- Failory
- Posts
- Hack Me Twice
Hey, it’s Nico.
Quick personal note before today’s issue: tonight I’m flying to New York, where I’ll be until Sunday night. After that, I’ll be in San Francisco until November 20.
If you’re in either city and want to grab a coffee, just reply to this email. I’d love to meet founders and people building in consumer and AI, hear what you’re working on, and help if I can.
Here are the 3 most important things of today’s issue:
Zeabur, a startup that helped developers deploy and host apps, shut down after being hacked twice — find out why below
Yesterday, part of the internet went down. Two severe PHP vulnerability were found by AI and had to be promptly fixed — learn what this means for the future of cybersecurity
Coming to AcceleratorCON tomorrow? Come say hi. The first 10 Failory readers get a free Founder ticket with code NICO10.
Successful founders don't rely on one right guess. They keep asking. AD
A single good decision won’t carry a company, but a habit of listening can.
SurveyMonkey helps founders build continuous feedback into the way they work, from customer satisfaction and product ideas to team culture, so every decision is a little more informed than the last.
Join 260K+ organizations building on real answers, not guesses.
This Week In Startups
🔗 Resources
How to run reference checks that reveal something
How Netflix got creatives to adopt AI
What engineers do when AI writes the code
📰 News
OpenAI acquires Orchestra Bio, a platform for coordinating drug development
DeepSeek open-sources its DeepInfer inference engine
Inception launches Mercury 3, a diffusion language model with a 1M-token context window
NVIDIA releases Nemotron 3.5 Super VL and Bolt 74B models for cloud and local AI agents
💸 Fundraising
Flapping Airplanes, a startup that researches ways to train and run AI models with less data and compute, raised $1B in Series A funding
Legora, a startup that builds AI agents for legal research and document work, raised $550M in Series E funding
Peak Energy, a startup that builds sodium-ion batteries for grid-scale energy storage, raised $108M in Series B funding
Mach9, a startup that turns 3D infrastructure scans into engineering drawings with AI, raised $34M in Series A funding
AcceleratorCON is tomorrow: 10 free founder tickets AD
Tomorrow, the startup ecosystem comes together in New York City.
AcceleratorCON is one high-impact day for founders, investors, accelerators, and ecosystem leaders to meet face-to-face.
The confirmed lineup includes:
Andres Barreto, Managing Director at Techstars
Bryanna Samuels, Director at New York Ventures
Javad Mushtaq, Managing Director and Head of AI Nexus (NYC) at C10Labs
Oliver Libby, Managing Partner at H/L Ventures
Nelly Yusupova, Founder of Techspeak
Plus investors, accelerators, startup operators, and participants in the Draft Experience.
Come for the conversations about startup growth, capital, AI, and accelerators. Stay focused on the connections and opportunities you can take forward after the event.
AcceleratorCON is tomorrow, October 23. If you have been considering attending, now is the time to make your decision.
I am personally sponsoring 10 free Founder tickets. Use code NICO10 before they run out.
If they have run out, use code FAILORY25 to save 25%.
Fail(St)ory
Hacked Twice
In August, an attacker broke into Zeabur, a Taipei startup that hosted apps and managed servers for developers. Afterward, the company told customers it had disabled or rotated all internal administrative keys.
Seven weeks later, it was hacked again, using credentials the cleanup had missed. On October 17, Zeabur announced its shutdown.
What Was Zeabur:
Zeabur offered a Vercel-style deployment service for backends, databases, and tools like n8n. It put a dashboard and AI assistant on top of servers from providers such as AWS and Google Cloud.
You could connect a GitHub repository or pick an app template, and Zeabur would build and deploy the service. Its assistant could create projects, configure settings, and connect domains. Developers could manage their apps and databases together without jumping between cloud consoles.
Customers paid for hosting or servers, plus subscriptions starting at $5 a month for platform features. They could use Zeabur's shared infrastructure, buy a dedicated server through the company, or connect one they already owned.
By November 2025, Zeabur reported more than 5,000 individual paying customers and had announced a $2 million seed round. The service saved customers work, while giving Zeabur access to the servers, database passwords, and API keys behind their applications.
On August 27, an attacker exploited a flaw in a customer's NextChat app. From that foothold, they reached internal systems, found privileged credentials, and accessed Zeabur's production database. A vulnerability in one customer's app had exposed secrets belonging to other customers.
Zeabur disabled its old API keys, rotated credentials, and published a report explaining the attack. Customers were told to replace their exposed keys and passwords.
But, on October 14, another attacker used internal credentials that still worked to enter Zeabur's shared infrastructure. Dedicated servers were compromised too. The second breach exposed records for 321,810 accounts and more than three million environment-variable records, including database passwords and API keys.
The cleanup had missed administrator tokens and cloud credentials.
Three days after the second attack began, the founder announced the shutdown. He described a system that had become increasingly complex to maintain and said the team had reassessed what continuing would require.
