InfoSecBulletin Cybersecurity for mankind
A study revealed that almost 5 million servers expose Git metadata, including 250,000 that leak deployment credentials through .git/config files.
A 2026 study from the Mysterium VPN research team found that about 5 million public web servers are leaking Git repository metadata, including over 250,000 that expose .git/config files with deployment credentials.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
Misconfigurations allow attackers to access source code and steal sensitive information. This problem continues due to deployment errors, exposed hidden folders, and servers not automatically protecting these files, making minor mistakes lead to major security breaches.
Some key takeaways:
Number of IP addresses found with publicly accessible .git structures: 4,964,815;
.git/config files with deployment credentials inside the config: 252,733 (~5.09%);
Countries with the most websites found vulnerable include the United States with 1,722,949 IPs (~34.70%), Germany (419,102 IPs), France (237,593 IPs), India (218,661 IPs), Singapore (189,900 IPs), The Netherlands (165,174 IPs), Japan (164,768 IPs), Russia (147,859 IPs), United Kingdom (140,341 IPs), and Hong Kong with 127,223 IPs.
This is more than a technical mistake; it’s a major vulnerability affecting websites and organizations worldwide.
The study reveals that exposed Git servers are mainly found in the US, Europe, and APAC regions. Exposed .git folders can lead to source code theft, credential abuse, supply chain attacks, and unauthorized access to cloud services, turning a misconfiguration into a serious breach.
To fix exposed .git folders, restrict public access, ensure Git data isn’t in production, and update any leaked credentials. Even 5% of exposed credentials can lead to hundreds of thousands of usable secrets. Teams should implement server rules, use secrets management, conduct pre-commit checks, monitor activity, and have rapid response plans.
“The findings highlight a widespread issue caused by deployment practices, inconsistent server configuration, and misplaced assumptions about safety. While the presence of exposed Git metadata alone is dangerous, the inclusion of credentials dramatically increases risk, enabling repository takeover, supply chain attacks, and access to cloud infrastructure.” said the report.
“The research underscores that even small percentages of credential exposure become severe at the internet scale and that attackers can automate discovery with ease.”
