Vulnérabilités Infra

usbliter8, published on 18 June 2026 by a research group called Paradigm Shift, is an unpatchable BootROM exploit for Apple's A12 and A13 chips, the silicon inside the iPhone XS, XR and 11 families plus the Apple Watch Series 4 and 5. It is the long-awaited successor to checkm8, the 2019 exploit that broke every Apple chip from the A5 to the A11 and was assumed to be the end of that road. The bug lives in the SecureROM, the very first code an Apple device runs at power on, which is etched into the silicon at the factory and can never be altered by any software update. usbliter8 abuses a hardware flaw in the Synopsys DWC2 USB controller: a mismatch in how the controller tracks its DMA memory while buffering USB Setup packets lets an attacker walk a write pointer backwards through memory and overwrite arbitrary SRAM, ending in full code execution inside the most trusted code on the chip. From there it can boot unsigned firmware and step outside Apple's chain of trust entirely, stamping the string PWND into the device's USB serial number as proof of control. The catch is that it is not a remote attack: it needs physical possession of the device, DFU recovery mode, a USB connection and a small RP2350 microcontroller board, and nothing it changes survives a reboot. It also does not break the Secure Enclave, so a device protected by a strong passcode keeps its user data encrypted even after the boot chain has been taken over. Apple cannot repair the affected chips; the only real remedy is newer hardware, because the A14 and later configure the controller correctly and are out of reach.

Copy Fail (CVE-2026-31431), disclosed on 29 April 2026 by the security firm Theori, is a Linux kernel flaw that turns any unprivileged local user into root with a 732-byte Python script and no luck required. Despite a name that sounds like a clipboard bug, it has nothing to do with copy and paste: it is a failed copy deep in the kernel's crypto code. A nine-year-old optimization in the AF_ALG crypto socket interface let an attacker steer the kernel into writing four attacker-chosen bytes into the page cache, the in-memory copy of files that the CPU actually executes. Patch the cached pages of a setuid-root binary like /usr/bin/su, run it, and you are root. The exploit is a straight-line logic flaw with no race condition and no hardcoded kernel addresses, so the exact same script runs at roughly 100 percent reliability across Ubuntu, RHEL, SUSE, Amazon Linux and every other distribution built since 2017. Worse, because the page cache is shared by the whole machine, it crosses container boundaries: one poisoned page in a Kubernetes pod can compromise neighbouring tenants and the host. The disk file is never touched, so file-integrity scanners stay silent. It rates CVSS 7.8 (High), was added to CISA's Known Exploited Vulnerabilities catalog on 1 May 2026, and is notable for how it was found: an AI-assisted code scan surfaced a bug that had been silently exploitable for nearly a decade in about one hour.

IngressNightmare was a chain of five vulnerabilities in the Ingress-NGINX Controller for Kubernetes disclosed on 24 March 2025 by the Wiz Research team, the most severe being CVE-2025-1974 (CVSS 9.8), which enabled unauthenticated remote code execution from the pod network. Wiz estimated about 43% of cloud environments were vulnerable and identified over 6,500 publicly exposed clusters, including Fortune 500 organizations. The controller's validating admission webhook ran as an unauthenticated HTTP endpoint reachable by any workload on the pod network, accepting attacker-supplied AdmissionReview requests containing crafted Ingress objects. The supporting CVEs (CVE-2025-24514 auth-url, CVE-2025-1097 auth-tls-match-cn, CVE-2025-1098 mirror UID, CVE-2025-24513 path bypass) injected unsanitized NGINX configuration directives via annotations into a temporary config the controller validated with nginx -t. The attacker uploaded a shared-library payload by abusing NGINX client-body buffering (an oversized Content-Length keeps the request file descriptor open in ProcFS) and then used the injected ssl_engine directive to load that library during validation, achieving code execution in the controller pod whose service account could read all cluster secrets across namespaces, enabling full cluster takeover.

