Over 543,000 valid credentials still exposed in public GitHub

🕵️ RESEARCH & DEEP DIVES

• Over 543,000 valid credentials still exposed in public GitHub repositories
  Truffle Security found over 543,000 credentials exposed in public GitHub repositories were still valid in July.

  • Applies to GitHub users and organizations whose secrets were committed to public repositories, including forks.
  • 543,699 unique working credentials were found across 224 million repositories and 58 billion files; median exposure time was 784 days, with ~10% older than 6.3 years.
  • 36.8% (199,843) were exposed after GitHub enabled Push Protection by default in February 2024; 51.8% fall into categories Push Protection does not block, like database connection strings and Google API keys.
  • Revocation varies by service: only 1 of 101,886 leaked npm tokens still worked, while 69,041 of 126,963 exposed Google Cloud service account credentials remained valid.
  • Secret density rose from 3.72 working credentials per million files in 2015 to a peak of 11.62 in 2025.
  Sources 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer

• Akamai uncovers 32 malicious browser extensions spying on 9,800+ users
  Akamai researchers found a campaign of 32 malicious browser extensions that spied on more than 9,800 users.

  • Applies to users of browser productivity extensions across Chrome and other browsers.
  • 32 malicious extensions disguised as productivity tools spied on 9,800+ users and hijacked browsing activity.
  • The extensions used remote configuration files to control spying and browsing-hijack behavior.
  Sources 📎 Coverage: akamai.com · 👁 via Akamai Blog

📋 ADVISORIES

• 📄 Source for Attackers exploit patched Zimbra flaw CVE-2026-73570 to deploy web shells and steal secrets — blogger.googleusercontent.com

🔓 CVEs & KEV

• CVE-2026-55094 — taskcluster — CVSS 8.7 — Taskcluster: Unauthenticated remote code execution in web-server via GraphQ...