Day: October 29, 2026

484,142 Exposed Cloud Buckets Contain 18 Billion Files

42 publicly listable cloud buckets containing 18 billion files, including exposed credentials, database dumps and backups.

The Ransomnews research team counted 484,142 publicly listable cloud storage buckets in October 2026, holding 18.05 billion files. They built the count from the search engines that index open cloud storage and published it as the Ransomnews Cloud Exposure Index, written by Mantas Sasnauskas.

“No file was opened for this index. Every number below comes from bucket names, file extensions, file counts and last-modified timestamps. That is a deliberate limit. It keeps the research on the right side of the line, and it turns out to be enough to see where the sensitive material concentrates.” Ransomnews states. “We are calling it the Ransomnews Cloud Exposure Index, and we will rerun it quarterly so the numbers can be compared over time.”

The researchers used bucket names, file types, file counts and last-modified dates to collect their data. They did not open any files, allowing them to identify where sensitive information might be stored without accessing the content. They plan to repeat the research every three months to track changes over time.

Amazon S3 accounts for 72% of the exposed buckets, roughly in line with its share of the market. This does not mean S3 has weaker security than other providers. Azure Blob, however, appears 2.5 to 3.6 times more often than expected among buckets named for backups, data exports and payroll records. The researchers also found 321,058 files related to credentials and keys. Of the exposed .env files, 67% were last modified in 2026.

Below is the split by provider, from a snapshot taken on October 7:

Provider	Open buckets	Share
Amazon S3	347,984	71.9%
Azure Blob	68,532	14.2%
Google Cloud Storage	53,131	11.0%
DigitalOcean Spaces	11,069	2.3%
Alibaba OSS	3,426	0.7%
Total	484,142	100%

A lot of these buckets are public on purpose, holding website assets, CDN mirrors, open datasets and podcast archives. So the index isn’t 484,142 breaches. It’s the pool where breaches hide, and the rest of the report narrows it down to the stores that should never have been listable.

“Azure, by a wide margin relative to its size. Azure Blob holds 14.2% of open buckets, but 37% of the 1,459 buckets with “backup” in the name, 42% of the 399 named for exports, and 51% of the 505 carrying HR or payroll terms.” continues the report. “Buckets named for logs, customers and databases sit at 35% to 36%, all around two and a half times Azure’s baseline.”

The skew only shows up for operational data. Buckets named “dev” sit at Azure’s baseline of 15 percent, and “test” and “staging” fall below it, at 9 and 7 percent. The authors suspect Azure storage accounts more often hold line-of-business data such as backups, exports and HR systems that enterprises run on Microsoft, while S3 and Google Cloud carry more application assets. They call it a hypothesis the counts suggest and don’t prove, and it’s the first thing they want to test next time.

By sector, retail and e-commerce names lead with 5,666 buckets, mostly storefront assets. The more worrying number is that names tied to regulated sectors (finance, healthcare, education, government, legal and HR) appear on 10,891 unique open buckets. Those are the places where a stray file most likely holds personal, health or financial records, and where regulators expect to hear about it.

Sector (by bucket name)	Open buckets	Files in them
Retail and e-commerce	5,666	269.9M
Finance and insurance	3,508	58.0M
Healthcare	2,709	47.9M
Media and entertainment	2,696	136.2M
Education	2,393	60.6M
Gaming	2,296	79.0M
Travel and hospitality	1,714	118.7M
Real estate	1,137	60.7M
Government and public sector	1,000	36.2M
Legal	978	11.3M
Crypto	630	11.9M
HR and payroll	505	8.4M

Healthcare-related names appear in 2,709 buckets containing 47.9 million files. The researchers identified them using terms such as “hospital” (135 buckets), “patient” (135), “clinic” (277) and “dental” (331). HR and payroll is the smallest sector, with 505 buckets, 259 of which are hosted on Azure.