On August 15, 2024, Palo Alto Networks Unit 42 detailed a large-scale extortion campaign that compromised cloud environments by harvesting exposed environment variable files. Attackers scanned at least 110,000 domains and collected over 90,000 unique variables, including roughly 7,000 cloud service credentials and 1,515 social media credentials, with their infrastructure probing around 230 million targets. The vector was a web server misconfiguration: .env files inside the web root were served as plaintext over HTTP because the servers had no rule denying access to dotfiles, exposing the long-lived AWS IAM access keys hardcoded inside. The initial IAM principals lacked full admin but retained permission to create roles and users, so attackers called CreateRole and attached AdministratorAccess to escalate, then spun up Lambda functions across regions to automate further internet-wide scanning. They used the victims' own AWS accounts to exfiltrate and delete S3 objects, then uploaded ransom notes demanding payment. The failure chain combined exposed dotfiles, long-lived hardcoded credentials, and over-permissioned IAM, not any cloud-provider flaw.

In research disclosed to AWS on February 16, 2024 and presented at Black Hat USA and DEF CON 32 in August 2024, Aqua Security's Nautilus team described a class of S3 bucket-name takeover attacks they called Bucket Monopoly, affecting CloudFormation, Glue, EMR, SageMaker, Service Catalog, and CodeStar. These services auto-created S3 buckets with predictable names built from static prefixes plus the account ID and region, such as cf-templates-{hash}-{region}, aws-glue-assets-{account-id}-{region}, and sagemaker-{region}-{account-id}, where account IDs are discoverable from ARNs, access keys, and public repos. Because S3 bucket names are globally unique, an attacker could pre-create a victim's predictably named bucket in a region the victim had not yet used (a Shadow Resource), then the victim's service would later read attacker-controlled content from it. This enabled data tampering, information disclosure, remote code execution by injecting malicious Glue or CloudFormation content, and in some cases full account takeover via planted admin roles; AWS remediated by adding randomized suffixes to bucket names and enforcing aws:ResourceAccount conditions. The class also covers reuse of abandoned or dangling bucket names that a victim configuration still references.

A signal-handler race condition in OpenSSH's server (sshd) on glibc-based Linux. If a client fails to authenticate within the LoginGraceTime window, the SIGALRM handler calls async-signal-unsafe functions, which an attacker can interrupt at a precise moment to corrupt the heap and achieve unauthenticated remote code execution as root. It is a regression of the 2006 CVE-2006-5051, reintroduced in OpenSSH 8.5p1. Exploitation is non-trivial, requiring thousands of race attempts, but Qualys reported roughly 4.8 million internet-exposed instances as potentially affected.

Exposed Docker API is a recurring misconfiguration class in which the Docker remote API (default TCP 2375 plaintext, 2376 TLS) is published to untrusted networks without TLS or authentication, granting anyone who reaches it full control of the daemon. Because dockerd runs as root and the unauthenticated API permits arbitrary container creation, an attacker can launch a privileged container that bind-mounts the host root filesystem and then chroots into it to escape to the host. The Commando Cat campaign, reported in 2024 by Cado Security and analyzed by Trend Micro (advisory dated 13 June 2024), abused exactly this exposure: it deployed a benign image (cmd.cat/chattr) generated by the open-source Commando project, then used chroot and volume binding of the host's root directory into the container to break out and run host-level payloads. The delivered payloads installed cryptocurrency miners, registered persistence and a stealthy backdoor (including DropBear SSH on TCP 3022), and exfiltrated host and cloud-service-provider credentials. Shell-script and command-and-control infrastructure overlapped with the TeamTNT cryptojacking group.

Leaky Vessels was a set of container-escape vulnerabilities disclosed on 31 January 2024 by Rory McNamara of Snyk Security Labs, the headline flaw being CVE-2024-21626 (CVSS 8.6, runc 1.1.11 and earlier). It was an order-of-operations file-descriptor leak in runc's handling of the process working directory (WORKDIR / process.cwd). During container setup runc left an internal file descriptor referencing the host filesystem namespace open before all privileged descriptors were closed, so a malicious image or a build using a malicious Dockerfile or upstream FROM could set the working directory to that leaked descriptor via a path like /proc/self/fd/7. Because chdir occurred before the descriptor was closed, the container process gained a working directory in the host filesystem and could read and write host files, breaking container isolation and escaping to the underlying host. Related Docker BuildKit issues were disclosed alongside it: CVE-2024-23651 (mount cache race), CVE-2024-23652 (build-time arbitrary delete), and CVE-2024-23653 (GRPC SecurityMode privilege check bypass). The flaw was fixed in runc 1.1.12.

