Zeabur breach October 2026: 3.2 million environment variables leaked and Zeabur is shutting down. What do I rotate and how do I migrate off?

What happened: on October 14-15, 2026, an attacker used old, never-rotated Zeabur internal credentials (a shared-cluster admin token with no expiry, plus internal cloud keys) to get into the shared cluster, some dedicated servers, internal systems and the platform database. Zeabur says about 3.2 million environment-variable records across roughly 321,810 accounts were read, along with settings for hosted database services, and some GCP dedicated servers were accessed with root and had unauthorized SSH keys added. This was Zeabur's second breach in two months, and it has announced it is shutting down. Am I affected? Assume yes if you ever deployed anything on Zeabur (shared cluster or dedicated server) or used its hosted databases or GitHub App. What to do now: 1. Treat every environment variable you stored on Zeabur as leaked. Revoke and reissue at the issuing provider, not just in Zeabur: LLM and payment API keys, cloud access keys, database passwords, OAuth client secrets, JWT and session signing keys, webhook secrets, SMTP credentials. 2. Change passwords for Zeabur-hosted databases, and check those databases for unknown users or changed data. 3. Rebuild any GCP dedicated server from a clean image instead of cleaning it; check authorized_keys on anything you keep. 4. In GitHub, review your organization audit log for Zeabur GitHub App activity around October 15, 2026, and remove the app when you have moved off. 5. Sign out of Zeabur sessions and change your Zeabur password. 6. Watch provider usage and billing dashboards (LLM APIs, cloud) for spend or activity you didn't make. Migration: Zeabur says some services start shutting down on December 1, 2026 and all shared clusters and dedicated servers will be off by December 31, 2026. Back up data and move workloads before then, and give the new host fresh secrets, not the leaked ones. After: confirm old keys are rejected (call the API with an old key), and remove Zeabur deploy hooks and DNS records that point at it. Sources: https://zeabur.com/blogs/october-2026-security-incident https://zeabur.com/blogs/zeabur-is-shutting-down https://www.bleepingcomputer.com/news/security/zeabur-shutting-down-after-second-security-breach-in-two-months/ https://www.scworld.com/brief/zeabur-to-shut-down-following-major-security-breach