Tag: credential exposure
26 articles
AI Firm Exposes 14M Credentials in Unsecured Database
A staggering 13.7 million records containing sensitive personal data, including names, passwords, and bank account information, were left vulnerable in an unsecured database, putting millions at risk of identity theft. This massive data breach exposed a treasure trove of stolen credentials and personal info, harvested from earlier breaches, in a single, easily searchable store.
AWS AgentCore Flaw Exposes Credentials, Enables Lateral Attacks
A single chat prompt was all it took for an external attacker to exploit a vulnerability in AWS AgentCore, extracting sensitive IMDS credentials and taking over all agents in the same account and region. This shocking security flaw highlights the potential for devastating lateral attacks with just a single exposed agent.
Telegram Account Tied to ASOS Hack Exposed in Gaming Trading Forums
A surprising twist in the ASOS hack reveals a Telegram account, previously linked to gaming item trading, was used to administer a channel tied to the breach, sparking questions about the hacker's true identity. The account, now labelled 'Xuanyewen', has a history that predates the incident, suggesting a calculated setup.
AI Reshapes Cyberattack Landscape With Automated Vulnerability Discovery
A shocking 543,699 valid credentials were left exposed in public GitHub repositories, putting companies at risk - and the oldest one has been lingering since 2009. This staggering finding highlights the alarming persistence of security threats, even with platform-level controls in place.
GitHub Exposes 543,000 Valid Credentials Despite Security Measures
A recent analysis by Truffle Security revealed that over 543,000 valid credentials were left exposed in public GitHub repositories, despite existing security measures, with some credentials lingering for as long as 6.3 years. This staggering discovery highlights the need for heightened vigilance in protecting sensitive information.
AI Coding Agents Exacerbate Secrets Sprawl as Credential Exposure Surges
AI-powered coding agents are supercharging the secrets sprawl problem, with AI-assisted commits leaking secrets at nearly twice the rate of human-written ones. This alarming trend reveals that AI tools are accelerating credential exposure, making it more crucial than ever to address the issue.
AWS Neutralizes Compromised IAM Credentials with Managed Policy Updates
In a controlled test, AWS swiftly responded to a compromised access key by attaching a managed policy that quarantines the threat, all within 10 seconds of the key being publicly exposed on GitHub. By doing so, AWS effectively limited potential damage by denying access to certain high-risk actions.
LiteLLM Gateways Expose Cloud Credentials to Risk with Default Admin Key
Thousands of LiteLLM gateways are leaving cloud credentials vulnerable due to a shocking security flaw: nearly 300 online gateways accepted a default admin key, granting hackers unrestricted access to sensitive data and cloud accounts. This easily exploitable weakness puts countless organizations at risk of devastating breaches.
Exposed AWS Keys Grant Attackers Full Corporate Account Control
Thousands of exposed AWS keys are still active, putting entire corporate accounts at risk of being hijacked by attackers - and a staggering 88% of re-verified keys were found to still grant access as recently as August 2026. This alarming vulnerability highlights the urgent need for tighter security measures to protect sensitive cloud data.
Wiz Exposes GitHub Actions Flaw in Snowflake Repository
Researchers at Wiz uncovered a vulnerability in Snowflake's GitHub repository, where a flawed GitHub Actions workflow exposed a sensitive Jira API token, putting internal credentials at risk. This security gap allowed attackers to potentially execute commands using a crafted GitHub issue.
Google Docs Exposes Staging Server Credentials in Search Results
A simple Google search led to a major security slip-up when a developer stumbled upon a publicly indexed Google Doc containing sensitive staging server credentials. A careless mistake by an outside contractor had left the confidential info exposed, and a curious autocomplete suggestion revealed it all.
CISA Exposes Lessons from AWS GovCloud Key Incident Response
When a security researcher uncovered exposed credentials in a public GitHub repository, CISA sprang into action, swiftly mitigating any potential exposure to its cloud resources and code repositories. Thanks to the researcher's sharp eyes and KrebsOnSecurity's reporting, CISA was able to respond quickly and contain the incident.