Exposed Terraform state is an Infrastructure-as-Code hygiene failure class in which the terraform.tfstate file leaks credentials because Terraform records every managed resource attribute, including secrets, in cleartext JSON by default. HashiCorp documents that Terraform stores state in a plaintext file that includes any secret values defined in the configuration, so database passwords, IAM access keys, TLS private keys, and API tokens are written verbatim into state. The exposure paths are concrete and repeatedly observed: state committed to a public or private git repository without a .gitignore rule, state left in a world-readable or misconfigured S3 bucket, state captured in CI/CD logs, or state held in a remote backend that lacks encryption at rest and access controls. Numerous terraform.tfstate files have been found in public GitHub repositories and open S3 buckets, and because the file is effectively a master key to the infrastructure, an attacker who reads it obtains working credentials and bypasses the perimeter entirely without exploiting any vulnerability.

A sensitive-information-disclosure flaw (memory buffer over-read) in NetScaler ADC and Gateway when configured as a Gateway or AAA virtual server. A specially crafted request leaks memory contents including valid session tokens, letting an unauthenticated attacker hijack authenticated sessions and bypass passwords and MFA. Mandiant confirmed zero-day exploitation since late August 2023, about six weeks before the patch, followed by mass exploitation. LockBit 3.0 ransomware affiliates and multiple nation-state groups used it for initial access. NVD scores it 7.5 High while Citrix rates it 9.4 Critical.

CVE-2023-34362 is the specific flaw behind one of the largest data-theft campaigns in history: an unauthenticated SQL-injection vulnerability in Progress MOVEit Transfer, a managed file-transfer application. It let an attacker reach and manipulate the backend database with no login at all. The Cl0p ransomware gang exploited it as a zero-day from late May 2023, using it to plant a web shell and steal files from thousands of organizations at once. This page covers the vulnerability itself; the mass-extortion campaign it enabled is documented separately.

On 24 May 2023 Dig Security disclosed a privilege-escalation chain in Google Cloud SQL for SQL Server, originally reported to Google in February 2023, that let an attacker escalate from a limited database role to full system administrator and reach the host operating system. The chain first abused a gap in GCP's security hardening to add the attacker's user to DbRootRole, an elevated GCP admin role that nonetheless lacked full SQL Server permissions, then exploited a further misconfiguration in the role permission architecture to grant the SQL Server sysadmin role and obtain complete control of the database engine. With sysadmin rights the researchers reached the underlying container and host OS, letting them list privileged paths, read sensitive files and extract secrets, including internal GCP data and credentials related to the managed service. This was a provider-side flaw under shared responsibility that customers could not patch; Google remediated it in April 2023 and it was found and reported by researchers with no evidence of exploitation in the wild.

On May 12, 2023, Toyota disclosed that a cloud environment managed by its Toyota Connected subsidiary had exposed data on roughly 2.15 million customers, essentially the entire Japanese user base of its T-Connect, G-Link, G-Link Lite, and G-BOOK connected services registered since November 2013. The data was exposed from November 6, 2013 to April 17, 2023, nearly a decade, and included in-vehicle GPS terminal IDs, vehicle chassis numbers, location history with timestamps, and a subset of drive-recorder video footage, but not names, credit cards, or other directly identifying personal data. The root cause was a cloud database misconfigured to be publicly accessible instead of private, attributed to human error during setup and allowing unauthenticated internet access. Toyota cited a lack of active detection mechanisms and insufficient enforcement of data-handling rules, which is why the misconfiguration persisted undetected for years. A follow-up disclosure on May 31, 2023 found additional misconfigured cloud services exposing around 260,000 more customers.

