Zeabur is shutting down entirely by December 31, 2026, after unrotated administrator credentials from an August breach let a second attacker walk back in through the same front door in October. Per the company's own incident report, the attacker used admin tokens created in January 2024 with no expiration date, stored in plaintext, that were never included in the credential rotation Zeabur ran after its first breach just seven weeks earlier.

Jump to what we checked in our own rotation process if your incident response plan has ever included the phrase "rotate all credentials."

How a Breach in August Set Up the Breach in October

The August 2026 intrusion started with a vulnerability in a customer's public-facing NextChat deployment, which the attacker used to pivot into Zeabur's internal network and read a cached legacy API key belonging an administrator. That key had no permission scopes and no expiration, and it led the attacker to AWS root credentials and, from there, the production database.…