These figures are based on names, not proof of ownership. The search matches parts of words, so “store” can refer to object storage as well as shops. A single bucket can also appear in two sectors.

The exposed buckets also list about 4.7 million database and dump files, 15,130 mailbox archives, and tens of millions of spreadsheets and documents. Credential files are particularly concerning because they can turn a cloud misconfiguration into a real intrusion.

File type	What it is	Files listed
.pem	Certificates and private keys	113,285
.env	App secrets and API keys	80,495
.p12	Certificate bundles with keys	33,268
.keystore	Java and Android keystores	27,229
.ppk	PuTTY SSH private keys	24,302
.pfx	Windows certificate bundles	23,352
.ovpn	OpenVPN client configs	15,079
.jks	Java keystores	2,421
.htpasswd	Web server password files	695
.tfstate	Terraform infrastructure state	475
.kdbx	KeePass password vaults	457

Each of these exists to grant access. A .env file is where developers keep database passwords and API keys. A .tfstate file is Terraform’s record of a whole cloud setup, often with secrets in plain text, and a .kdbx vault is encrypted but now open to anyone who wants to guess passwords offline. Some .pem files are public certificates and some files are test fixtures, so the counts are a ceiling on live secrets and not a measure of them. It’s still a big ceiling.

Database files make up most of the sensitive material by volume:

File type	What it usually holds	Files listed
.sqlite	Embedded app databases	2,561,807
.bak	Database and server backups	752,055
.sql	Database dumps	687,446
.sqlite3	Embedded app databases	488,176
.dump	Database dumps	176,603
.mdb / .accdb	Microsoft Access databases	36,467
.dmp	Memory and crash dumps	12,809
.pst / .ost / .mbox	Mailbox archives	15,130
.eml	Saved emails	4,549,665
.csv	Data exports and records	at least 69,580,112
.xlsx / .xls	Spreadsheets	42,544,997
.docx	Word documents	24,936,788
.pdf	Documents, invoices, scans	at least 106,191,393
.log	Application and server logs	at least 61,310,809

The exposed buckets contain thousands of virtual disk images, including VMware, Hyper-V and QEMU files. A single disk image can contain an entire server, including credentials.

Some exposures involve active systems. Of 80,495 .env files, 67% were last modified in 2026. Certificates and SQLite databases include both recent and older files. Backups appear older, with 89% of the 752,055 .bak files last modified before 2025. Almost all PuTTY key files date from 2024.

Recent leaks need urgent attention, while long-standing exposures point to poor security management. The problem is ongoing: at least 113.6 million files were added to publicly listable buckets in the seven days before September 9. Over the previous 30 days, these included more than 21,000 SQL dumps, nearly 21,000 backup files, 4,477 .pem files and 1,298 .env files.

Public .env files can expose database passwords that ransomware affiliates and initial access brokers look for. Similar credentials appear in stolen-data logs, but in this case, attackers do not need to infect a device. They only need to search for exposed files.

Cloud providers already offer settings to prevent public access. Organizations should enable S3 Block Public Access, disable anonymous access to Azure Blob storage, and enable public access prevention in Google Cloud. These controls should apply at account or organization level to prevent new storage buckets from becoming public.

Organizations should also scan their storage for sensitive files such as .env, .sql, .bak, .pem, .ppk, .tfstate and .kdbx. Terraform state files and virtual disk images should be treated as secrets, stored privately, encrypted and monitored. Backups should never be publicly accessible, and recovery procedures must be tested.

One exposed bucket may be a mistake, but many often indicate a wider process failure. Organizations need to fix the underlying security controls, not just individual buckets.

The research has some limitations. The team queried search engines on October 25, while the bucket list was current to October 7 and the newest indexed file dated September 9. File-level data may therefore be about a month old. Counts are also capped at one million per query, so researchers split larger categories into date ranges and added the results.

