Dark Web Intelligence on X: " UPDATE: ZEABUR REPORT SAYS ATTACKER READ 3.2M ...

Dark Web Intelligence @DailyDarkWeb 🚨 UPDATE: ZEABUR REPORT SAYS ATTACKER READ 3.2M ENVIRONMENT VARIABLES AND 321K ACCOUNTS Follow-up to our Oct 16 post. Cloud deployment platform Zeabur has published a preliminary incident report (Oct 19) on the Oct 14–15 breach. • The attacker used leaked internal credentials (AWS keys and non-expiring cluster admin tokens stored in plaintext) to reach the shared cluster in 9 regions • Root sign-ins to 101 Zeabur-managed GCP Dedicated Servers (92 users) • Confirmed read of the platform database: 3,218,965 service environment-variable records, 321,810 accounts (email, username, phone), 566 plaintext zSend API keys • Commands run in 865 user database services; the attacker mainly hunted for usable API keys, especially AI-service keys • All sessions and platform access tokens revoked; Zeabur says the root cause was its own plaintext long-lived admin credentials ⚠️ Analyst Note: If you deploy on Zeabur, treat every secret stored there as leaked. Rotate all passwords, database credentials and API keys (especially OpenAI/Anthropic/cloud keys), even if you rotated after the August incident, and watch AI-provider billing for abuse. Primary: zeabur.com/blogs/october-… #DDW #DarkWeb #Zeabur #DataBreach #CloudSecurity #APIKeys #SupplyChain #ThreatIntelligence #CyberSecurity 1:50 PM · Oct 20, 2026 · 3,559 Views 2

Material Security @material_sec 1h Long-lived admin credentials that never expired is the root cause Zeabur named, and most SaaS tenants carry the same shape in OAuth refresh tokens that renew until someone revokes them. In our OAuth Risk Report, 47.2% of 22,332 apps across 21 Google Workspace environments had

The Doxx Doctor @thedoxxdoctor 2h If the preliminary numbers hold, 3.2M env vars is basically a pile of API keys and database passwords. If you ever deployed on Zeabur, rotate those secrets themselves. A new Zeabur password doesn't un-read them.