A fresh cloud-security reminder landed this week for hosting teams: BleepingComputer reported that thousands of Amazon Web Services access keys exposed publicly over the past four years still authenticated as of August 10, creating a direct takeover path for sites and applications hosted on AWS.

The report, citing Truffle Security research, said more than 9,300 AWS access keys exposed between August 2022 and August 2026 remained active and valid. The finding is especially relevant for agencies, managed-hosting providers and SaaS operators because AWS keys can be embedded accidentally in repositories, demos, model files, CI logs or configuration bundles long after the original project has moved on.

For site operators, the risk is not abstract. Valid cloud credentials can let an attacker enumerate or alter infrastructure, access storage buckets and databases, create persistence, spin up costly resources, or disrupt production workloads. BleepingComputer also noted that exposed keys included some highly privileged credentials and that only a minority of readable accounts had budget alerts configured.

The practical takeaway is to treat public-key exposure as an incident, not a housekeeping ticket. Rotate the key, review CloudTrail or equivalent logs, check IAM permissions, add budget and anomaly alerts, and scan both current and historical code paths. Hosting businesses should also prefer short-lived roles, least-privilege policies and secret-scanning gates in deployment pipelines so a leaked key cannot become a long-lived skeleton key for customer infrastructure.

Source: BleepingComputer: Hundreds of leaked AWS keys give full control over corporate accounts.