Zeabur Shutting Down: What to Do Before December 1

Zeabur is shutting down. The deployment platform stops renewing dedicated servers and pauses shared-cluster services on December 1, 2026, and everything goes offline by December 31. If you host anything there, rotate every secret you stored on Zeabur now, because a second breach in October exposed about 3.2 million environment-variable records, then back up your data and move your apps before your own server’s expiry date.

Below: what Zeabur announced about shutting down, what the October breach exposed, what to do this week, and how to migrate without carrying the exposed credentials along with you.

Before you start

Checked on October 27, 2026 against Zeabur’s shutdown announcement (October 17), its migration guide (October 20), its security changelog and status page, and BleepingComputer’s October 20 report. Sources are at the end.
As of October 27, Zeabur still lists the data deletion date, the final export deadline and the Support closing date as “to be announced.” Plan around the December dates, not a later grace period.
Have your GitHub account, domain registrar login and the dashboards for any API keys you used on Zeabur open before you start.

Zeabur shutting down: the timeline

Founder Yuanlin Lin posted the wind-down on October 17, 2026. Zeabur stopped selling new dedicated servers and domains immediately and opened account balance refunds. The rest of the timeline:

Date	What happens
Now	No new dedicated servers or domains. Balance refund requests are open through Zeabur Support.
December 1, 2026	Zeabur disables dedicated server renewals and pauses shared-cluster services.
December 1 to 31	Each dedicated server shuts down on its own expiration date.
December 31, 2026	All dedicated servers and shared clusters stop.

Zeabur’s own wording is that December 31 “does not mean that every service will keep running until that day.” A server that expires on December 3 goes down on December 3.

What the October breach exposed

This is the second incident in two months. In late August, an attacker used a leaked internal AWS credential to reach Zeabur’s main database and pull environment variables, apparently hunting for AI API keys. Zeabur’s status page listed exposed variable names including OPENAI_API_KEY, ANTHROPIC_API_KEY, STRIPE_SECRET_KEY, DATABASE_URL and AWS_SECRET_ACCESS_KEY.

On October 14, 2026 (UTC), an attacker got in again with leaked internal credentials. According to BleepingComputer, the attacker read the platform database, covering about 321,810 accounts and roughly 3.2 million environment-variable records across shared clusters in nine regions. The report also says there were root sign-ins on 101 Google Cloud servers belonging to 92 users, SSH keys added to 50 servers, and 16 customer disk copies attached to the attacker’s machines. Zeabur suspects the credentials came from the August breach, but hasn’t confirmed it.

Zeabur cited unencrypted credentials, admin credentials it hadn’t fully rotated after August, admin portals reachable from the internet, and admin tokens it hadn’t rotated since January 2024.

What to do now that Zeabur is shutting down

1. Rotate every secret you ever stored on Zeabur

Treat every value in your Zeabur environment variables as public. Generate new values in each provider’s own dashboard, then revoke the old ones there:

AI API keys (OpenAI, Anthropic, Gemini, OpenRouter)
Payment keys such as Stripe secret keys
Database passwords and connection strings
Cloud keys (AWS, Google Cloud, Cloudflare, DigitalOcean)
GitHub personal access tokens and OAuth client secrets
JWT signing secrets and session keys

Rotating a JWT secret signs out your users. That’s the point, so do it anyway. If you moved environment variables to your own server after August using Zeabur’s “Migrate to server” option, they weren’t in the platform database. BleepingComputer notes an attacker could still reach them on a compromised server, so rotate those too.

2. Check your servers and usage

On a Google Cloud dedicated server, change the root password and remove any SSH key you don’t recognize. Taiwanese outlet Kocpc reports Zeabur flagged a key named “zeabur-pentest”; we couldn’t confirm that name in Zeabur’s English notices, so remove anything unfamiliar either way. Zeabur’s September changelog adds options under Server > Settings > SSH password to delete the SSH credentials Zeabur stores, and Server > SSH shows login attempts by IP address. Then check your AI and cloud provider usage pages for spikes since mid-October.

