Zeabur shuts down hosting by December 31 after second breach — migrate before December 1

Zeabur founder Yuanlin Lin announced on October 17, 2026 that the hosting platform would wind down after a second serious security incident. New dedicated-server and domain purchases stopped immediately. On December 1, shared-cluster services will be paused, while dedicated-server renewals will be disabled; individual servers stop on their expiration dates. By December 31 all shared clusters and dedicated servers stop. Zeabur's October 19 report says an attacker read 3,218,965 environment-variable records and 321,810 account records, accessed 101 GCP dedicated servers as root, and ran read commands in 865 database services. The incident investigation remains open.

Customers must migrate applications, data, DNS, scheduled jobs and integrations before services stop, while also revoking potentially stolen keys at their original providers. Merely changing host does not revoke stolen AI, database or payment credentials. December 1 may interrupt shared-cluster workloads and individual dedicated servers may expire before December 31.

Zeabur stopped selling new dedicated servers and domains on October 17. From December 1 shared-cluster services pause, though manual restarts remain possible for backups. Dedicated-server renewals stop that day and servers expire individually between December 1 and December 31. The final shutdown is December 31, but the data-deletion date, final export deadline and support closure date remain undecided.

Zeabur's preliminary October 19 report documents 3,218,965 environment-variable records and 321,810 account records read from the platform database, 101 GCP dedicated servers accessed as root and read commands in 865 database services. Some database commands failed, and logging gaps mean exact customer-data exfiltration cannot be established. Internal admin tokens lacked expiry and plaintext credentials remained in configuration and backup systems. Some keys rotated after an August breach were not the keys used in October.

Revoke and reissue keys at the provider that issued them: AI model services, cloud accounts, databases, payment processors, registries and signing services. Replacing a secret in Zeabur alone cannot invalidate a stolen copy. For GCP dedicated servers, Zeabur advises treating the host as compromised and rebuilding from trusted images where possible. Review API bills and audit logs for unexpected activity.

Inventory each service, database, volume, object store, webhook, cron task, environment variable and domain. Export data, verify a test restore and reproduce infrastructure at a replacement host. Recreate secrets with narrower permissions, smoke-test the new deployment, move DNS and monitor errors. Include a contingency for earlier dedicated-server expiry and manual shared-cluster restart after December 1.

Zeabur offers domain self-service transfer, account-balance refunds, security-incident compensation and migration assistance. Refund and compensation claims are separate support requests. Its migration guide includes a Markdown version intended for coding agents, but users remain responsible for testing their backups and cutover.

The founder cites architectural complexity, maintenance burdens and two security incidents that exposed limits in the company's ability to operate safely. The incident is consequential for small SaaS and self-hosting users because it forces security response and migration simultaneously; it does not prove comparable hosts have the same defects.