'Damn Vulnerable' Training Apps Leave Vendors' Clouds Exposed

Security researchers say insecure training apps left on the public Internet are a backdoor into organisations’ cloud environments, with attackers already abusing over-permissioned programs to reach major vendors. In a newly published report, Pentera researcher Noam Yaffe highlights Hackazon, a mock e-commerce site with real vulnerabilities, which was run in production on a client’s AWS EC2 instance and used to obtain credentials via an insecure file upload vulnerability that led to remote code execution.

Yaffe found more than 10,000 damn vulnerable apps such as DVWA, OWASP Juice Shop, and bWAPP, with 1,926 of them active and accessible from the Internet across 1,626 unique servers, though he focused on those running on AWS, Google Cloud or Microsoft Azure. Of those 974 servers on major clouds, 165 had IAM roles attached and 109 were over-permissioned, giving attackers ample potential to reach deeper and move laterally within victim environments.

Dark Reading notes that vendors such as Palo Alto Networks, F5 and Cloudflare were among those observed to be exposed, and none of the contacted vendors responded by press time. The story, published on 21 January 2026, underlines how the cybersecurity industry itself can be its own weakest link when training apps act as a doormat into enterprise clouds.