42 publicly listable cloud buckets containing 18 billion files, including exposed credentials, database dumps and backups. The Ransomnews research team counted 484,142 publicly listable cloud storage buckets in October 2026, holding 18.05 billion files. They built the count from the search engines that index open cloud storage and published it as the Ransomnews Cloud Exposure Index, written by Mantas Sasnauskas. “No file was opened for this index. Every number below comes from bucket names, file extensions, file counts and last-modified timestamps. That is a deliberate limit. It keeps the research on the right side of the line, and it turns out to be enough to see where the sensitive material concentrates.” Ransomnews states. “We are calling it the Ransomnews Cloud Exposure Index, and we will rerun it quarterly so the numbers can be compared over time.” The researchers used bucket names, file types, file counts and last-modified dates to collect their data. They did not open any files, allowing them to identify where sensitive information might be stored without accessing the content. They plan to repeat the research every three months to track changes over time. Amazon S3 accounts for 72% of the exposed buckets, roughly in line with its share of the market. This does not mean S3 has weaker security than other providers. Azure Blob, however, appears 2.5 to 3.6 times more often than expected among buckets named for backups, data exports and payroll records. The researchers also found 321,058 files related to credentials and keys. Of the exposed .env files, 67% were last modified in 2026. Below is the split by provider, from a snapshot taken on October 7: ProviderOpen bucketsShareAmazon S3347,98471.9%Azure Blob68,53214.2%Google Cloud Storage53,13111.0%DigitalOcean Spaces11,0692.3%Alibaba OSS3,4260.7%Total484,142100% A lot of these buckets are public on purpose, holding website assets, CDN mirrors, open datasets and podcast archives. So the index isn’t 484,142 breaches. It’s the pool where breaches hide, and the rest of the report narrows it down to the stores that should never have been listable. “Azure, by a wide margin relative to its size. Azure Blob holds 14.2% of open buckets, but 37% of the 1,459 buckets with “backup” in the name, 42% of the 399 named for exports, and 51% of the 505 carrying HR or payroll terms.” continues the report. “Buckets named for logs, customers and databases sit at 35% to 36%, all around two and a half times Azure’s baseline.” The skew only shows up for operational data. Buckets named “dev” sit at Azure’s baseline of 15 percent, and “test” and “staging” fall below it, at 9 and 7 percent. The authors suspect Azure storage accounts more often hold line-of-business data such as backups, exports and HR systems that enterprises run on Microsoft, while S3 and Google Cloud carry more application assets. They call it a hypothesis the counts suggest and don’t prove, and it’s the first thing they want to test next time. By sector, retail and e-commerce names lead with 5,666 buckets, mostly storefront assets. The more worrying number is that names tied to regulated sectors (finance, healthcare, education, government, legal and HR) appear on 10,891 unique open buckets. Those are the places where a stray file most likely holds personal, health or financial records, and where regulators expect to hear about it. Sector (by bucket name)Open bucketsFiles in themRetail and e-commerce5,666269.9MFinance and insurance3,50858.0MHealthcare2,70947.9MMedia and entertainment2,696136.2MEducation2,39360.6MGaming2,29679.0MTravel and hospitality1,714118.7MReal estate1,13760.7MGovernment and public sector1,00036.2MLegal97811.3MCrypto63011.9MHR and payroll5058.4M Healthcare-related names appear in 2,709 buckets containing 47.9 million files. The researchers identified them using terms such as “hospital” (135 buckets), “patient” (135), “clinic” (277) and “dental” (331). HR and payroll is the smallest sector, with 505 buckets, 259 of which are hosted on Azure. These figures are based on names, not proof of ownership. The search matches parts of words, so “store” can refer to object storage as well as shops. A single bucket can also appear in two sectors. The exposed buckets also list about 4.7 million database and dump files, 15,130 mailbox archives, and tens of millions of spreadsheets and documents. Credential files are particularly concerning because they can turn a cloud misconfiguration into a real intrusion. File typeWhat it isFiles listed.pemCertificates and private keys113,285.envApp secrets and API keys80,495.p12Certificate bundles with keys33,268.keystoreJava and Android keystores27,229.ppkPuTTY SSH private keys24,302.pfxWindows certificate bundles23,352.ovpnOpenVPN client configs15,079.jksJava keystores2,421.htpasswdWeb server password files695.tfstateTerraform infrastructure state475.kdbxKeePass password vaults457 Each of these exists to grant access. A .env file is where developers keep database passwords and API keys. A .tfstate file is Terraform’s record of a whole cloud setup, often with secrets in plain text, and a .kdbx vault is encrypted but now open to anyone who wants to guess passwords offline. Some .pem files are public certificates and some files are test fixtures, so the counts are a ceiling on live secrets and not a measure of them. It’s still a big ceiling. Database files make up most of the sensitive material by volume: File typeWhat it usually holdsFiles listed.sqliteEmbedded app databases2,561,807.bakDatabase and server backups752,055.sqlDatabase dumps687,446.sqlite3Embedded app databases488,176.dumpDatabase dumps176,603.mdb / .accdbMicrosoft Access databases36,467.dmpMemory and crash dumps12,809.pst / .ost / .mboxMailbox archives15,130.emlSaved emails4,549,665.csvData exports and recordsat least 69,580,112.xlsx / .xlsSpreadsheets42,544,997.docxWord documents24,936,788.pdfDocuments, invoices, scansat least 106,191,393.logApplication and server logsat least 61,310,809 The exposed buckets contain thousands of virtual disk images, including VMware, Hyper-V and QEMU files. A single disk image can contain an entire server, including credentials. Some exposures involve active systems. Of 80,495 .env files, 67% were last modified in 2026. Certificates and SQLite databases include both recent and older files. Backups appear older, with 89% of the 752,055 .bak files last modified before 2025. Almost all PuTTY key files date from 2024. Recent leaks need urgent attention, while long-standing exposures point to poor security management. The problem is ongoing: at least 113.6 million files were added to publicly listable buckets in the seven days before September 9. Over the previous 30 days, these included more than 21,000 SQL dumps, nearly 21,000 backup files, 4,477 .pem files and 1,298 .env files. Public .env files can expose database passwords that ransomware affiliates and initial access brokers look for. Similar credentials appear in stolen-data logs, but in this case, attackers do not need to infect a device. They only need to search for exposed files. Cloud providers already offer settings to prevent public access. Organizations should enable S3 Block Public Access, disable anonymous access to Azure Blob storage, and enable public access prevention in Google Cloud. These controls should apply at account or organization level to prevent new storage buckets from becoming public. Organizations should also scan their storage for sensitive files such as .env, .sql, .bak, .pem, .ppk, .tfstate and .kdbx. Terraform state files and virtual disk images should be treated as secrets, stored privately, encrypted and monitored. Backups should never be publicly accessible, and recovery procedures must be tested. One exposed bucket may be a mistake, but many often indicate a wider process failure. Organizations need to fix the underlying security controls, not just individual buckets. The research has some limitations. The team queried search engines on October 25, while the bucket list was current to October 7 and the newest indexed file dated September 9. File-level data may therefore be about a month old. Counts are also capped at one million per query, so researchers split larger categories into date ranges and added the results. Some limits apply. The team queried the search engines on October 25. The bucket list was current to October 7 and the newest indexed file was dated September 9, so file-level figures lag by about a month. The index caps any single count at one million, so larger types were split into date windows and summed. A last-modified date shows when a file was written, not when it was exposed, and a listed file isn’t proof that its contents can be read. No bucket is named in the report. Exposures with a known owner in regulated sectors are going through responsible disclosure, with national CERTs copied where the owner is public sector or doesn’t respond. “Rotate any secret that has ever sat in a public bucket. Closing the bucket does not un-leak the key. Assume anything that was listable was copied.” conlcudes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Cloud Buckets)
A massive search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users' searches through tracking servers to generate advertising revenue from Bing and Yahoo. A new report by Socket's John Tuckner expands on the researcher's April 2025 discovery of 57 Chrome extensions with 6 million users, adding 264 newly identified add-ons with another 8.7 million users. "These extensions were created by a handful of organized operators all working from the same idea: quietly take over the browser's default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID," explained Tuckner. The extensions, with the full list shared at the bottom of Socket's report, pretend to be PDF converters, manual finders, safe search, and AI search tools. However, for the most part, the extensions simply redirect users' searches through a series of sites until they land on Bing or Yahoo.
