As part of our containment work, we rotated a large number of internal credentials. This temporarily affected several platform features. Status:

Restored: dashboard and project settings, GitHub sign-in, magic-link sign-in and email delivery, zSend sending, builds and deployments, database backups, and server management for Tencent Cloud and AWS Lightsail servers.
In progress: server management for some other providers. Your servers keep running normally; only management actions and expiry information in the dashboard are affected.

Still in effect: public SSH to Google Cloud dedicated servers remains restricted to the web SSH console.

If you use Zeabur Email, please create a new API key, because all previous keys were revoked. If a deployment failed during this period, please redeploy. We continue to monitor around the clock and will post further updates.

Our investigation has found that the incident is broader than first reported, and we are correcting our earlier update. Some dedicated servers hosted on Google Cloud were also accessed without authorization, and the attacker had read access to our platform database. The exposed data includes service environment variables, account information, API tokens, and zSend API keys.

We have revoked the compromised credentials we have identified, rotated our session signing key (all users will need to sign in again), and temporarily restricted public SSH access to Google Cloud dedicated servers. Web-based SSH and your running services are not affected. We are continuing to contain the incident.

What you should do now: rotate any secrets stored in your environment variables, and regenerate your Zeabur API tokens. If you use zSend, create new API keys, because existing keys are being revoked. If you use a Google Cloud dedicated server, change its root password and remove any SSH keys you don't recognize, especially any labeled zeabur-pentest. Affected customers will be contacted directly. We will post the next update as soon as we have more to share.

We have detected unusual access activity in our shared cluster environment and confirmed unauthorized access to user-deployed PostgreSQL and MySQL services still running on deprecated shared clusters.

We have blocked the identified attack vector and verified that the attacker can no longer gain access using the same method. We are continuing to investigate the root cause.

At this time, we have found no evidence that services deployed on dedicated servers have been affected by this attack. We will continue to monitor for any signs of impact.