Zeabur breach exposes 3.2M env-var records; company to shut down
Teaser from the source
Zeabur disclosed an October 14–15 2026 security incident in which an attacker used leaked internal credentials stored in plaintext to access shared clusters in 9 regions, root into 101 Zeabur-managed GCP dedicated servers, and read the platform database, exposing ~3.22 million environment-variable records across 321,810 accounts. Zeabur is winding down: from December 1 2026 shared-cluster services pause and dedicated servers stop renewing, and on December 31 all services stop and service data is deleted. Refund and incident-claim requests close November 30. Users must rotate every secret stored on Zeabur and migrate off.
This is the RSS-feed teaser. Read the full article at the original source.
Read at pwn.watchMore on exposes
Other advisories
- Not ratedosv:GHSA-c8m5-c952-6cm4Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs
- Mediumghsa:GHSA-c8m5-c952-6cm4Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs
- Not ratedosv:CVE-2026-57207NetBox MCP Server: HTTP transport exposes all NetBox data without authentication
- MediumCVE-2026-112957ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
- MediumCVE-2026-112957ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
- HighCVE-2026-70387Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method t…
- Not ratedosv:CVE-2026-112957ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
- HighCVE-2026-108372LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
Other news entries
- Massive leak exposes 41,000 DHS workers and undercover ICE agentsNewsArs Technica — Security
- Sony ISP subsidiary data breach exposes 2.5 million customer recordsNewsBleepingComputer
- Amplitude analytics security incident exposes Coinbase customer contact dataBreachpwn.watch
- "Icepick" leak exposes records on 41,000 DHS employees, including undercover ICE agentsBreachpwn.watch
- University of Copenhagen data breach exposes data of 525,000 peopleNewsBleepingComputer
- Genesys Hack Exposes Customer Data From Internal SystemsNewsSecurityWeek
- PHP2Shell exposes the weakness in coordinated vulnerability disclosureNewsCSO Online
- Amadeus passenger system breach exposes booking data of about 92,000 JAL customers, 2,000 with passport numbersBreachpwn.watch
Source: https://pwn.watch/i/zeabur-october-2026-breach-shutdown