Zeabur hit again within seven weeks as environment variables, API tokens and zSend keys leak

Cloud deployment startup Zeabur has confirmed a second security incident in less than seven weeks, with the latest breach spreading from a legacy shared cluster to the company’s own operational database and, in some cases, dedicated Google Cloud servers. According to the company’s status page and a user notice cited by the report, the exposed data includes service environment variables, account information, API tokens, and API keys for zSend, Zeabur’s email service. The timeline shifted as the company updated its public disclosures on Oct. 16. An initial notice at 00:08 said unauthorized access was limited to user-managed PostgreSQL and MySQL instances on an old shared cluster and that there was no evidence dedicated servers were affected. At 04:48, Zeabur revised that statement, saying the scope was broader than first reported and confirming the attacker had read access to its database. A later update at 07:33 said large-scale internal credential rotation briefly disrupted some functions, most of which had since recovered. Users have been told to sign in again, rotate all secrets stored in environment variables, regenerate Zeabur API tokens, create new zSend or Zeabur Email keys, and, for Google Cloud dedicated servers, change root passwords and remove unknown SSH keys, especially one labeled "zeabur-pentest."