Misconfigured and Exposed: Container Services
Summary: Unit 42 used Shodan searches to find more than 40,000 unique container hosting devices with default configurations, including 20,353 Kubernetes instances and 23,354 Docker instances found with simple search terms. The researchers also counted 1,448,102 devices listening on port 9200, 349,403 on port 5601, and 4,816,638 on port 3306, while noting that most of these systems require authentication and that some may run other services on those ports.
Why it matters: The report ties basic container misconfiguration to the Docker Hub loss of keys and tokens for 190,000 accounts and the Ladders leak of over 13 million user records, showing that failing to rename a container or enforce basic authentication can precede a breach of that scale.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026