[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEXgS-bOOJQ6amJ1JQfJokL7iiwsRiy3cjawU54RVCjU":3},{"article":4,"iocs":48,"watch_terms":53,"solutions":54,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"b0d81c4a-25a7-4019-b394-92de30a6377b","The Top 10 Attack Surface Exposures in 2026","the-top-10-attack-surface-exposures-in-2026-8b4290","Breaches don't always start with a zero-day. An exposed admin panel can get brute-forced, or credentials reused from a previous attack. But when a vulnerability does drop — like MongoBleed earlier this year, which let attackers pull credentials and session tokens from server memory without authentication — anything internet-facing is immediately at risk. With time-to-exploit now down to a","A new report analyzing 3,000 attack surfaces reveals that a significant portion of organizations have unnecessary internet-facing services. The top exposures include databases (MySQL, Postgres), API documentation, and administrative panels (WordPress, phpMyAdmin), with legacy services like SNMP and RDP also frequently found exposed. The analysis highlights the need for attack surface reduction alongside traditional vulnerability management.","Report details top 10 attack surface exposures, including databases, admin panels, and legacy services.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fthe-top-10-attack-surface-exposures-in.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiM2DfFAWIuQ6v6hyh32CXcT_wKU72aTUxixyWIcnjW04ydv40r8RtVXjDrxKJzksW6zzqYciPMxgYAwcDGRz8kahhZVZXoi0FySWg5o8LpWo_KkHdX4wRX4Qgk6ONxHqyb7_cF5TN5qQp-9B4hOQpB3WljI8sDbHMlOh6n2jyTjV30kxC-ccJVJHu4bTs\u002Fs1600\u002FINTRUDER.jpg","2026-06-17T10:30:00+00:00","2026-06-17T12:00:28.355062+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"MySQL","product",{"name":21,"type":19},"Postgres",{"name":23,"type":19},"WordPress",{"name":25,"type":19},"Remote Desktop Service",{"name":27,"type":19},"SNMP",{"name":29,"type":19},"phpMyAdmin","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,43],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":50,"value":51,"context":52},"malware","MongoBleed","Vulnerability allowing credential and session token extraction from server memory.",[18,21,23],{"controls":55,"vendors":136},[56,85,107],{"slug":57,"name":58,"problem":59,"products":60},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":86,"name":87,"problem":88,"products":89},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"detectify","Detectify","\u002Fvendor-logos\u002Fdetectify.png","surface-monitoring","Detectify Surface Monitoring","https:\u002F\u002Fdetectify.com\u002Fproduct\u002Fsurface-monitoring","Continuous discovery and testing of internet-facing subdomains and services.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","attack-surface-intelligence","Attack Surface Intelligence","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fattack-surface-intelligence","External attack surface management that discovers internet-facing assets and prioritises their exposures.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},{"slug":108,"name":109,"problem":110,"products":111},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"clavister","Clavister","\u002Fvendor-logos\u002Fclavister.png","clavister-netwall","Clavister NetWall","https:\u002F\u002Fwww.clavister.com\u002Fproducts\u002Fclavister-netwall\u002F","Next-generation firewalls developed in Sweden.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","next-generation-firewall","Next-Generation Firewalls","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fnetwork-security\u002Fnext-generation-firewall","Hardware, virtual and cloud firewalls running PAN-OS, with intrusion prevention.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"sonicwall","SonicWall","\u002Fvendor-logos\u002Fsonicwall.png","sonicwall-firewalls","SonicWall firewalls","https:\u002F\u002Fwww.sonicwall.com\u002Fproducts\u002Ffirewalls","Next-generation firewalls for small business to enterprise.",[],{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":152},"unnecessary-internet-facing-services-dominate-2026-attack-surfaces","Unnecessary Internet-Facing Services Dominate 2026 Attack Surfaces","A review of 3,000 organizational attack surfaces found that databases, admin panels, API documentation, and legacy protocols like SNMP and RDP are routinely exposed to the public internet — often without business justification. This represents a fundamental configuration management failure, where services are left accessible by default rather than being deliberately scoped to only what is necessary. Exposed administrative interfaces such as phpMyAdmin and WordPress admin panels provide direct pathways for credential attacks and exploitation of known vulnerabilities. Legacy services like SNMP and RDP carry decades of known weaknesses and dramatically widen the blast radius if compromised. Attack surface reduction must be treated as a continuous discipline, not a one-time hardening exercise.",[142,143,144,145,146,147,148,149,150,151],"CIS Control 1 – Inventory and Control of Enterprise Assets","CIS Control 12 – Network Infrastructure Management","CIS Control 18 – Penetration Testing","NIST SP 800-41 – Guidelines on Firewalls and Firewall Policy","NIST CSF ID.AM-1 – Physical devices and systems inventoried","NIST CSF PR.AC-5 – Network integrity is protected (network segregation)","NIST SP 800-115 – Technical Guide to Information Security Testing","ISO\u002FIEC 27001 A.13.1 – Network security management","ISO\u002FIEC 27001 A.12.6 – Management of technical vulnerabilities","OWASP API Security Top 10 – API3:2023 Broken Object Property Level Authorization",{}]