Zeabur 10/15 Security Incident: Impact Assessment in Progress

Incident Summary

On October 15, 2026, Zeabur, the upstream deployment platform we use, published a new security incident notice (incident 1091243):

• Official status page: https://status.zeabur.com/incident/1091243

Based on Zeabur’s latest update as of Oct 15, 2026 23:33 UTC:

1. The attacker gained unauthorized access to PostgreSQL / MySQL services deployed on still-active legacy shared clusters.
2. The scope is broader than initially reported: some Google Cloud dedicated servers were also accessed without authorization.
3. The attacker had read access to Zeabur’s platform database. Potentially exposed data includes service environment variables, account information, API tokens, and zSend API keys.
4. Zeabur has revoked the compromised credentials it identified, rotated the session signing key (all users must sign in again), and temporarily restricted public SSH access to Google Cloud dedicated servers; web-based SSH remains available.
5. Core platform features such as the dashboard, GitHub sign-in, builds and deployments, and database backups have been restored. Server-management features for some other providers are still being restored.

Impact on sk5s

We are conducting an internal review against Zeabur’s announcement and our own records. At this time:

• If any sk5s projects are hosted on the affected shared clusters or Google Cloud dedicated servers, the relevant environment variables and credentials may be at risk of exposure.
• sk5s game applications do not store game progress, payment, or subscription records by design; however, sk5s operates newsletter and SSO systems that collect email addresses. We are evaluating whether this upstream incident affects those systems and will notify affected users if any risk is identified.

Actions Taken and Planned

• We have started an internal review to identify affected projects and any exposed credentials.
• Based on the review, we will rotate relevant cloud and third-party API keys, tokens, database passwords, and application signing secrets.
• We will audit and clean up project environment variables, removing known high-risk credential patterns.
• We will continue monitoring for unusual sign-in and access activity.

Recommendations for Users

Although sk5s game applications do not store personal sensitive data, sk5s operates newsletter and SSO systems that collect email addresses. We recommend that users:

• Watch for any unusual account sign-ins or notifications.
• Contact us if you receive any suspicious emails or notifications related to your sk5s account.

Ongoing Monitoring

We will continue to follow Zeabur’s official investigation and status updates, and will post an updated notice to this channel once we have completed our internal review or if new risks are identified.