The Numbers:
💰 Seed funding: $2M
👥 Paying customers: 5,000+ in November 2025
🔓 Account records exposed: 321,810
🖥️ Google Cloud servers accessed: 101
📅 Final shutdown: December 31, 2026
Reasons for Failure:
Customer apps could reach platform secrets: The August intrusion spread through poorly isolated systems and credentials with excessive permissions. Access to one customer's application became access to internal services and other customers' secrets. The damage extended across the platform Zeabur was supposed to manage.
The cleanup missed live credentials: Zeabur's October report corrected its earlier assurance that all internal administrative keys had been disabled or rotated. Some tokens had remained valid since January 2024, an uncomfortable lifespan for that much access. Known problems with stored server passwords also remained unresolved when the second attack arrived.
The hosting transition left old systems running: In February, Zeabur acknowledged that shared-hosting prices were below its AWS costs and announced a shift toward managing dedicated servers. Existing workloads kept running, carrying maintenance and security obligations through the transition. Changing the business model still left the team responsible for protecting the old service.
Why It Matters:
Isolate customer apps so one vulnerability cannot expose everyone else’s secrets.
After a breach, revoke every exposed credential, including copies in backups and configuration files.
Budget for security and support until the last customer leaves your old infrastructure.
Trend
The Day Websites Went Dark
Yesterday, parts of the internet went dark.
Government websites were taken offline as operators rushed to protect them from two critical flaws in PHP. AI-assisted security research had helped demonstrate how dangerous those weaknesses could be.
Why it Matters
A well-maintained app can still inherit a critical flaw from the software underneath it.
AI is making it practical to investigate serious weaknesses that survived years of testing.
Faster discovery puts more pressure on the people who validate findings, build fixes, and deploy them.
The PHP Emergency
More than 30 years after its first public release, PHP still powers roughly seven in ten websites. WordPress, Drupal, and Joomla all depend on it.
Back in 2024, a PHP developer had noticed signs of a serious problem. The team could imagine how someone might exploit it, but had no working attack to demonstrate the danger. Fixing it was difficult, and work repeatedly stalled.
Then, this August, researchers at Calif and Wiz reported working attacks after investigating PHP with AI. Wiz says the underlying flaws had been there for decades. Its researchers demonstrated that they could run their own code on test installations of WordPress, Drupal, and Joomla without needing a login.
For vulnerable sites, that could let an intruder steal sensitive data or change what visitors saw. The two vulnerabilities received a severity score of 9.2 out of 10. Demonstrating those attacks made the full danger clear, and fixing the problem became the PHP team's top security priority.
The PHP team had kept the findings confidential while preparing a coordinated fix. But on Tuesday, news leaked ahead of the scheduled release, forcing the team to bring it forward by a day. Websites were still running vulnerable software while their operators waited for updates they could install.
The concern was that attackers would exploit the flaws before those websites could be updated. Britain's cybersecurity agency advised organizations to consider taking systems offline if they couldn't secure them immediately.
Across Europe, government services, universities, and hosting providers took websites offline as a precaution. One host shut down all its customers' websites. PHP released the fixes on Wednesday, but operators still had to install them before restoring affected services.
The Signals
Other teams have been finding serious flaws in mature software with AI this year. Their results show how much old code remains worth investigating, and how quickly parts of that investigation can now move:
Firefox: Mozilla has spent years testing and hardening its browser. In April, it shipped fixes for 271 security bugs found with AI, including 180 rated high severity. Some defects had survived for 15 or 20 years.
Linux: In April, cybersecurity firm Theori disclosed a flaw that had been present since 2017 and could let someone with an ordinary local account gain full control of a machine. One of its researchers suspected where a weakness might be and directed the company’s AI tool to investigate that part of Linux. The company says the AI scan returned the finding in about an hour.
FFmpeg: The software used to process audio and video had been carrying a high-severity bug for 19 years, according to AISLE. In August, the company included it among six high or critical vulnerabilities found through AI-assisted research. This adds another established project to the pattern: a fresh investigation with AI exposed serious problems in code that had already been in use for years.
The Trend
AI is exposing a backlog of serious flaws in some of the internet’s most established software. These projects have survived decades of use, active development, and security work. PHP, Firefox, and FFmpeg show how dangerous weaknesses can remain in that code until better tools make them practical to uncover or prove exploitable.
That makes the potential exposure much larger than the projects being scanned. An application can be carefully maintained while relying on a vulnerable language, library, or operating system several layers below it. Each new discovery in that shared foundation can force many unrelated products to update at once.
That creates a race around open-source code that both maintainers and attackers can examine with AI. Defenders have to turn a growing stream of findings into safe patches, then get the organizations using that software to install them. Attackers can look for the weaknesses still waiting to be fixed, or the systems still waiting to be updated.
Help Me Improve Failory
How useful did you find today’s newsletter?Your feedback helps me make future issues more relevant and valuable. |
That's all for today’s edition.
Cheers,
Nico