Hackers target exposed Vite dev servers to steal AWS, Azure secrets

Development servers intended for local use were left exposed to the public internet, creating an easily exploitable attack surface. CVE-2026-39364 allows unauthenticated attackers to bypass file access controls and retrieve sensitive environment files containing AWS and Azure cloud credentials — a critical failure of both configuration discipline and patch management. Development environments frequently store production-equivalent secrets, meaning a single exposed dev server can compromise an entire cloud infrastructure. The use of Google Cloud IP ranges for evasion highlights that attackers are actively employing trusted infrastructure to evade detection, making this threat harder to block by simple IP filtering.