Zeabur breach: attacker read 3.2 million stored secrets and data on 321,810 accounts
The Field Briefing — Red Flag Cyber research desk
Zeabur breach: attacker read 3.2 million stored secrets and data on 321,810 accounts
Zeabur said an attacker using leaked internal credentials read its platform database on October 14-15, 2026 — 3,218,965 stored environment-variable records and data on 321,810 accounts. The attacker also signed in as root to 101 customer servers. Zeabur has revoked the credentials used, signed out every user, and revoked all platform Access Tokens and all zSend API keys. The platform shuts down December 31, 2026, with shared-cluster services pausing from December 1.
Who is affected: Zeabur users — 321,810 accounts in total. The data read included environment-variable names and values, and account email addresses, usernames and phone numbers.
The one action that matters: replace every password and key stored in your Zeabur environment variables — revoke each old credential with its service provider first, then create a new one and redeploy. Do not wait for a notification email.
Full report: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/zeabur
Featured vulnerabilities — patch these
These entries are in CISA's Known Exploited Vulnerabilities catalog, which means attackers are already using them. Full list: https://red-flag-cyber-site.andrewdpeat.workers.dev/vulnerabilities
- EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931): an OS command injection flaw that may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. Apply the vendor's fix / follow CISA's required action.
- Plex Media Server (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656): a chain of flaws in Plex Media Server — two server-side request forgery flaws, an improper neutralization of encoded URI schemes flaw that could allow an attacker to call other plugins' functions, and an external control of file name or path flaw that can allow an admin user to write arbitrary files that may be executed on load. Keep Plex Media Server updated and follow CISA's required action on the vulnerabilities page.
Stay sharp — read every briefing and get the free Spot the Phish checklist at https://red-flag-cyber-site.andrewdpeat.workers.dev
— Red Flag Cyber research desk