The Credential Layer Is Expanding Faster Than Security Teams Can See It

Summary: GitHub's COO said the platform went from roughly 1 billion commits in all of 2025 to 2.9 billion in August 2026, an annualized pace above 14 billion, while GitGuardian detected 28.65 million new hardcoded secrets in public GitHub commits in 2025, up 34% year over year, with leaked credentials tied to AI services up 81%. Across 6,943 systems compromised in the Shai-Hulud 2 campaign, researchers found 33,185 unique secrets, with 44% of machines holding more than 10 and 5% holding more than 100.
Bottom line: GitGuardian retested credentials confirmed valid in 2022 and found 64% were still valid in January 2026, so a secret exposed years ago can still open a door today - and with CrowdStrike reporting an average eCrime breakout time of 29 minutes in 2025, the window to act on that exposure is measured in minutes, not quarters.

Read the original at The Hacker News ↗