KDDI Breach Exposes 14.2 Million Email Credentials
A massive data breach at KDDI has potentially exposed a staggering 14.2 million email addresses and passwords, putting countless users at risk of cyber threats. The breach was detected on June 17, and although KDDI quickly took action to prevent further intrusion, the full extent of the incident is still under investigation.
Phishers Target Midterm Elections With 5K+ Domain Registrations
Scammers are ramping up their efforts to deceive voters with over 5,000 election-themed domains registered in just two months, providing a fertile ground for phishing, impersonation, and misinformation campaigns to manipulate the midterm elections. This alarming surge in domain registrations has already exposed around 17,000 credentials linked to sensitive organizations and services.
CISA Breach Exposes Sensitive Government Systems
A shocking security lapse at CISA exposed highly sensitive government systems, thanks to a contractor's careless mistake of leaving credentials to privileged AWS GovCloud accounts and internal systems publicly available on GitHub. The error granted unfettered access to a vast array of agency infrastructure, putting national security at risk.
Identity Exposures Form Highways for Cyber Attacks
A single compromised identity can become a superhighway for cyber attacks, giving hackers access to nearly every critical workload a business relies on - as seen in a recent incident where a cached AWS access key on one Windows machine put 98% of the company's cloud environment at risk. Identity has become the ultimate attack path, carrying with it a multitude of permissions just waiting to be exploited.
CISA Contractor Exposes AWS GovCloud Keys in GitHub Leak
A contractor for the Cybersecurity & Infrastructure Security Agency (CISA) made a critical mistake by exposing sensitive AWS GovCloud keys, plaintext passwords, and internal files in a public GitHub repository. The leak, described as one of the worst ever witnessed, included highly privileged credentials and build artifacts for numerous internal CISA systems.
Lovable Disputes Data Leak, Shifts Blame to HackerOne
Lovable, a coding platform, is facing scrutiny after a security researcher uncovered a major data leak, exposing users' sensitive information, including credentials, chat history, and source code, to anyone with a free account. The company's shifting explanations have only added fuel to the fire, sparking concerns about its data handling practices.
Hungarian Government Credentials Exposed in Breach Data
The Hungarian government's digital defenses have been left vulnerable after nearly 800 state logins, including defense and NATO-linked accounts, surfaced in breach data, raising serious concerns about the nation's security posture. One alarming example? A username as simple as "FrankLampard", the name of a Premier League midfielder.
Vulnerabilities Exposed in Amazon Bedrock AgentCore Sandbox
Security researchers at Unit 42 have uncovered critical vulnerabilities in Amazon Bedrock AgentCore's sandbox, revealing that a protective layer meant to separate code and services can be breached using DNS tunneling, exposing sensitive credentials in the process. This alarming discovery highlights the potential risks of slipping through the cracks of a supposedly secure system.
Alarming API Leak Exposes Global Bank's Cloud Credentials
A recent study has uncovered a shocking security risk, revealing that hundreds of valid API keys - essentially digital master keys - have been left exposed on the web, putting sensitive information at risk. This alarming API leak highlights the urgent need for stronger API security measures to protect our data.
Ni8mare Stunning Dangerous Bug Hijacks n8n Servers
Imagine the tool you trust to automate workflows becoming a master key for attackers — Ni8mare is a high‑risk flaw in the n8n automation platform that can let adversaries seize servers, steal secrets, and hijack your integrations. If you run internet‑exposed or self‑hosted n8n, patch now and audit for any lingering compromise.
Passwd: Exclusive Best Google Workspace Password Tips
If your companys digital keys were leaked tomorrow, could you recover fast? Passwd is a business-first password vault for Google Workspace that secures shared credentials, enforces access controls and automates rotations so teams can stop credential-stuffing attacks without slowing down work.
AI Browsers Exclusive: Security Leaders Call Risky
Before you roll out agentic browsers, pause—security leaders warn these AI-powered tools can trade productivity for stealthy new attack surfaces. With embedded models, persistent state and plugins able to act for users, CISOs are being urged to block or tightly control them until hardened safeguards arrive.