{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-23T03:54:42.456Z",
  "tag": {
    "id": "zeabur",
    "label": "Zeabur",
    "isStack": false,
    "url": "https://pwn.watch/t/zeabur",
    "feed": "https://pwn.watch/t/zeabur/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 1,
    "notFullyPatched": 1,
    "patched": 0
  },
  "incidents": [
    {
      "slug": "zeabur-october-2026-breach-shutdown",
      "title": "Zeabur breach exposes 3.2M env-var records; company to shut down",
      "url": "https://pwn.watch/i/zeabur-october-2026-breach-shutdown",
      "json": "https://pwn.watch/i/zeabur-october-2026-breach-shutdown.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "partial",
      "product": "Zeabur (PaaS)",
      "tags": [
        "hosting",
        "zeabur",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Platform-wide (accounts with stored env vars)"
      ],
      "fixedVersions": [],
      "startedAt": "2026-10-14",
      "closedAt": null,
      "updatedAt": "2026-10-23T03:53:49Z",
      "summary": "Zeabur disclosed an October 14–15 2026 security incident in which an attacker used leaked internal credentials stored in plaintext to access shared clusters in 9 regions, root into 101 Zeabur-managed GCP dedicated servers, and read the platform database, exposing ~3.22 million environment-variable records across 321,810 accounts. Zeabur is winding down: from December 1 2026 shared-cluster services pause and dedicated servers stop renewing, and on December 31 all services stop and service data is deleted. Refund and incident-claim requests close November 30. Users must rotate every secret stored on Zeabur and migrate off.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "zeabur-october-2026-breach-shutdown",
      "incidentTitle": "Zeabur breach exposes 3.2M env-var records; company to shut down",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-15",
      "title": "Attacker reads ~53 production secrets and re-adds SSH keys after a key is disabled; last recorded activity at 21:05.",
      "body": null,
      "sourceUrl": "https://zeabur.com/blogs/october-2026-security-incident",
      "url": "https://pwn.watch/i/zeabur-october-2026-breach-shutdown"
    },
    {
      "incident": "zeabur-october-2026-breach-shutdown",
      "incidentTitle": "Zeabur breach exposes 3.2M env-var records; company to shut down",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-14",
      "title": "Attacker starts using Zeabur internal AWS keys and shared-cluster admin tokens (stored in plaintext), reads secrets and env vars across 9 regions, and signs in as root to 101 GCP dedicated servers.",
      "body": null,
      "sourceUrl": "https://zeabur.com/blogs/october-2026-security-incident",
      "url": "https://pwn.watch/i/zeabur-october-2026-breach-shutdown"
    }
  ]
}