InfoSecBulletin Cybersecurity for mankind
One of the most egregious government data leaks in recent history might be the recent leak of Cybersecurity & Infrastructure Security Agency (CISA) public GitHub repository maintained by a contractor that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems.
Security experts said the public archive had files about how CISA makes, tests, and uses software inside the organization.
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
On May 15, KrebsOnSecurity got a message from Guillaume Valadon, a researcher at GitGuardian. His company always checks public code sites like GitHub for exposed secrets and alerts the accounts if they find sensitive data. Valadon contacted KrebsOnSecurity because the owner wasn’t replying and the exposed information was very sensitive.
The “Private-CISA” repository was open to the public until mid-May 2026. It held a lot of sensitive information like AWS GovCloud login info, plain passwords, API keys, and internal system details.
A file called “AWS-Workspace-Firefox-Passwords.csv” showed many usernames and passwords in plain text linked to CISA systems. This includes a DevSecOps area known as “LZ-DSO.”
Philippe Caturegli, founder of security consultancy Seralys said, some of the exposed AWS credentials were still valid at the time of discovery and provided high-level access. He noted that the repository also contained credentials for CISA’s internal “artifactory,” a centralized system for storing and distributing software components.
This type of access could allow attackers to insert malicious code into software pipelines.
KrebsOnSecurity said that the exposed data was connected to a contractor from Nightwing, a government services company in the U.S. The account had been open since 2018, and the “Private-CISA” folder was set up in November 2025.
CISA acknowledged saying that:
“Currently, there is no indication that any sensitive data was compromised as a result of this incident[…] While we hold our team members to the highest standards of integrity and operational awareness, we are working to ensure additional safeguards are implemented to prevent future occurrences.”
