InfoSecBulletin Cybersecurity for mankind
A recent April 2026 report from security expert Himaja Motheram at Censys says that nearly 6 million internet-connected hosts still use the File Transfer Protocol (FTP). This shows a big 40% drop from the 10.1 million servers seen in 2024. This old protocol still brings a risk because many users keep insecure default settings.
The Censys report shows that in 2026, the main issue with FTP exposure is not due to special file transfer systems, but from default settings on shared hosting and broadband networks.
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
The State of Encryption and Regional Risks
About protecting these servers, the data shows different results. Censys found that about 58.9% of checked FTP hosts finished a Transport Layer Security (TLS) handshake, which means they allow secure connections.
This means about 2.45 million hosts have no proof of encryption, which may let them send files and passwords in plain text. The use of encryption is different in each area. Censys data shows that mainland China and South Korea have the lowest rates of TLS use among the top 10 hosting countries, with rates of 17.9% and 14.5%.
Japan has 71% of all FTP servers in the world that still use old encryption methods like TLS 1.0 and 1.1. The safety of these 6 million servers is greatly affected by the default settings of the software programs that run them.
Organizations should consider the following mitigation strategies:
Migrate to Secure Alternatives: Whenever possible, replace FTP with SSH File Transfer Protocol (SFTP), which encrypts credentials and data by default over port 22.
Enforce Explicit TLS: If legacy FTP infrastructure must remain online, administrators should configure their daemons to enforce Explicit TLS (FTPS) and refuse cleartext connections.
Fix IIS Certificate Bindings: Windows Server administrators using IIS FTP must ensure that a valid certificate is bound to the FTP site and verify that the SSL policy actively enforces encryption.
Ultimately, while the internet’s reliance on FTP is slowly shrinking, millions of instances continue to run quietly in the background.
Censys warns that the main risk is not complex zero-day attacks, but the simple problem of not updating default settings, which makes systems too open.
