The common thread in the recent incidents logged on this beat is not a novel exploit. It is credentials and keys that were already sitting inside systems, exposed or stored badly, and then used against the organizations that held them. Zeabur, CISA's accounting of SafePay's victims, and the OpenCode exposure all describe breaches that turn on access material rather than on a clever technical break-in.
Plaintext Is the Whole Story at Zeabur
The clearest case is Zeabur, the development platform that is shutting down after its second security breach in two months, as BleepingComputer reported. The disclosed incident involved an attacker using leaked internal credentials that had been stored in plaintext to compromise infrastructure. The haul was large and unusually specific: more than 3.2 million environment variable records and information for 321,810 accounts.
That detail matters because environment variables are where modern software keeps its secrets. A development platform holds exactly the material its customers use to reach databases, cloud services and third-party APIs. Storing those credentials in plaintext turns an internal compromise into a supply-chain event, and the account count shows how quickly a single set of internal keys becomes a customer-facing breach. The second breach in two months also suggests remediation did not address how the credentials were held in the first place, or that the same exposure survived the first cleanup.
SafePay Shows the Scale of Credential-Driven Intrusions
The CISA advisory on SafePay, also reported by BleepingComputer, puts the pattern at infrastructure scale. The agency says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. A ransomware operation of that size depends on repeatable access, and the recurring path into organizations is stolen or weak credentials rather than bespoke tooling. The 600-plus figure is a measure of how many organizations had access material that could be bought, guessed or reused.
For US technology companies, the relevant point is that critical infrastructure is now heavily software-defined. The operators on CISA's list depend on cloud platforms, managed services and API-driven vendors, many of them American. A gang that gets in through credentials at an operator can reach the vendors connected to it, and vice versa. The SafePay numbers describe an access problem that crosses the boundary between a customer and its suppliers.
OpenCode Exposes Keys, Not Just Accounts
The third incident involves the open-source AI coding project OpenCode, which notified a small number of users that API keys they used with external providers were exposed in a security breach, per BleepingComputer. The affected population is small, and the notification language suggests the project moved to contain it. But the asset that leaked was not a password to a discussion forum. It was a working key to an external provider, which means the exposure lands on third parties who never had a relationship with OpenCode's users.
That is the same structural issue as Zeabur, at a different scale. AI coding tools chain together providers, and the keys that connect them are the weak link. When a project stores or transmits those keys in a way that fails, the damage surfaces in billing, in provider-side abuse and in the uncertainty of not knowing which key was used where. The small user count understates the reach of the disclosure.
