Over 90,000 Jupyter Notebooks Publicly Exposed, Posing Remote Code Execution Risk

A ZoomEye scan conducted on September 21, 2026, identified 90,626 publicly indexed Jupyter Notebook instances on the internet, representing an upper bound of potentially unprotected deployments. Jupyter Notebooks lacking authentication effectively grant any visitor shell access as the notebook's service user, enabling arbitrary code execution. Such exposed instances have previously been exploited in cryptomining and ransomware attacks, making them a well-documented security risk. The exposure often stems from analysts launching notebook servers outside formal IT oversight, binding them to all network interfaces and neglecting to enable token or password authentication, which has been Jupyter's default since version 5.0. Security experts recommend restricting notebook servers to localhost, enforcing authentication, limiting user permissions, and treating any publicly reachable Jupyter instance as a potential active incident.