Nearly 6 Million Internet-Facing FTP Servers Still Exposed in 2026, Censys Warns

Censys reports nearly 6 million Internet-facing FTP hosts in 2026 with widespread insecure defaults: ~58.9% show TLS support while about 2.35 million have no observed encryption, many servers run default-included daemons (notably Pure-FTPd) or misconfigured IIS instances that accept cleartext credentials; the report warns of broad exposure rather than active exploitation and recommends migrating to SFTP, enforcing Explicit TLS (FTPS), and fixing IIS certificate bindings.