AI agents can control authenticated browsers, interact with corporate applications, and access sensitive data while appearing to act as legitimate employees. Keep Aware examines three ways agents operate inside browsers and why traditional security tools may struggle to distinguish their activity from human users.
US election websites show improved security, but weak email protection, non-.gov domains and third-party tracking still expose voters to risks. Millions of Americans will use websites to check their registration, find polling places or track ballots before the November 3 election. However, a new study finds that many county election websites still have security weaknesses involving domain names, email authentication, encrypted connections and third-party tracking. Mysterium VPN’s 2026 County Election Website Security Census examines 2,081 county election websites across the United States. “42% of county election websites aren’t on .gov (869 of 2,081 identified). That’s down from 57% in 2024.” states the report. “Weighted by population, it’s 28% because the big counties moved first.” That’s an improvement from 57% in the company’s 2024 census. However, the findings reveal persistent weaknesses that could expose voters to impersonation, misleading websites and unnecessary data collection. These findings concern public information websites and their contact domains. They do not establish that voting machines, ballot-counting systems or election results have been compromised. The researchers started with 3,144 US counties and county equivalents but identified county-run election information pages for 2,081. Of these, 869 used domains outside .gov. Only verified US government organizations can register a .gov domain, making it a useful way for voters to identify official government websites. The study found that larger counties had made more progress: when weighted by population, 28% of residents lived in counties whose election pages used non-.gov domains. Texas accounted for 169 non-.gov sites, including 134 using the older co.<county>.tx.us structure. Arizona and Nebraska had no identified non-.gov county election sites. The FBI and CISA previously warned that criminals were using fake election websites to spread false information and collect personal data. Moving to .gov and redirecting older addresses can reduce confusion, although the domain alone cannot guarantee that every aspect of a website is secure. Election offices communicate with voters about registration, identification requirements and missing ballots. Weak email authentication can make it easier for attackers to impersonate these offices. Of 1,977 readable election pages, 965 displayed a contact address. After excluding consumer email services, researchers examined 942 county-controlled domains. “Of the 1,977 election pages whose content we could read, 965 display a contact address. Twenty-three of those are at consumer providers like Gmail. As in 2024, we set them aside, because Gmail’s security policy is Gmail’s, not the county’s.” states the report. “That leaves 942 county-controlled election email domains.” The study reported that 23% had no DMARC record, while 28% used p=none, a monitoring-only policy that does not request quarantine or rejection of unauthenticated messages. Another 30% requested quarantine and 19% rejection. Together, the first two groups account for roughly 51% of domains without an enforced DMARC policy. The report’s underlying counts total 941 rather than the stated 942, a discrepancy that requires clarification. The share of domains without DMARC fell from 41% in 2024 to 23% in 2026. SPF, another email authentication mechanism, was present on 98% of checked domains. Smaller counties performed worse. Among the third of counties with the fewest residents, 34% of election contact domains lacked DMARC, compared with 12% among the largest counties. Non-.gov domains also showed weaker protection: 32% lacked DMARC, compared with 16% of .gov domains. These findings indicate an association, not proof that adopting .gov automatically improves email security. DMARC enforcement can reduce certain forms of domain spoofing, but it cannot prevent every impersonation attempt, lookalike domain or attack involving compromised accounts. The researchers found 28 websites with consistent HTTPS failures among the 2,081 tested. Fifteen lacked a working HTTPS service, seven presented certificates for the wrong domain, and others had expired or untrusted certificates or failed to establish a secure connection. Another 178 websites would serve election pages over unencrypted HTTP if visitors requested them that way. Only 34% sent an HSTS header, which instructs compatible browsers to insist on encrypted connections. Sixty-three certificates were due to expire within 30 days of Election Day. A separate test examined third-party connections when election pages loaded in a clean browser, without clicks or scrolling. Of 1,930 measured pages, 84% contacted at least one company identified as a tracker by Disconnect or DuckDuckGo. The median page contacted six third-party domains. Google Analytics