InfoSecBulletin Cybersecurity for mankind
One of the most egregious government data leaks in recent history might be the recent leak of Cybersecurity & Infrastructure Security Agency (CISA) public GitHub repository maintained by a contractor that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems.
Security experts said the public archive had files about how CISA makes, tests, and uses software inside the organization.
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
“PentesterFlow” AI Automation Tool for Penetration Testers and Bug Hunters
Jailbreak works against AI Models GPT-5.6, Claude Opus 5, and Fable, Claims Researcher
On May 15, KrebsOnSecurity got a message from Guillaume Valadon, a researcher at GitGuardian. His company always checks public code sites like GitHub for exposed secrets and alerts the accounts if they find sensitive data. Valadon contacted KrebsOnSecurity because the owner wasn’t replying and the exposed information was very sensitive.
The “Private-CISA” repository was open to the public until mid-May 2026. It held a lot of sensitive information like AWS GovCloud login info, plain passwords, API keys, and internal system details.
A file called “AWS-Workspace-Firefox-Passwords.csv” showed many usernames and passwords in plain text linked to CISA systems. This includes a DevSecOps area known as “LZ-DSO.”
Philippe Caturegli, founder of security consultancy Seralys said, some of the exposed AWS credentials were still valid at the time of discovery and provided high-level access. He noted that the repository also contained credentials for CISA’s internal “artifactory,” a centralized system for storing and distributing software components.
This type of access could allow attackers to insert malicious code into software pipelines.
KrebsOnSecurity said that the exposed data was connected to a contractor from Nightwing, a government services company in the U.S. The account had been open since 2018, and the “Private-CISA” folder was set up in November 2025.
CISA acknowledged saying that:
“Currently, there is no indication that any sensitive data was compromised as a result of this incident[…] While we hold our team members to the highest standards of integrity and operational awareness, we are working to ensure additional safeguards are implemented to prevent future occurrences.”
