InfoSecBulletin Cybersecurity for mankind
A study revealed that almost 5 million servers expose Git metadata, including 250,000 that leak deployment credentials through .git/config files.
A 2026 study from the Mysterium VPN research team found that about 5 million public web servers are leaking Git repository metadata, including over 250,000 that expose .git/config files with deployment credentials.
LastPass says hackers stole customer data via Klue, supply chain breach
New Apple Exploit Bypasses Boot Defenses, Possibly Affects Millions of iPhones Worldwide
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
Misconfigurations allow attackers to access source code and steal sensitive information. This problem continues due to deployment errors, exposed hidden folders, and servers not automatically protecting these files, making minor mistakes lead to major security breaches.
Some key takeaways:
Number of IP addresses found with publicly accessible .git structures: 4,964,815;
.git/config files with deployment credentials inside the config: 252,733 (~5.09%);
Countries with the most websites found vulnerable include the United States with 1,722,949 IPs (~34.70%), Germany (419,102 IPs), France (237,593 IPs), India (218,661 IPs), Singapore (189,900 IPs), The Netherlands (165,174 IPs), Japan (164,768 IPs), Russia (147,859 IPs), United Kingdom (140,341 IPs), and Hong Kong with 127,223 IPs.
This is more than a technical mistake; it’s a major vulnerability affecting websites and organizations worldwide.
The study reveals that exposed Git servers are mainly found in the US, Europe, and APAC regions. Exposed .git folders can lead to source code theft, credential abuse, supply chain attacks, and unauthorized access to cloud services, turning a misconfiguration into a serious breach.
To fix exposed .git folders, restrict public access, ensure Git data isn’t in production, and update any leaked credentials. Even 5% of exposed credentials can lead to hundreds of thousands of usable secrets. Teams should implement server rules, use secrets management, conduct pre-commit checks, monitor activity, and have rapid response plans.
“The findings highlight a widespread issue caused by deployment practices, inconsistent server configuration, and misplaced assumptions about safety. While the presence of exposed Git metadata alone is dangerous, the inclusion of credentials dramatically increases risk, enabling repository takeover, supply chain attacks, and access to cloud infrastructure.” said the report.
“The research underscores that even small percentages of credential exposure become severe at the internet scale and that attackers can automate discovery with ease.”