Some limits apply. The team queried the search engines on October 25. The bucket list was current to October 7 and the newest indexed file was dated September 9, so file-level figures lag by about a month. The index caps any single count at one million, so larger types were split into date windows and summed.

A last-modified date shows when a file was written, not when it was exposed, and a listed file isn’t proof that its contents can be read. No bucket is named in the report. Exposures with a known owner in regulated sectors are going through responsible disclosure, with national CERTs copied where the owner is public sector or doesn’t respond.

“Rotate any secret that has ever sat in a public bucket. Closing the bucket does not un-leak the key. Assume anything that was listable was copied.” conlcudes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Cloud Buckets)

Source: Security Affairs · 2026-10-29

October 29, 2026

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. […]

Source: BleepingComputer · 2026-10-29

October 29, 2026
Claude Model Builds Exploits Across Major Browsers & OSes

An unreleased version of the AI model has found and chained multiple vulnerabilities in Chrome, Safari, Android, Windows, and Linux, Anthropic says.

Source: Dark Reading · 2026-10-29

October 29, 2026
Criminal Probe Launched in South Africa Over Contraband Baobabs Bound for Georgia

South African authorities have opened a criminal investigation into the attempted illegal export of five baobab trees to Georgia, halting a massive shipment at the coastal port of Durban after discovering the exporter lacked required environmental permits.

The five trees, estimated to be between 200 and 300 years old and weighing up to 30 tons each, remain impounded at a Durban logistics warehouse while investigators build a case under the country’s forestry laws.

Under South Africa’s National Forests Act, the indigenous baobab is a protected species. It is illegal to cut down, harvest, transport, or export live specimens without explicit authorization from environmental regulators. While South Africa permits the commercial trade of processed baobab derivatives—such as fruit powder, seed oil, and cosmetic extracts—under strict licensing, the live specimen trade is tightly restricted to protect the slow-growing trees from international exploitation.

According to the Daily Maverick, the shipment was intercepted this summer at a facility operated by Africa Global Logistics, a subsidiary of the maritime shipping firm MSC Group. Officials discovered that the exporter lacked the mandatory permits required to export the specimens. Days after the seizure, the exporter submitted a retrospective permit application, which environmental authorities rejected.

“The department refused to issue a license retrospectively to regularize allegedly illegal criminal activities,” South Africa’s Department of Forestry, Fisheries and the Environment said in a statement to OCCRP, confirming that a criminal case had been opened under the National Forests Act.

Department officials declined to publicly identify the exporter or the intended recipient in Georgia, citing the active investigation. However, a conviction carries severe penalties under South African law.

“A person who contravenes the prohibition in the National Forests Act commits a first category offense and may upon conviction be sentenced to a fine or imprisonment for a period of up to three years, or to both,” Sello Molekwa, chief director of communication and advocacy at the department, told OCCRP.

To botanists and conservationists, the uprooting of the trees—extracted from the Waterberg District in South Africa’s northern Limpopo province—represents a devastating loss of irreplaceable natural heritage.

Dr. Sarah Venter, a baobab expert and founder of the Baobab Foundation in South Africa, explained that removing the trees required approval under two distinct pieces of South African legislation.

“They didn’t have either,” Dr. Venter said, expressing hope that the impounded giants could still be saved. “I am hoping that the trees will be returned to Limpopo Province, where they came from, and replanted into their natural environment.”

Although South African authorities have not officially named the buyer, the seizure coincides with reports in Georgian media indicating that a private residence linked to the country’s billionaire former prime minister, Bidzina Ivanishvili, is preparing for a major tree delivery.

Ivanishvili has a documented history of importing ancient African trees for his personal estates and a public dendrological park on Georgia’s Black Sea coast. Between 2022 and 2023, eight massive baobabs were exported from Kenya to his park in Georgia. All eight trees withered and died last year, prompting the park’s management to issue an official statement blaming critical media coverage for extended procedures that then caused the demise of the trees.

