[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuCsYfri6X1aBExYpGkTdDZR4Dbu5rFuIcpAhsGoEqRQ":3},{"article":4,"iocs":48,"watch_terms":59,"solutions":60,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"5f09556b-9d9f-457c-bf03-2433987ff2fc","Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers","mass-scanning-campaign-exploits-vite-flaw-to-extract-cloud-credentials-from-expo-bf27a7","Cybersecurity researchers have disclosed details of a mass-scanning campaign that has targeted Vite deployments siphon sensitive data. The first is an automated effort aimed at internet-exposed Vite development servers that's designed to steal cloud credentials, configurations from Amazon Web Services (AWS) and Microsoft Azure instances, and infrastructure state files, per F5 Labs. The","A mass-scanning campaign is actively exploiting a high-severity vulnerability (CVE-2026-39364) in Vite, a popular web development tool. Attackers are targeting internet-exposed Vite development servers to steal cloud credentials, configurations for AWS and Azure, and infrastructure state files by manipulating query parameters to bypass security restrictions. The campaign, observed in August 2026, requires specific conditions to be met for successful exploitation, including the Vite dev server being explicitly exposed to the network.","Mass-scanning campaign exploits Vite flaw to steal cloud credentials from exposed dev servers.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fmass-scanning-campaign-exploits-vite.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgDvoBVfJIN7YwGuf64F0CQWt9GrAVzaxDWGJetCrAGM_QgGEfpZm_I7f3FTkWBydY7v_iV4n8RWPAr4jfp7ZhN9DVbVZGDryBYlZiL6dn5RuYzLd811NH_sARdjbwWIpf9kOj-jtXfLzb7BTuy-iMpHbsgB9n8J5T7Hx0qp0D1_XeJR-ANcGQ5p88YH3fE\u002Fs1600\u002Fvite.jpg","2026-09-15T11:12:32+00:00","2026-09-15T14:00:26.422482+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"Vite","product",{"name":21,"type":22},"F5 Labs","vendor",{"name":24,"type":25},"AWS","technology",{"name":27,"type":25},"Microsoft Azure",{"name":29,"type":25},"Google Cloud Platform","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,38,43],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53,57],{"type":50,"value":51,"context":52},"cve","CVE-2026-39364","Vite vulnerability exploited in the campaign",{"type":54,"value":55,"context":56},"ip","34.94.237.62","Forged X-Forwarded-For\u002FX-Real-IP header used by attackers",{"type":54,"value":58,"context":56},"104.28.219.193",[21,18],{"controls":61,"vendors":145},[62,91,117],{"slug":63,"name":64,"problem":65,"products":66},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":92,"name":93,"problem":94,"products":95},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"detectify","Detectify","\u002Fvendor-logos\u002Fdetectify.png","surface-monitoring","Detectify Surface Monitoring","https:\u002F\u002Fdetectify.com\u002Fproduct\u002Fsurface-monitoring","Continuous discovery and testing of internet-facing subdomains and services.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"censys","Censys","\u002Fvendor-logos\u002Fcensys.png","censys-external-exposure-management","Censys External Exposure Management","https:\u002F\u002Fcensys.com\u002Fsolutions\u002Fexternal-exposure-management","External attack surface discovery based on continuous internet-wide scanning.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":113,"product_name":114,"url":115,"description":116},"cortex-xpanse","Cortex Xpanse","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xpanse","External attack surface discovery and remediation.",{"slug":118,"name":119,"problem":120,"products":121},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[122,130,137],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":132,"url":135,"description":136},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",[146],{"slug":147,"name":148,"logo_path":149,"roles":150},"f5","F5","\u002Fvendor-logos\u002Ff5.png",[151],"reported_by",{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":167},"vite-dev-server-flaw-exploited-to-steal-cloud-credentials-at-scale","Vite Dev Server Flaw Exploited to Steal Cloud Credentials at Scale","Attackers are mass-scanning for internet-exposed Vite development servers vulnerable to CVE-2026-39364, exploiting a query parameter manipulation flaw to bypass security restrictions and exfiltrate cloud credentials, AWS\u002FAzure configurations, and infrastructure state files. The root problem is twofold: unpatched development tooling and the critical mistake of exposing dev servers directly to the internet, a practice never intended for production or public-facing environments. Development tools like Vite are built for local use and lack the hardening of production-grade software, making them high-value, low-resistance targets. This incident highlights that cloud credential exposure can cascade into full infrastructure compromise, making the blast radius of a seemingly 'dev environment' breach catastrophic.",[157,158,159,160,161,162,163,164,165,166],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 18: Penetration Testing","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 CM-7: Least Functionality","NIST CSF PR.AC-5: Network Integrity Protection","NIST CSF DE.CM-8: Vulnerability Scans Performed","GDPR Article 32: Security of Processing (where EU personal data may be at risk)",{}]