Zeabur, a cloud deployment platform popular for hosting n8n, AI API gateways and vibe-coded apps, published a preliminary report on Oct 19 for its second breach in under two months. According to Zeabur, from Oct 14, 01:36 UTC the attacker used internal AWS keys and shared-cluster admin tokens that were stored in plaintext in a private configuration repository. The tokens had never expired (created January 2024), the cluster admin interface was reachable from the internet, and none of these credentials had been rotated after the August incident. How the attacker got them is unconfirmed. Zeabur's leading hypothesis is the GitHub App private key leaked in August.

What Zeabur says was taken or touched (its own certainty labels):

• Platform database (confirmed): 3,218,965 service environment-variable records (names and values) and 321,810 accounts (email, username, phone), plus project data. 566 zSend API keys were stored in plaintext and have been revoked. The 11,536 platform access tokens were stored only as hashes, and all were revoked.
• Shared cluster: settings and secrets of all services in 9 regions. Read commands ran inside 865 customer database services, including 736 n8n instances on PostgreSQL. In 602 of the 607 n8n instances checked, the encryption key sat in an environment variable, so stored third-party credentials were effectively exposed in plaintext. A program planted in at least two Tokyo PostgreSQL databases called back to an external host.
• GCP dedicated servers: root sign-ins on 101 servers (92 users), with attacker SSH keys added on 50. Root passwords were stored in plaintext in server initialization settings, a problem Zeabur found on Sept 3 but hadn't fixed.
• About 53 production secrets read, the GitHub App private key among them (rotated Oct 15 18:54 UTC; no use found so far). Hetzner and DigitalOcean management tokens also leaked; whether they were used can't be confirmed.

Zeabur says the attacker mainly hunted for directly usable API keys, especially AI-service keys, and tried, without success, to call Amazon Bedrock with Zeabur's AWS keys. It also suspects that a user's OpenAI key was abused on Oct 16 for about 1,107 image-generation requests. The last attacker activity was Oct 15, 21:05 UTC. More than 16 hours of activity on Oct 14 triggered no alerts, and the investigation began only after a user report.

Do now if you use or used Zeabur: don't wait for an email. Revoke and replace every credential stored in Zeabur environment variables, including any you rotated after August. Change passwords inside your databases, since changing the env var doesn't change the database password. Replace the n8n encryption key and recreate all n8n credentials. Revoke upstream AI keys used by new-api/one-api. Check your GitHub audit log for Zeabur GitHub App actions between Oct 15 15:05 and 18:54 UTC. Treat GCP dedicated servers as compromised and rebuild them. Review cloud and AI-provider bills from Oct 14 onward, or from Sept 1 for GCP servers. Separately, Zeabur announced on Oct 17 that it is winding down: dedicated-server renewals stop Dec 1 and all servers and shared clusters stop by Dec 31, 2026. Plan the migration alongside the rotation.