3. Sign in again and replace revoked keys

Kocpc also reports that Zeabur rotated its session signing key, so expect to sign in again, and that Zeabur revoked old zSend and Zeabur Email API keys. Generate a new Zeabur API token if any scripts use one.

4. Ask for refunds and compensation separately

Balance refunds and compensation for the security incident are two different requests through zeabur.com/support. Say which one you want, and include your account, the affected services and what happened. For misused AI keys, Zeabur previously asked for screenshots from the provider’s dashboard and daily usage figures per key. Replies are slower than usual.

How to back up and migrate

List what you run. Write down each service, its database, its volumes, its domain and its server expiry date. The earliest expiry is your real deadline.
Export databases yourself. Use pg_dump for PostgreSQL or mysqldump for MySQL, and copy the dump off Zeabur. Zeabur says you can restart paused shared-cluster services manually to take backups after December 1, but don’t count on that window.
Export environment variables separately. Zeabur’s changelog warns that service and volume backups may not include settings stored as Kubernetes Secrets on dedicated servers. Rebuild that list on the new host with the new rotated values, not the old ones.
Export your container images. Zeabur keeps images in its own registry. After shutdown, pulls fail, so a service restarted elsewhere from a Zeabur image won’t start. Rebuild from your repository, or export the image before you cut over.
Stop using your .zeabur.app address. Zeabur’s guide says *.zeabur.app domains stop working. If clients, webhooks or OAuth callbacks point at one, move them to your own domain first.
Move your domains. You can transfer domains bought through Zeabur out from the Dashboard, or Zeabur Support will help move them to another registrar.
Redeploy and test. Your code is still in your Git repository, so redeploy it on the new host, restore the database, point DNS at it and test before your Zeabur server expires.

Let Zeabur’s migration guide do the heavy lifting

Before Zeabur finishes shutting down, use its official migration guide, published October 20. Zeabur wrote it so a coding agent such as Claude Code or Codex can work through it: inventory your services, choose a destination, do a dry run with a real restore, then cut over and change DNS yourself. Zeabur says it will keep updating the guide as the shutdown progresses. If you use an agent, let it use the Zeabur CLI already signed in on your computer rather than pasting your access token into the chat. If you can’t make the timeline, contact Support early and mention whether your service is down, whether you can reach your data and when your server expires.

Where to move with Zeabur shutting down

Platforms with a similar connect-a-repo-and-deploy workflow include Railway, Render and Fly.io, and Vercel or Netlify for frontends. If you’d rather keep control of the server, Coolify is an open-source panel you can run on your own VPS. Compare pricing and regions yourself; we haven’t tested any of them for this article. Whichever you pick, store secrets in its secret manager rather than committing them to your repository.

FAQ

When is Zeabur shutting down?

Shared-cluster services pause on December 1, 2026, and dedicated server renewals stop that day. Each dedicated server shuts down on its expiration date in December, and everything is offline by December 31, 2026.

Did the breach behind Zeabur shutting down expose my data?

If you stored environment variables in Zeabur’s platform database, assume yes. The October incident exposed about 3.2 million environment-variable records across roughly 321,810 accounts, according to BleepingComputer. Zeabur’s August notice says Stripe holds full card details and it found no evidence attackers reached card data.

Will Zeabur refund my balance?

Yes. Refund requests opened on October 17 through Zeabur Support, and Kocpc reports Zeabur pays refunds in the original currency. Incident compensation is a separate request.

Can I still back up a paused Zeabur service?

Zeabur says you can manually restart shared-cluster services paused on December 1 to take backups. It hasn’t said how long that will be possible, so back up before December 1.

Do this before Zeabur finishes shutting down

Open your Zeabur dashboard today, note each server’s expiry date, and rotate your AI and payment keys first, since those are the ones attackers went after in August. This isn’t the first hosting-side leak of developer keys this month; see our guide to the OpenCode breach and exposed API keys. If you run WordPress sites, also check our guide to the compromised Rank Math PRO 3.0.123 release.

Zeabur shutting down: what to do before December 1

Zeabur shutting down: the timeline

What the October breach exposed

What to do now that Zeabur is shutting down