On September 24, 2022 SOCRadar discovered a misconfigured Microsoft Azure Blob Storage endpoint that exposed roughly 2.4 TB of business data spanning 65,000+ entities across 111 countries, with files dated from 2017 to August 2022, though Microsoft disputed the entity count as exaggerated. The exposed data included customer names, email addresses, phone numbers, company names, and business transaction documents such as signed invoices, proof-of-execution and statement-of-work files, and product offers. The low-level misconfiguration was that the Blob Storage endpoint's access level was set to allow anonymous public access instead of requiring authentication, so the container and its blobs were readable over the internet without any credential. Microsoft's Security Response Center attributed it to an unintentional misconfiguration on an endpoint not in use and reconfigured it to require authentication, stating it found no indication that accounts or systems were compromised.

A remote code execution flaw in the Microsoft Support Diagnostic Tool (MSDT) triggered when MSDT is invoked via the ms-msdt: URL protocol from a calling application such as Word. A malicious Office document, even via the preview pane or RTF without macros, loads a remote HTML payload that abuses MSDT to execute arbitrary code with the privileges of the calling application. It was actively exploited as a zero-day before patching and used to deliver malware in real-world phishing campaigns.

A remote code execution flaw in the Spring Framework's data-binding mechanism. On JDK 9 and later, an unauthenticated attacker can manipulate request parameters to access the ClassLoader and write a malicious JSP web shell to disk, achieving RCE. Exploitation specifically targets Spring MVC and WebFlux applications deployed as WAR files on Apache Tomcat. It was mass-exploited within days of disclosure to deploy cryptocurrency miners and the Mirai botnet.

Log4Shell, disclosed on 10 December 2021, was for a time the most dangerous vulnerability on the internet. It lived in Log4j, an Apache logging library so ubiquitous that it sat, usually invisibly, inside millions of Java applications, from enterprise servers to Minecraft to iCloud. The flaw was almost absurdly easy to trigger: if an attacker could get a crafted string like ${jndi:ldap://...} written into a log, a username, a chat message, a header, the server would reach out, fetch attacker-controlled code, and run it, giving full unauthenticated remote code execution. Because logging untrusted input is something nearly every application does, exploitation was trivial and everywhere. Within hours the entire internet was being mass-scanned, and defenders spent a frantic holiday season patching a dependency many did not even know they had. It is the defining example of why you must know, and be able to fix, every component buried in your software.

On 14 September 2021 Wiz disclosed OMIGOD, a set of four flaws in Open Management Infrastructure (OMI), an agent that Azure silently auto-deploys onto many Linux VMs via services such as Log Analytics, Azure Automation, Azure Diagnostics and Defender for Cloud. The flagship bug, CVE-2021-38647 (CVSS 9.8), gave unauthenticated remote code execution as root, while CVE-2021-38645, CVE-2021-38648 and CVE-2021-38649 were local privilege escalations. The agent ran as root and could expose a management port (5985, 5986 or 1270); because the authorization code left the AuthInfo struct at its zero-initialized default of uid 0 and gid 0, a request that omitted the Authorization header was treated as an authenticated root request, so a single crafted packet yielded root code execution. This was a provider-side flaw under shared responsibility that most customers did not know was installed and could not patch themselves. Unlike the other entries here it was exploited in the wild within days, with attackers scanning for exposed agents and dropping Mirai botnet and cryptominer payloads.

On 9 September 2021 Palo Alto Unit 42 researcher Yuval Avrahami disclosed Azurescape, described as the first cross-account container takeover in a public cloud, in which a malicious container on Azure Container Instances could escape and gain control over other customers' containers running on the shared multitenant Kubernetes cluster. ACI ran an outdated container runtime, runC v1.0.0-rc2, which was vulnerable to CVE-2019-5736, letting the attacker break out of the container and execute code as root on the underlying Kubernetes node. From the node the researcher found the bridge pod, which serviced az container exec calls, sent a Kubernetes service-account token in the Authorization header to a Kubelet that also allowed anonymous access; decoding that token (related to CVE-2018-1002102) granted pods/exec rights across all namespaces and control of the api-server, and thus the whole multitenant cluster. This was a provider-side flaw under shared responsibility that customers could not patch; Unit 42 found it and reported it with no knowledge of exploitation in the wild.

