Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Browse News Feed Stats Watchlists Beta About Contact

Exposed security-training web apps exploitation wave

Exploitation Wave
First reported
Last updated
Happening score
H score 20
2 unique sources, 2 articles

Summary

Hide ▲

DVWA, OWASP Juice Shop, Hackazon, and bWAPP instances exposed in cloud environments are being actively exploited, putting Fortune 500 companies and security vendors at risk of cloud takeover, miner deployment, and webshell persistence. Pentera found 1,926 live vulnerable applications on AWS, GCP, and Azure, with many tied to overly privileged IAM roles and default credentials. Several affected organizations, including Cloudflare, F5, and Palo Alto Networks, have since remediated the exposed instances.

Related Happenings

AWS exposed-key hardening guidance for Amazon SES phishing abuse

Defensive Guidance
First: 04.05.2026 23:03 Last: 04.05.2026 23:03 Sources 1

About this happening: **Kaspersky** urged organizations to harden **AWS IAM** and credential handling after **exposed access keys** were linked to phishing delivery through **Amazon SES**, reducing the...

Open Happening

Zealot autonomous AI cloud intrusion proof of concept

Technical Analysis
First: 23.04.2026 13:09 Last: 23.04.2026 13:09 Sources 1

About this happening: **Palo Alto Networks Unit 42** built **Zealot**, an autonomous AI agent that successfully attacked an isolated **Google Cloud Platform** environment, showing that machine-speed ad...

Open Happening

Unit 42 Zealot proves autonomous cloud attack chaining in GCP

Technical Analysis
First: 23.04.2026 13:00 Last: 23.04.2026 13:00 Sources 1

About this happening: **Unit 42's Zealot PoC** shows autonomous AI can chain cloud attack stages in a live **Google Cloud Platform** environment, shrinking defender reaction time to minutes. The system...

Open Happening

XM Cyber maps eight validated AWS Bedrock attack vectors across connected enterprise integrations

Technical Analysis
First: 23.03.2026 13:55 Last: 23.03.2026 13:55 Sources 1

About this happening: **XM Cyber** mapped **eight validated attack vectors** in **AWS Bedrock**, showing how over-privileged permissions can expose logs, knowledge bases, agents, flows, guardrails, and...

Open Happening

AWS Bedrock AgentCore Code Interpreter DNS exfiltration and covert C2 in Sandbox Mode

Technical Analysis
First: 16.03.2026 15:00 Last: 16.03.2026 15:00 Sources 1

About this happening: Researchers demonstrated **DNS-based exfiltration** and covert **C2** against **AWS Bedrock AgentCore Code Interpreter**, showing cloud AI code execution environments can still le...

Open Happening

Timeline

  1. 21.01.2026 16:00 3 articles · 4mo ago

    Pentera reports active exploitation of exposed security-training web apps in cloud environments

    Initial Disclosure

    Pentera reports active abuse of misconfigured security-training and internal pentest web apps such as DVWA, OWASP Juice Shop, Hackazon, and bWAPP that were exposed on AWS, GCP, and Azure and often tied to overly privileged IAM (Identity and Access Management) roles and default credentials. The findings cover 1,926 live vulnerable applications and indicate attacker activity including XMRig Monero mining, webshell deployment, persistence mechanisms, and access paths into cloud resources such as S3 buckets, GCS, Azure Blob Storage, Secrets Manager, and container registries; Cloudflare, F5, and Palo Alto Networks received the findings and fixed exposed instances.

    Show sources
    Open in new tab