The State of Secrets Sprawl 2026: 9 Takeaways for CISOs

The collection highlights an escalation in secrets sprawl, widespread supply‑chain and vetting failures, active exploitation of high‑severity vulnerabilities, and increasingly sophisticated nation‑state and criminal tooling. Key findings: GitGuardian reports a historic jump in hardcoded secrets; multiple supply‑chain compromises (PyPI telnyx, Open VSX/VS Code vetting bypass, malicious VS Code extensions); active reconnaissance and exploitation of critical appliance flaws (Citrix NetScaler CVE‑2026‑3055 and F5 BIG‑IP APM CVE‑2025‑53521); proliferation of nation‑state and proxy tooling (Russian‑