Overview
- F5 Labs' honeypots recorded roughly 800 distinct attacks and about 32,000 raw events in August–September 2026, showing an automated campaign focused on internet-exposed Vite development servers.
- The operation exploits CVE-2026-39364, a high-severity bug that lets specially crafted /@fs/ requests with parameters like ?raw or ?import&raw return files normally blocked by server.fs.deny.
- Observed targets include .env variants, AWS credential and config backups, Azure profiles, terraform and serverless state files, and process environment artifacts that can reveal plaintext secrets.
- Attackers used evasion tactics such as Google Cloud IP ranges, forged X-Forwarded-For/X-Real-IP headers and fake crawler or AI User-Agent strings to bypass simple IP blocks and confuse logs.
- Mitigation steps are clear: update Vite to patched releases, avoid exposing dev servers (don’t use --host or public Docker port mappings), block port 5173 and suspicious /@fs/ requests, and rotate any secrets that may have been exposed.