2026 Critical Cloud Control Plane Detection: NSG/Firewall Rule Change Opening Public Ingress on Sensitive Ports

Ibrahim Saud@tektrix

•updated 22 days ago•8•0•4

Detects modifications to security groups, network security groups (NSG), or firewall rules across AWS, Azure, and GCP that expose sensitive management or database ports (22, 3389, 3306, 5432, 6379, 9200, 27017) to the entire internet (0.0.0.0/0). Such configurations significantly increase the attack surface and potential for unauthorized access, brute-force attacks, or data exposure.