America's top cyber-defense agency left a GitHub repo open with with passwords, keys, tokens – and incredibly obvious filenames
2026-05-19T19:23:59Z•25dc44c4590d13b27cc925acf686c9237752ba14d5b4d1ba06c06774cb8ba092
credential-exposurecritical-patchdirty-fragdrupalgithubgrafanalinux-kernelmacos-stealermalwarenginx-riftnpmprivilege-escalationransomwareshai-huludsupply-chain
What happened
A wave of high-risk incidents and disclosures from mid-May 2026: a US cyber‑defense agency accidentally exposed credentials and keys in a public GitHub repo; multiple supply‑chain attacks (TanStack/npm cache‑poisoning and Shai‑Hulud) and GitHub account compromises (Grafana) led to stolen code and poisoned packages; several high‑impact malware families (Reaper stealer, Shai‑Hulud) are harvesting passwords, wallets and backdooring hosts; multiple Linux kernel privilege‑escalation flaws (including Dirty Frag/Fragnesia and a bug exposing root‑only files) have public exploits and no/limited patches
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- theregister_security
- Record identifier
- 25dc44c4590d13b27cc925acf686c9237752ba14d5b4d1ba06c06774cb8ba092
- Enrichment time
- 2026-05-19T19:23:59Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.