application platform (PaaS)
Zeabur: security status
Summary
PaaS. PHP runs in the customer's service and the customer updates it. No php2shell notice found (as of 2026-10-24).
Customer action:
For services that use PHP, update to a fixed PHP release and redeploy; check the same on whatever you migrate to.
Verified: 2026-10-24
Zeabur runs on AWS and GCP addresses, so it is recognised by CNAME or by its response header, not by network. Sites whose apex A record points straight at a cluster address show as AWS. Zeabur is closing: all shared clusters and dedicated servers end by 2026-12-31.
The provider's own security incidents
October 2026 security incident (environment variables exposed) and shutdown
in progressofficial notice · 2026-10-19Summary
Official preliminary report (Oct 19, also in Japanese): on Oct 14-15 UTC an attacker used leaked internal credentials to enter the shared cluster, GCP dedicated servers and internal systems, and read service settings and environment variables on the shared cluster as well as the environment variables stored in Zeabur's database. A separate incident happened in August, and the credential rotation then did not cover the ones used this time. Zeabur says the root cause is its own (long-lived admin credentials stored in plaintext). On Oct 17 Zeabur announced it is shutting down: shared-cluster services are paused from Dec 1, and all shared clusters and dedicated servers end by Dec 31. The investigation continues.
Customer action:
Revoke every password and key stored on Zeabur (API keys, cloud keys, database passwords, signing and encryption keys), including ones already replaced in August, then set new values and redeploy. On the shared cluster, also change the passwords inside your databases. Recreate access tokens, check the GitHub audit log and bills from Oct 14 (Sept 1 for GCP dedicated servers). Back up and migrate before Dec 1.
Source: https://zeabur.com/ja-JP/blogs/october-2026-security-incident
Verified: 2026-10-24
How this tool recognises the provider
- CNAME
*.zeabur.app*.clusters.zeabur.com- Response headers (names)
x-zeabur-request-id