TL;DR Attackers are mass-scanning the internet for exposed Vite development servers. They abuse the Vite development server vulnerability CVE-2026-39364 to steal cloud credentials and config files. F5 Labs recorded 807 grouped attacks and roughly 32,000 events in one month. Why this Vite vulnerability matters Vite is a popular local development server and build tool. Developers sometimes expose it to the internet by mistake.