The appetite for live specimens appears to continue. On Sept. 15, Georgia’s independent Formula TV reported that a new private residence being built for Ivanishvili outside Tbilisi was undergoing a “special landscaping project,” with a new baobab expected to arrive by late October.

The park is owned by a Georgia-registered firm ultimately controlled by Ivanishvili’s wife, while the residence is owned by its subsidiary. The director of the firm that owns the residence did not respond to requests for comment regarding whether the South African shipment was destined for the property.

Meanwhile, the five uprooted trees remain held at the Durban facility. Africa Global Logistics stated that it acted solely as a logistics agent, halted the shipment as soon as regulatory concerns were raised, and is cooperating fully with authorities without facing criminal charges.

Source: OCCRP · 2026-10-29

October 29, 2026
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)

CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems.

Source: Palo Alto Networks Unit 42 · 2026-10-29

October 29, 2026
A quiet week in infosec
Welcome to this week’s edition of the Threat Source newsletter.

“The darkest period of my life, so far, arrived the summer I was pregnant with my eldest son. The future was growing in me with all of its terrifying unpredictability, and I found myself anxious, unable to work and woefully at sea.” — Lauren Groff

I doubt Lauren had this maniacal infosec news cycle in mind when she wrote about the terrifyingly unpredictable future, but honestly, she’s got our current careers down cold. Let he who is not woefully at sea cast the first water balloon? I’ll work on it.

Here we are with PHP taking up every available ounce of oxygen, Node.js adding its own spice to the sauce… and here’s me, staring my screen blankly, waiting for an original thought to leak out and onto this page. Not to worry, none have. There is simply nothing novel to say because the entire internet has it covered. In triplicate. With graphs and compelling statistics and AI-generated evil bad guy images galore.

These vulnerabilities are serious, and the remediations matter. Teams need to know what they run, find the affected systems, and get them patched and determine ways to secure systems that can’t be patched. I’m simply not going to add another dramatic headline to the stack or pretend there’s a clever new angle hiding in the margins. The thing I keep looping on is that the work underneath the headlines is familiar and it’s the real story. To defend your environment, you need a team that knows that environment, has enough time and expertise to investigate the telemetry, that can tell an anomaly from the usual benign noise, and take action. Yes, the right tools help, and without them you can’t do it — but the people doing the work are still what make those tools useful.

Give smart people enough room to do smart people stuff. This is the entire ballgame. Read it again: Give smart people enough room to do smart people stuff. Because a good response starts way before the headline. Know what you own, who owns it, what version is running, whether it can be reached from the internet, what identities can do what task on the device, etc. When a fix is available, make sure it actually reaches the system you meant to fix. If a system cannot be updated yet, give that exception an owner and a deadline. Reduce its exposure, add monitoring, and keep checking until the fix is in place. “We’ll get to it” is not a plan.

So, there may be nothing new to say about PHP this week, but the work is still worth talking about: Know your environment, take care of your team members, and keep paying attention when the weird thing stops being weird and starts becoming evidence. When the next headline arrives, help your teammate do the same.

“The only thing that makes life possible is permanent, intolerable uncertainty: not knowing what comes next.” — Ursula K. Le Guin

The one big thing

Cisco Talos has recently discovered “NIK C2,” a new command-and-control framework that integrates AI directly into its attack chain. This Go-based Windows implant allows adversaries to dump credentials, stream keystrokes, and deploy screen-locking ransomware. It also uses an integrated OpenAI model to analyze harvested data on the fly. By hijacking the victim’s own API keys to fund these requests, NIK C2 collapses data collection and exploitation into a single, continuous session.

Why do I care?

By embedding a live AI pipeline directly into the C2 loop, NIK C2 turns a compromised host into an active operational asset rather than a passive foothold. Because it processes data and generates context-aware payloads locally, it erases the offline processing delays that historically gave defenders a critical detection window. Furthermore, by piggybacking on the victim’s OpenAI account, threat actors completely mask their infrastructure, leaving no attributable trace and complicating incident response.

