The Top 10 Attack Surface Exposures in 2026

Summary: Intruder analyzed 3,000 attack surfaces and found exposed databases took the top two spots, with more than a quarter of organizations exposing MySQL and Postgres. API documentation ranked third ahead of RDP, and the rest of the list - SNMP, UPnP, NTP, RPC - are legacy services built for internal networks that were never meant to be internet-facing.
Bottom line: With time-to-exploit down to a single day, the exposure that matters most is the service that had no reason to be reachable at all - and the source notes attack surface reduction is not getting the same attention as vulnerability management.

Read the original at The Hacker News ↗