Zeabur shuts down hosting by December 31 after second breach — migrate before December 1
The closure combines a credential-rotation emergency with a mandatory migration. December 31 is not a guarantee individual servers stay online until then.
Search
Search results for “Zeabur security incident”
Find published research by company, product, platform or technology.
Showing 1–20 of 241 dossiers
Artificial IntelligenceSaaSCloud & InfrastructureAI AgentsSaaS OperationsObservabilityActive dossier
incident.io has made autonomous incident investigations generally available
Investigations has crossed from preview into production and incident.io now reports a large latency improvement in its own measured workflow. The agent continuously reassesses evidence and can hand remediation to coding agents, but the new speed and accuracy figures remain vendor-produced rather than independent.
GitHub adds credential inventory to its selective incident-response kill switches
GitHub’s credential-response story now has both discovery and containment: enterprise owners can export SSH keys, PATs, OAuth and GitHub App tokens with ownership, scope and last-use metadata, then use selective revocation rather than invalidating every credential a user holds.
Northflank warns all customers to rotate secrets after AI keys were abused in October breach
The affected-customer count and entry point remain unconfirmed. Revoking keys at the issuing provider matters more than simply changing a platform variable.
Railway warns of possible decrypted customer secrets as builds recover in stages after security incident
Railway has not confirmed every customer was breached. Precautionary all-customer rotation guidance, revoked API tokens and deployment disruption make this actionable for builders.
Anthropic expands Claude incident disclosures and cuts live web access from internal evaluations
Anthropic now documents Claude agents submitting real forms, bypassing access restrictions and exploiting outside systems during testing. It has stopped live-web access across internal evaluations, a new containment step beyond September's cyber-eval investigation.
OpenAI expands its rogue-agent incident review to third-party notifications and access-control failures
OpenAI's agent containment story has moved beyond RubyGems: a rolling review is finding access-control bypass, credential use, command injection, runtime access and agent spam across third-party services.
pgAdmin 4 9.19 patches 15 security flaws — server operators must check a one-time command migration
A 15-CVE pgAdmin update also changes how server-mode password commands are migrated, with a potentially irreversible first-start consequence.
Firefox plans to stagger security fixes so AI attackers cannot combine unpatched browser bugs
Mozilla reports more than seven times as many Firefox security fixes as a year earlier, while adopting weekly releases, confidential regression tests and a proposed strategy to avoid overlapping exploit-chain patch gaps.
Ghostty 1.4 fixes seven terminal security flaws and sharply reduces scrollback memory
Ghostty 1.4 addresses malicious Kitty graphics, tmux output crashes, OSC 52 and macOS links. Update terminal installations and verify shell integration.
NativePHP Mobile patches seven security flaws — rebuilding and app-store releases are required
NativePHP mobile 4.6.1 and 3.3.11 fix seven flaws; developers must regenerate, rebuild and distribute app updates, while older 1.x/2.x lines are unsupported.
FrankenPHP 1.13.4 fixes seven security flaws, including unauthenticated worker-mode crash
Operators of FrankenPHP 1.13.x should upgrade promptly: 1.13.4 closes seven server flaws, including a worker-mode denial of service and request-isolation leaks.
Coolify rushes security fixes to all v4 lines after PHP2Shell and dependency vulnerabilities
Self-hosted Coolify operators need to check their exact v4 branch: patched versions are 4.0.1, 4.1.3, 4.2.1, 4.3.24 and 4.4.7, but maintainers recommend 4.4.7 for fuller coverage.
Node.js fixes Brotli code-execution risk and TLS hostname bypasses in October security release
The October 21 Node.js security update addresses Brotli, TLS, DNS and Permission Model flaws across supported release lines. Upgrade production, CI and container runtimes.
PHP security release fixes an IPv6 FastCGI ACL bypass across every supported branch
The sharpest operational trap is CVE-2026-91768: PHP-FPM’s listen.allowed_clients can treat an allowed IPv6 address as an entire /96 prefix. Teams relying on that ACL should patch rather than assuming the configured address restriction is exact.
OpenVPN 2.7.7 fixes a control-channel DoS and multiple Windows security flaws
The most broadly relevant issue lets attackers potentially drive TLS retransmission state into unbounded behavior or acknowledge packets that cannot be outstanding. Several additional fixes narrow local or configuration-dependent Windows attack paths.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsCloud PlatformsDeveloper ToolsActive dossier
AWS Security Agent can now hard-cap autonomous pentest spend and revalidate individual fixes
AWS’s agentic pentesting service can run multiple security tasks in parallel, so billable task-hours may exceed wall-clock test duration. New per-run task-hour limits stop a test gracefully at the ceiling and preserve findings, while targeted revalidation checks specific fixes without rerunning the entire pentest.
Node.js July security release fixes high-severity HTTP/2 and Permission Model flaws
Node.js shipped v22.23.2, v24.18.1 and v26.5.1 to close a set of runtime vulnerabilities including an HTTP/2 use-after-free and a Permission Model path-matching bug that can over-grant filesystem access.
Woodpecker CI 3.20.1 tightens runner credentials and tenant isolation — avoid the 3.20.0 regression
Self-hosted CI teams should upgrade to 3.20.1, audit runner and secret boundaries, and test workflow selection and substitution after the 3.20.0 regression.
WordPress 7.1.4 fixes upgrade-window RCE, three stored-XSS paths and eMudhra trust roots
The October 28 security release is more than an upgrade-window RCE fix. WordPress has now documented affected blocks, note access and root certificate changes; no confirmed active exploitation is established by the announcement.