So now what?

Defenders must embrace continuous behavioral vigilance. Ensure endpoint solutions monitor for unusual local proxy routing, unexpected PowerShell executions, and unauthorized access to browser databases or crypto wallets. Update your defenses using the ClamAV signature and indicators of compromise (IOCs) provided in the full blog.

Top security headlines of the week

CISA gives agencies days to patch critical PHP bugs
CISA added the two vulnerabilities in the PHP open-source scripting software to the Known Exploited Vulnerabilities (KEV) catalog Monday. (Federal News Network)

Node2Shell: Brotli flaw triggers patching across Microsoft, Node.js, Python packages
An out-of-bounds write in Google’s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages, and can lead to code execution. (SecurityWeek)

Gheist uses stolen GitHub tokens to steal private repository secrets via Actions logs
Each workflow sits on a new branch named ci-sync- followed by six random characters. Deleting a branch, or the run it started, does not undo the exposure. (The Hacker News)

Japan internet giant GMO says hackers posted stolen customer data
GMO Internet is investigating a data leak after suspected unauthorized access to its Onamae cloud desktop service, which provides virtualized desktops to financial traders. (TechCrunch)

Third Serengeti sweep tops 1,400 arrests as investigations mature
Interpol’s annual Operation Serengeti, now on its third iteration, led to 1,462 arrests across 20 African countries and the U.S., recovering $105 million in stolen funds. (Dark Reading)

Can’t get enough Talos?

Stealing AI secrets and breaking EDRs
Phishing may have dropped from last quarter’s highs, but ransomware engagements climbed as attackers shifted their focus toward disabling EDR systems and scraping AI credentials. The financial sector also returned as a top target.

From federal SOCs to Talos: Ryan Fetterman on practical security research
What does it mean to be “blue collar” for the blue team? Amy sat down with security researcher Ryan Fetterman to discuss his journey from federal agency work to his new role at Talos.

The Guy Who Invented Pain (plus first reactions to PHP2Shell)
David Bianco built the Pyramid of Pain, so we offered him some more. David joins the Beers with Talos crew for a conversation how AI changes about his famous model, how EvidenceForge creates simulated incidents for research and training, and why his red-team entrance exam didn’t go to plan.

Compromised eMudhra intermediate certificates
Cisco Talos is aware of eight compromised intermediate certificates belonging to the intermediate certificate authority. eMudhra has revoked the certificates and stopped issuing new certificates under its G3 root.

Two critical RCEs in PHP core
Two critical remote code execution vulnerabilities in PHP core could have implications across its wider ecosystem. This blog explains what we know so far, and details the Snort coverage available.

Upcoming events where you can find Talos
- SAINTCON (Oct. 26 – 30) Provo, UT
- CYBERWARCON (Nov. 20) Arlington, VA
- AVAR 2026 (Dec. 2 – 4) Hyderabad, India
- Black Hat Europe (Dec. 7 – 10) London, U.K.
Most prevalent malware files from Talos telemetry over the past week

SHA256: 73a25ff8893260418c2271b863c567e40e842adbab3c57023cb72de590ea377d
MD5: 0cf0271c3564881fce95f44c649bd745
Talos Rep: https://talosintelligence.com/talos_file_reputation?s=73a25ff8893260418c2271b863c567e40e842adbab3c57023cb72de590ea377d
Example Filename: KMSAuto++.exe
Detection Name: HackTool:WZTeam-tpd

SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
MD5: 2915b3f8b703eb744fc54c81f4a9c67f
Talos Rep: https://talosintelligence.com/talos_file_reputation?s=9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
Example Filename: sample.exe
Detection Name: W32.9F1F11A708-100.SBX.TG**