ChaosDB, disclosed in 2021, was the kind of cloud vulnerability that is supposed to be impossible: a flaw in Microsoft Azure's Cosmos DB database service that let any customer steal the access keys to thousands of other customers' databases. Cloud platforms promise that tenants are isolated from each other; ChaosDB broke that wall. Researchers found that a built-in notebook feature, enabled by default, could be escalated to grab Microsoft's own internal certificates, which in turn unlocked the keys to every Cosmos DB account on the platform. It is a stark reminder that even in the cloud, the isolation between tenants is itself a piece of software that can have bugs, and one you cannot patch yourself.

On August 23, 2021, UpGuard disclosed that misconfigured Microsoft Power Apps portals exposed roughly 38 million records across 47 organizations, including American Airlines, Ford, J.B. Hunt, the Maryland Department of Health, the State of Indiana, New York City agencies, and Microsoft itself. Exposed data included names, email addresses, phone numbers, social security numbers, and COVID-19 contact tracing and vaccination appointment information. Power Apps portals surface list data through OData list feeds reachable at predictable URLs, and access to those feeds is gated by Table Permissions, but Table Permissions were disabled by default on every list. Because security was opt-in, any portal where a developer enabled an OData feed without explicitly configuring and enabling Table Permissions returned its records to any unauthenticated visitor querying the OData endpoint. This is an insecure-default access-control misconfiguration where the platform defaulted to anonymous read rather than deny.

A remote code execution flaw in the Windows Print Spooler service allows an authenticated domain user to load a malicious printer driver DLL and execute code as SYSTEM, both locally and remotely. A working proof-of-concept was accidentally published before a patch existed, so Microsoft assigned a new identifier and shipped out-of-band fixes. Because nearly every Windows host, including domain controllers, runs the spooler, it gave attackers a near-universal lateral-movement and privilege-escalation primitive. It was exploited in ransomware intrusions by Vice Society, Conti, and Magniber.

ProxyLogon, disclosed on 2 March 2021, was a chain of flaws in on-premises Microsoft Exchange Server that let an unauthenticated attacker take over a mail server completely, then use it to read everyone's email and plant a foothold in the network. China's state-sponsored HAFNIUM group used it as a zero-day for targeted espionage, but the moment Microsoft patched, the exploit became public and a free-for-all began: within days at least ten APT groups were mass-scanning and compromising every unpatched Exchange server they could find, dropping web shells and ransomware. An estimated 250,000 servers were compromised worldwide, including at least 30,000 in the US, in a matter of weeks. It is the case study in how fast a patched vulnerability becomes a worldwide free-for-all, and why internet-facing infrastructure has to be patched in hours, not weeks.

On February 3, 2021, Palo Alto Networks Unit 42 reported Hildegard, the first known TeamTNT campaign targeting Kubernetes, detected in January 2021. The attackers gained initial access through a misconfigured kubelet: the kubelet read-write API on port 10250 was reachable and accepted anonymous, unauthenticated requests because it was configured with --anonymous-auth set to true and --authorization-mode set to AlwaysAllow, the insecure legacy defaults shipped by some self-managed clusters. Anyone who could reach port 10250 could call the kubelet run-command API to execute commands inside running pods with no credentials. The attackers used this to exec into pods, move laterally across containers, scan for more exposed kubelets, and harvest cloud access keys, SSH keys, Docker credentials, and service-account tokens from the environment. They then deployed the XMRig Monero miner for cryptojacking, using a tmate reverse shell and IRC for command and control and LD_PRELOAD injection to hide processes. The misconfiguration class is missing authentication caused by an insecure default on an internet-reachable management port.

In 2019, a former Amazon engineer stole the personal data of about 100 million Americans from Capital One, and she did it through a chain of cloud-security mistakes that has since become a teaching classic. A misconfigured web application firewall could be tricked into making requests on the attacker's behalf, a flaw called server-side request forgery. She pointed it at a special internal address that every AWS server can reach, the one that hands out the server's temporary cloud credentials, grabbed those credentials, and because they were far more powerful than they needed to be, used them to download Capital One's data straight out of its storage. It is the textbook SSRF-to-cloud-takeover chain, and the reason AWS hardened that metadata service afterward.

