October 1, 2026
- 543,699 unique credentials found in public GitHub repos still authenticated when tested in July. Truffle Security scanned an LLM-training snapshot of 224 million repositories and 58 billion files (crawl closed 7 August 2025); median public exposure was 784 days, the oldest working secret dates to 2009, and 199,843 (36.8%) were pushed after Push Protection became default in February 2024. Revocation hygiene varies wildly by service: 1 of 101,886 npm tokens still worked, against 69,041 of 126,963 Google Cloud service account credentials (BleepingComputer, Truffle Security). · Cloud, Identity & Supply Chain
in An Encoded Character Away From Admin: Cisco SD-WAN Manager Exploited in the Wild