account balance refunds and security incident compensation. We apologize for the inconvenience and thank you for your support over the years. Full announcement and migration details: https://t.co/Oub5w7vrjs

undefined Zeabur (@zeaburapp) October 20, 2026

Joseph Perry, Cybersecurity Researcher and Advanced Services Lead at Arcova, sending condolences to Zeabur, called the shutdown “unfortunate,” but also explained that negative repercussions from a major cyberattack aren't “anomalous.”

“Across the world, businesses, school systems, even cities are being devastated by threats like this,” Perry said.

Failure to remediate a major incident isn't just opening yourself up to more losses, it's putting the organization at existential risk, and doing so in a way that will cause at least some critics (to say nothing of attorneys) to scream negligence,

said Joseph Perry, Cybersecurity Researcher and Advanced Services Lead at Arcova.

From rapid rise to shutdown

Founded in 2022, the cloud-based application deployment platform was the brainchild of a recent graduate, Yuanlin Lin, who, according to his GitHub profile, is a self-described “freelance full-stack developer from Taiwan.”

A fan favorite among vibe-coders for the application's seamless infrastructure, Zeabur grew out of a school project Lin began while earning a computer science degree at Zhejiang University in China.

Calling itself “the world’s first AI DevOps Engineer,” the globally backed startup faced its first round of cyberattacks in August.

Penning a heartfelt statement on the Zeabur website (the company lists only seven employees between Taiwan and Silicon Valley), the roughly 24-year-old founder took full responsibility for the predicament.

The root cause lies with Zeabur. This was our responsibility, and we take full accountability.

You trusted us with your projects, your products, and the work you put into them,

wrote Yuanlin Lin, Founder & CEO of Zeabur.

Beyond the security failures, the fledgling AI startup acknowledged growing infrastructure complexity and operational difficulties contributing to the decision.

“As we adapted our architecture and changed direction to meet market needs, it became increasingly complex and difficult to maintain," Lin explained.

The two security incidents in the second half of this year have made the shortcomings in our security and operations even clearer,” he said.

How two breaches unraveled Zeabur

During the August attack, a customer-deployed NextChat application hosted on the Zeabur platform was exploited by an attacker, allowing them to gain unauthorized access to the company's infrastructure before eventually reaching its production environment.

In response, Zeabur said it blocked the intrusion path, rotated internal credentials and passwords, and rolled out several security upgrades across its platform.

We have completed our investigation into the August 2026 Zeabur security incident and have now published the full incident report. The report provides a detailed account of how the attacker exploited a vulnerability in a user-deployed service to gain access to our shared cluster, progressively escalated their privileges, and ultimately accessed our production environment. It also covers the confirmed scope of impact, the root causes of the incident, and the remediation measures we have completed. We once again sincerely apologize to all users affected by this incident. The majority of the compensation claims we have received have now been verified, and we are working to process the remaining cases as quickly as possible. We want to be as transparent as possible about what we have learned. In the two weeks since the incident, we have already shipped three major security-related architectural updates, and we will continue improving privilege isolation, credential management, and security monitoring across our systems. Full report: https://t.co/6TzvHRxnDu

undefined Zeabur (@zeaburapp) September 9, 2026

Although two breaches occurred, the first on August 27th and the second 8 weeks later, the main damage occurred in mid-October, when Zeabur announced on Monday that a whopping 321,810 accounts had been compromised.

That exposed account data includes email, username, phone number, project, environment, and service data.

What’s more, the names and values of over 3.2 million environment-variable records, which store sensitive configuration data such as passwords, API keys, and database credentials, were also accessed.

The full list of compromised data is as follows:

• 3,218,965 environment-variable records — both names and values.
• 321,810 accounts — including email, username, phone number, project, environment, and service data.
• 566 plaintext zSend API keys — revoked.
• 11,536 platform access tokens — stored as hashes and revoked.
• Shared-cluster exposure across nine regions.
• 865 database services potentially exposed.
• Confirmed root sign-ins to 101 GCP dedicated servers belonging to 92 users.

The preliminary investigation into the October hack revealed that the attacker infiltrated Zeabur using “long-lived administrative credentials that were stored in plaintext.”

Zeabur also noted that “certain management interfaces were accessible from the public internet.”

Once inside the system, the threat actor gained access to “shared clusters, dedicated servers, and internal systems, eventually gaining read access to the Zeabur platform database,” the company said.

"One of the key details in Zeabur's second breach is that certain administrator credentials remained active after the company's initial incident response in August,” said Perry.

According to Perry, Zeabur apparently failed to rotate some administrator credentials afterward, “including tokens that had been active since January 2024 without expiration.”

Although Zeabur has said the attackers may have obtained those credentials during the earlier breach, Perry noted that the connection has not been confirmed.

If those same credentials were used to regain access, it would suggest that some of the security exposure from the first breach remained unresolved, even if the original intrusion path had been closed, he said.

said Joseph Perry, Cybersecurity Researcher and Advanced Services Lead at Arcova.

Stopping an active attack versus removing everything an attacker could use to come back in is quite a big difference, Perry said.

In response to October's incident, Zeabur said it revoked compromised credentials and blocked known attack paths, and recommended that users immediately rotate all passwords, API keys, and other stored secrets, even if they had been rotated after the August incident.

A full list of recommendations is listed in the October security incident report.