Incorrect handling of error responses to proxied upgrade requests in kube-apiserver lets a specially crafted request establish a connection to a backend server and then send arbitrary requests over that same connection directly to the backend, authenticated with the API server's own TLS credentials. This enables privilege escalation, including from an unauthenticated user via aggregated API servers and from a low-privileged user to cluster-admin-level access on backend kubelets. Impact spans all secrets, pods, environment variables, and running containers on affected nodes. It was the first major critical CVE in Kubernetes.

Exposed etcd is a misconfiguration class in which the etcd key-value store backing the Kubernetes API server is reachable on its client port (TCP 2379, with 2380 used for peer traffic) without client-certificate authentication. etcd is the single source of truth for a cluster and stores the entire cluster state, including all Secrets, service-account tokens, credentials, ConfigMaps, and RBAC rules, so reading it bypasses Kubernetes RBAC entirely and writing to it lets an attacker alter cluster state and take over the cluster. etcd shipped insecure by default: it had no authentication before version 2.1 (July 2015) and client-certificate authentication remained off by default for backward compatibility, and its authorization model is effectively all-or-nothing once access is granted. In March 2018, researcher Giovanni Collazo demonstrated the scale by querying Shodan and finding 2,284 etcd servers exposed to the internet without authentication; a short script then harvested roughly 750 MB of data including thousands of passwords, hundreds of AWS access keys, and private keys. The root cause is an etcd endpoint listening on a network-reachable interface without TLS client-certificate authentication enforced.

In 2018, attackers found Tesla's Kubernetes admin console sitting open on the internet with no password. Inside, they found Tesla's AWS cloud keys. But instead of stealing data or causing damage, they did something quieter and increasingly common: they used Tesla's cloud to mine cryptocurrency, on Tesla's bill. And they hid it carefully, throttling the mining and hiding the traffic behind Cloudflare so it would not stand out. It is the textbook cryptojacking case, and a reminder that an exposed dashboard is a door to your cloud account, and that the first sign of a breach is often a suspiciously busy server, not a ransom note.

On October 10, 2017, UpGuard publicly disclosed that Accenture had left four Amazon S3 buckets exposed, originally found by researcher Chris Vickery on September 17, 2017. The buckets were named acp-deployment, acpcollector, acp-software, and acp-ssl under the Accenture Cloud Platform prefix, with the largest holding 137GB. They were configured for public access, so anyone who entered or guessed the bucket URL could download the contents with no authentication, and because the S3 subdomain matched the bucket name the names were predictable. Exposed material included a master access key for Accenture's AWS KMS account stored in plaintext, internal Identity API credentials, nearly 40,000 plaintext passwords in a database backup, private signing and decryption keys, certificates, VPN keys, and Google and Azure credentials. The root cause was an S3 public-read misconfiguration: buckets that are private by default had been reconfigured to allow anonymous access, contradicting the secure default.

On 27 June 2017 NotPetya became the most destructive cyberattack in history, causing more than $10 billion in global damage. It looked like ransomware but was a wiper: even victims who paid could not recover, because its encryption kept nothing needed to decrypt. It entered through a poisoned update to M.E.Doc, a Ukrainian tax application, then spread inside networks at machine speed using the EternalBlue and EternalRomance SMB exploits plus Mimikatz to harvest credentials and move laterally, so even fully patched machines fell once one neighbour was compromised. The blast radius was global: Maersk had to reinstall roughly 45,000 PCs and 4,000 servers and was saved only because a single domain controller in Ghana had been offline during a power cut and held a clean copy of Active Directory; Merck's losses reached about $1.4 billion. The US, UK, and allies attributed it to Russia's GRU (Sandworm). It is the lesson in patching, stopping credential reuse, segmentation, and truly offline backups.