or Tag Manager appeared on 60% of websites, while Meta Pixel appeared on 3%. Mysterium suggests that some tracking results from default settings in website platforms rather than deliberate decisions by election officials. The presence of third-party code does not, by itself, establish unlawful tracking or prove exactly what information was collected. Still, counties should review whether these connections are necessary on pages designed to provide basic voting information. The study examined recognizable election-related domain names across several extensions, including .gov, .com, .org, .net, .us and .vote. Researchers identified 2,074 matching names that resolved to an address. Of these, 121 were registered outside government control. Thirty-eight hosted unrelated websites, eight were offered for sale, 73 displayed basic server or hosting pages, and two served gambling or spam content. The researchers also found 73 counties with a working .gov version of the name used by their non-.gov election website, suggesting that some had secured the official address without completing the migration. A separate test generated 14,456 single-character misspellings of 77 state and large-county election domains. Researchers found 245 registered variants and identified 26 that served parked, placeholder or unrelated pages after excluding potentially coincidental matches. The study does not establish that these registrations were malicious or identify their owners. However, a voter who mistypes an address or guesses the wrong domain ending could reach a third-party website instead of an official source. Across the seven states that decided the 2024 presidential election, 43% of identified county election websites were outside .gov, down from 55% in 2024. In these states, 26% of election contact domains lacked DMARC, compared with 39% two years earlier. However, 55% still lacked an enforced policy. The nine states whose 2026 Senate races were rated toss-up or lean in mid-October showed similar concerns: 53% of identified county election sites were outside .gov, while 44% of election contact domains lacked enforced DMARC. These figures measure website and email configurations. They are not evidence that an election has been compromised. Mysterium recommends that eligible government organizations complete the move to .gov, redirect old addresses, enforce email authentication policies and configure HTTP-to-HTTPS redirects and HSTS. Counties should inventory legitimate email senders before tightening DMARC policies to avoid disrupting valid communications. They should also review advertising pixels and unnecessary third-party connections, monitor certificate expiration dates and consider registering defensive versions of their domains. For voters, the report recommends starting with the state election office listed on USA.gov and following its link to the relevant county website. Voters should avoid trusting unsolicited messages or plausible-looking search results without checking the destination. If an election-office email comes from an unexpected address, voters should verify it using an independently obtained official telephone number. An unusual address is a reason to check, not proof of fraud, since the study found that some legitimate offices still use consumer email services. The researchers combined Census Bureau county data with official websites recorded in Wikidata and checked them against CISA’s .gov registry. They tested displayed contact addresses, email authentication records, certificates, redirects, tracking requests and lookalike domains. The study identified 2,081 election pages, compared with 2,913 in the 2024 manual survey. Automated discovery favored larger counties with better-structured websites, leaving smaller counties underrepresented even though some had weaker protections. The comparisons indicate progress but are not a perfectly matched before-and-after assessment. Different tests also used different sample sizes, and the tracking analysis measured a single page load from one location. The observations reflect October 17, 2026, rather than continuous monitoring. The findings provide a useful snapshot of public-facing election website security, but individual results should be rechecked before drawing conclusions about a specific county. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Election Website)
U.S. law enforcement has seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums for facilitating illegal activities. The service also operated under the names Secury, Massgod, Spamhouse, Lanedo, and Omegatech, and promised to shield customers from legal complaints and requests from law enforcement and other authorities. The U.S. Department of Justice (DOJ) confirmed that Virtualine marketed services that permitted “illegal/black hat activities” ranging from phishing, spamming, and carding to port scanning. The FBI seized the primary domain of the service, virtualine[.net], following an investigation that involved Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the U.K.’s National Crime Agency, as well as private partners OverRIPE and Lumen.
Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as "PHP2Shell" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk. The findings come from Eclypsium's October InfraTrust Pulse, a monthly report tracking security advisories affecting network devices, servers, firmware, chips, and other infrastructure. Between September 18 and October 14, InfraTrust tracked 133 new security advisories across 18 vendors, covering 2,813 vulnerabilities. Of those advisories, 37 were rated critical, five had a maximum CVSS score of 10.0, and 58 could be exploited remotely without authentication. Sixteen newly published advisories included vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog (KEV) as they were actively exploited.
PHP2Shell shows how quickly attackers can exploit critical vulnerabilities, often before organizations have time to patch. Token Security explains why limiting the access of service accounts, API keys, and AI agents is just as important as fixing vulnerabilities to reduce the damage from a breach.
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. Tracked as CVE-2026-111497, this critical-severity flaw stems from an out-of-bounds write weakness in the Brotli decoder used to expand data compressed with Google's widely popular Brotli lossless compression algorithm. Unprivileged attackers can use a maliciously crafted Brotli-compressed stream to trigger crashes or memory leaks and, in some cases, gain remote code execution on devices with vulnerable Brotli libraries or binaries. The security issue was first identified in the Node.js JavaScript runtime environment, but it also affects HTTP servers and clients that rely on vulnerable Brotli implementations.
Modern phishing campaigns can compromise American businesses without relying on traditional credential theft. Attackers can abuse legitimate cloud services, authentication mechanisms, and trusted business workflows to gain access to corporate accounts while leaving fewer obvious signs behind. ANY.RUN's analysis of Skyw4lker, a device code phishing campaign primarily targeting U.S. organizations
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Google Brotli and Adobe Commerce and Magento vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: CVE-2026-111497 (CVSS score: 9.2) – An unchecked return value vulnerability in Google Brotli that could allow a remote, unauthenticated attacker to corrupt decoder memory, expose sensitive information, cause a denial-of-service, or potentially execute arbitrary code by sending a specially crafted Brotli-compressed stream. CVE-2026-48356 (CVSS score: 9.3) – An unrestricted file upload vulnerability in Adobe Commerce and Magento that could allow an attacker to execute arbitrary code with the privileges of the current user, potentially gaining elevated access or taking control of the victim’s account or session. Brotli is a data-compression algorithm developed by Google.It reduces the size of web content, such as HTML, CSS, JavaScript, and other text-based resources. Security researchers have observed exploitation attempts targeting CVE-2026-111497 (aka Node2Shell), a critical flaw in Google’s Brotli library. Previdian recorded one attempt by October 27, while ELLIO researchers recently detected traffic carrying a public exploit that could execute code on vulnerable systems. The activity may indicate attempts to exploit the flaw on a larger scale, but its scope remains unclear. An attacker can trigger the vulnerability to cause crashes, expose sensitive memory or remote code execution when applications decompress attacker-controlled Brotli data. Because Brotli is widely used, multiple projects and vendors have released security updates, including Node.js, PHP, Bun, and Microsoft .NET. Cybersecurity firm Wiz warned that 91% of cloud environments contain resources vulnerable to the flaw, while 82% have publicly exposed Node.js instances. The second flaw added to the catalog is an unrestricted file upload vulnerability tracked as CVE-2026-48356, dubbed PolyShell. Recently WordPress security firm Sansec warned of attacks exploiting CVE-2026-48356 to infect at least 953 of online stores. The attackers reportedly used a Magento CMS block to insert a malicious loader capable of retrieving and executing a payload hosted under their control. So far, researchers have not recovered the subsequent payload, leaving the campaign’s ultimate objectives unclear. The activity is believed to have been underway since at least July 2025 and remains ongoing. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaws by October 29, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Confirm this action.
Leaving now will discard your changes.