https://pwn.watch/t/zeabur Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Fri, 23 Oct 2026 03:00:20 GMT https://pwn.watch/i/zeabur-october-2026-breach-shutdown https://pwn.watch/i/zeabur-october-2026-breach-shutdown Fri, 23 Oct 2026 03:00:20 GMT critical <p>Zeabur disclosed an October 14–15 2026 security incident in which an attacker used leaked internal credentials stored in plaintext to access shared clusters in 9 regions, root into 101 Zeabur-managed GCP dedicated servers, and read the platform database, exposing ~3.22 million environment-variable records across 321,810 accounts. Zeabur is winding down: from December 1 2026 shared-cluster services pause and dedicated servers stop renewing, and on December 31 all services stop and service data is deleted. Refund and incident-claim requests close November 30. Users must rotate every secret stored on Zeabur and migrate off.</p> <p><strong>Status:</strong> live · <strong>Patch:</strong> partial</p> <p><strong>Latest updates:</strong></p><ul><li>2026-10-15: Attacker reads ~53 production secrets and re-adds SSH keys after a key is disabled; last recorded activity at 21:05. (<a href="https://zeabur.com/blogs/october-2026-security-incident">source</a>)</li><li>2026-10-14: Attacker starts using Zeabur internal AWS keys and shared-cluster admin tokens (stored in plaintext), reads secrets and env vars across 9 regions, and signs in as root to 101 GCP dedicated servers. (<a href="https://zeabur.com/blogs/october-2026-security-incident">source</a>)</li></ul>