SHA256: 7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f
MD5: cca616647db9370c88998ae25da6997f
Talos Rep: https://talosintelligence.com/talos_file_reputation?s=7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f
Example Filename: cca616647db9370c88998ae25da6997f.exe
Detection Name: Win.Tool.Kmsauto::1201

SHA256: 58d6fec4ba24c32d38c9a0c7c39df3cb0e91f500b323e841121d703c7b718681
MD5: f1fe671bcefd4630e5ed8b87c9283534
Talos Rep: https://talosintelligence.com/talos_file_reputation?s=58d6fec4ba24c32d38c9a0c7c39df3cb0e91f500b323e841121d703c7b718681
Example Filename: KMSAuto Net.exe
Detection Name: W32.58D6FEC4BA-95.SBX.TG

SHA256: fed979f93bcaf4e73ebd25748093a92095d5109cbd01d55f97bdc50ce509ad2f
MD5: 207d9d891ac756b2bfad88aba5682c65
Talos Rep: https://talosintelligence.com/talos_file_reputation?s=fed979f93bcaf4e73ebd25748093a92095d5109cbd01d55f97bdc50ce509ad2f
Example Filename: sample.exe
Detection Name: W32.FED979F93B-95.SBX.TG

Source: Cisco Talos Intelligence · 2026-10-29
October 29, 2026
Search More Than 500 Cases of U.S. Citizens Detained by Immigration Agents

ProPublica

Experts have long warned that immigration dragnets will inevitably result not only in the erosion of rights for immigrants but also for citizens. Since the start of this Trump administration, we’ve watched those warnings come true.

So we have once again done what the government won’t: We have tallied and cataloged every case we can find of an immigration agent reportedly detaining a citizen during the current administration — more than 500 cases from Inauguration Day through Oct. 21, 2026.

Read our earlier reporting on U.S. citizens being detained.

We compiled our list by scouring social media, court records and local media, and we included an incident only if we could find at least two sources for it. We asked the Department of Homeland Security about each incident, and we searched for any federal criminal charges that were brought in relation to each incident. (DHS has repeatedly said it is not arresting U.S. citizens.)

Since the government itself does not track these cases, our list is almost certainly an undercount. Below, we’re showing you every case we found — the reality that the administration denies — along with the receipts. Read more about how we reported this project.

Source: ProPublica · 2026-10-29

October 29, 2026
Your headphones have hidden LE Audio features you’ll want to know about

Your JBL, Sony, or Bose Bluetooth headphones got a top-to-bottom wireless makeover — not just Auracast.

Source: ZDNet Security · 2026-10-29

October 29, 2026
Podcast: Flock CEO Says the Backlash Isn’t Real
We start this week with Jason and Joseph’s article about leaked audio from a private police conference. In that audio, Flock’s CEO made all sorts of wild claims about the backlash to his company not being real, and his wife’s advice to never apologize. After the break, Sam tells us why former Yahoo CEO Marrisa Mayer can’t keep pretending ‘gender doesn’t matter.’ In the subscribers-only section, Joseph tells us about a woman who is facing years in prison because someone else opened a CashApp account in her name.

Listen to the weekly podcast on Apple Podcasts, Spotify, or YouTube. Become a paid subscriber for access to this episode’s bonus content and to power our journalism. If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only link for the extended video version too. It will also be in the show notes in your podcast player.
Source: 404 Media · 2026-10-29
October 29, 2026
October 28, 2026 letter commenting on the International Auditing and Assurance Standards Board’s July 2026 Exposure Draft: “Proposed International Standard on Auditing for Audits of Financial Statements of Less Complex Entities (Revised)”

This letter provides GAO’s comments on the International Auditing and Assurance Standards Board’s (IAASB) Proposed International Standard on Auditing for Audits of Financial Statements of Less Complex Entities (Revised) (ISA for LCE). GAO promulgates generally accepted government auditing standards, which provide professional standards for auditors of government entities in the United States.

Source: GAO Reports & Testimonies · 2026-10-29

October 29, 2026