MASS-SCANNING CAMPAIGN EXPLOITS VITE FLAW TO EXTRACT CLOUD CREDENTIALS FROM EXPOSED DEV SERVERS

Summary from the TLDR InfoSec newsletter

Attackers scanned exposed Vite development servers in August and exploited CVE-2026-39364. Crafted query parameters bypassed server.fs.deny and returned protected files through /@fs/. Observed targets included .env files, AWS credentials, Azure profiles, Terraform state, database passwords, and /proc data with requests spoofing crawler user agents and forged forwarding headers.