Threats Day: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories

Summary: Truffle Security found 543,699 unique credentials exposed in public GitHub repositories that were still valid as of July 2026, with the median one sitting in a public default branch for 784 days and the oldest committed in 2009. Just under 200,000 of them were pushed after GitHub turned push protection on by default.
Bottom line: Nearly 200,000 valid secrets were published after GitHub's default push protection was in place, and a credential committed in 2009 still works - the median exposure window of 784 days is how long an attacker has to find and use one.

Read the original at The Hacker News ↗