InfoSecBulletin Cybersecurity for mankind
A recent April 2026 report from security expert Himaja Motheram at Censys says that nearly 6 million internet-connected hosts still use the File Transfer Protocol (FTP). This shows a big 40% drop from the 10.1 million servers seen in 2024. This old protocol still brings a risk because many users keep insecure default settings.
The Censys report shows that in 2026, the main issue with FTP exposure is not due to special file transfer systems, but from default settings on shared hosting and broadband networks.
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
The State of Encryption and Regional Risks
About protecting these servers, the data shows different results. Censys found that about 58.9% of checked FTP hosts finished a Transport Layer Security (TLS) handshake, which means they allow secure connections.
This means about 2.45 million hosts have no proof of encryption, which may let them send files and passwords in plain text. The use of encryption is different in each area. Censys data shows that mainland China and South Korea have the lowest rates of TLS use among the top 10 hosting countries, with rates of 17.9% and 14.5%.
Japan has 71% of all FTP servers in the world that still use old encryption methods like TLS 1.0 and 1.1. The safety of these 6 million servers is greatly affected by the default settings of the software programs that run them.
Organizations should consider the following mitigation strategies:
Migrate to Secure Alternatives: Whenever possible, replace FTP with SSH File Transfer Protocol (SFTP), which encrypts credentials and data by default over port 22.
Enforce Explicit TLS: If legacy FTP infrastructure must remain online, administrators should configure their daemons to enforce Explicit TLS (FTPS) and refuse cleartext connections.
Fix IIS Certificate Bindings: Windows Server administrators using IIS FTP must ensure that a valid certificate is bound to the FTP site and verify that the SSL policy actively enforces encryption.
Ultimately, while the internet’s reliance on FTP is slowly shrinking, millions of instances continue to run quietly in the background.
Censys warns that the main risk is not complex zero-day attacks, but the simple problem of not updating default settings, which makes systems too open.