On June 12, 2017 UpGuard analyst Chris Vickery discovered an Amazon S3 bucket owned by Republican data firm Deep Root Analytics that exposed about 1.1 TB of personal data and modeled political preferences on roughly 198 million American voters, and it was secured on June 14, 2017. The exposed records included names, dates of birth, home addresses, phone numbers, voter registration details, party affiliation, and modeled ethnicity and religion linked by 32-character RNC IDs, compiled with contractors TargetPoint and Data Trust. The low-level misconfiguration was that the bucket, reachable at the six-character Amazon subdomain dra-dw, had its access control set to public so anyone could list and download its objects without authentication; the firm said the data was exposed after a settings change on June 1, 2017. This is the canonical example of a large-scale public-read S3 bucket leaking sensitive PII to the open internet.

On the morning of 12 May 2017, WannaCry became the fastest-spreading ransomware in history, encrypting files on more than 230,000 Windows machines across 150-plus countries in a single day and demanding a few hundred dollars in Bitcoin per machine. It needed no phishing and no clicks. It was a worm: it spread itself from one unpatched computer to the next using EternalBlue, an exploit for a flaw in Windows' ancient SMBv1 file-sharing protocol that the US National Security Agency had quietly stockpiled and that a group called the Shadow Brokers had leaked weeks earlier. Microsoft had shipped a patch (MS17-010) two months before, but the unpatched and the end-of-life machines, most famously across the UK's National Health Service, which diverted ambulances and cancelled thousands of operations, were swept up regardless. The global rampage was then halted almost by accident when a 22-year-old researcher registered a single gibberish domain for about ten dollars, not yet knowing it was the worm's kill switch. WannaCry is the textbook lesson in patching fast and killing legacy protocols, with a stranger-than-fiction ending.

Tens of thousands of MongoDB instances were left exposed to the internet with no authentication on the admin account, a known insecure default in older versions. Multiple attacker groups scanned the internet via Shodan, connected anonymously, exfiltrated or deleted the database contents, and left a ransom note demanding Bitcoin. By early January 2017 roughly 10,500 servers, about a quarter of all internet-facing MongoDB databases, were hit, and cumulative waves through 2017 ruined over 45,000 databases. Many victims who paid recovered nothing because competing crews overwrote each other's ransom notes and in many cases never copied the data.

In 2016 the Mirai botnet showed what happens when millions of insecure IoT devices get weaponized. Mirai scanned the internet for cameras, DVRs, and routers exposed over Telnet and logged in using a table of about 61 default and hardcoded credential pairs that owners never changed (and sometimes could not change). The conscripted devices launched record-breaking DDoS attacks: roughly 620 Gbps against the security site Krebs on Security, around 1.1 Tbps against the host OVH, and, after Mirai's source code was leaked, an assault on the DNS provider Dyn on 21 October 2016 that knocked Twitter, Netflix, Reddit, GitHub, and Spotify offline for much of the US. That public code release spawned countless variants that still operate today. It is the defining lesson in default-credential and IoT hygiene.

Shellshock, disclosed on 24 September 2014 (twelve days after Bash maintainer Chet Ramey was privately warned by its discoverer, Stephane Chazelas), was a 25-year-old flaw in Bash, the command-line shell at the heart of nearly every Linux, Unix, and macOS system. Bash had a quirk: it could pass functions to child processes through environment variables, and it would keep executing any commands that trailed the function definition. Since web servers, mail servers, and network devices routinely put attacker-controllable data into environment variables before calling Bash, an attacker could smuggle commands into something as ordinary as an HTTP header and have the server run them, with no authentication. It was trivially exploitable, and Bash was everywhere, so within hours of disclosure botnets were mass-scanning the internet. Coming six months after Heartbleed, it cemented 2014 as the year the internet learned how much of its foundation was decades-old code nobody had re-examined.

Heartbleed, disclosed on 7 April 2014, was a flaw in OpenSSL, the encryption library that secures a huge share of the internet's HTTPS traffic. A single missing bounds check meant an attacker could ask a server a tiny question and get back up to 64 kilobytes of whatever happened to be sitting next to it in memory: usernames, passwords, session cookies, and, worst of all, the server's own private encryption keys, all without leaving a trace in any log. Because OpenSSL was everywhere, at disclosure a large fraction of all secure websites were exposed, and the world spent days re-issuing certificates and resetting passwords. It is the case that gave vulnerabilities a logo, and a permanent reminder that the open-source code underpinning the internet is often maintained by almost no one.