Hackers are actively scanning internet-exposed Vite development servers and trying to steal cloud credentials and configuration files from them. According to F5, the campaign exploits Vite file-read bypass CVE-2026-39364 in versions 7.1.0 through 7.3.2 and 8.x before 8.0.5, using crafted GET requests with parameters such as ?raw to retrieve plaintext files including .env files, AWS and Azure credentials, Terraform state, and system environment data.
Why it matters: Organizations that exposed Vite dev servers to the internet may have had cloud keys and other secrets copied, which can lead to broader compromise of AWS or Azure environments. Update Vite immediately, block public access to dev servers, and rotate any secrets reachable from affected hosts.
info@thehackernews.com (The Hacker News)
2026.09.15
99% relevant
The article appears to cover the same campaign: attackers are mass-scanning internet-exposed Vite development servers and exploiting CVE-2026-39364 to extract cloud credentials and configuration secrets from affected environments.
Bill Toulas
2026.09.14
100% relevant
This article establishes a distinct story by tying active exploitation to a specific Vite flaw, CVE-2026-39364, and detailing a live campaign focused on stealing AWS and Azure secrets from exposed dev servers.
← Back to all stories