CISA had plaintext passwords, SSH private keys, tokens and other sensitive assets exposed in a public GitHub repo named Private-CISA since at least November 2025. The repo's administrator disabled GitHub's default secret protections, a contractor managed it, and testing confirmed high-privilege AWS GovCloud access was possible.
Security researcher Brian Krebs reported that America’s Cybersecurity and Infrastructure Security Agency (CISA) left a large collection of plaintext passwords, SSH private keys, tokens, and additional sensitive agency materials exposed inside a public GitHub repository since at least November 2025.
The repository, now taken offline and previously called Private-CISA, came to Krebs’s notice through GitGuardian’s Guillaume Valadon. Valadon learned of the repository via GitGuardian’s public code scans and contacted Krebs only after the repository owner failed to reply.
https://x.com/arstechnica/status/2056805273025876192
In an email to Krebs, Valadon stated that the repository’s commit logs indicated GitHub’s default safeguards against committing secrets—mechanisms meant to shield inexperienced or careless developers from precisely this sort of mistake—had been turned off by the repository administrator.
Tests conducted by Seralys founder Philippe Caturegli verified that the repository was neither a prank nor a fabrication. Caturegli successfully employed the credentials found inside Private-CISA to obtain high-privilege access across multiple Amazon Web Services GovCloud accounts.
Krebs reported that the repository seemed to be administered by Nightwing, a Virginia-based contractor working for CISA. Nightwing has declined to issue any public statement and has instead directed all inquiries back to CISA.
This is not the first misstep by CISA; it is not even the first one this year. In January, acting CISA Director Madhu Gottumukkala—who had previously failed a polygraph—uploaded sensitive government documents to ChatGPT after securing an exemption from the agency’s ban on its use by personnel. Gottumukkala was removed from the position in February.
Disabling GitHub secret commit protections in a contractor-managed repo allowed prolonged high-privilege exposure of CISA credentials to AWS GovCloud.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
Anthropic has launched the Anthropic Cyber Mission to support defenders of critical infrastructure and open-source software with models, engineers, and tools. The initiative starts with the Critical Infrastructure Defense Program and free OSS Scanner amid ongoing challenges in verifying and fixing vulnerabilities.
Citrix NetScaler ADC and Gateway face denial-of-service risk from CVE-2026-88779 due to a memory buffer flaw.
CISA added CVE-2026-104286 in Fortinet FortiMail to its Known Exploited Vulnerabilities catalog on October 1, confirming active exploitation. Mitigations must be applied by October 4 or discontinue use where fixes are unavailable.
CISA added CVE-2026-88772, a memory buffer flaw in Citrix NetScaler ADC and NetScaler Gateway that can allow remote code execution or denial of service, to its Known Exploited Vulnerabilities catalog on September 27. CISA set a September 30 deadline to apply Citrix's mitigations.
CISA added CVE-2026-65660, a Microsoft SharePoint code injection vulnerability, to its Known Exploited Vulnerabilities catalog on September 25, with a federal deadline of September 28. The flaw could let an authorized attacker execute code over a network and carries a Microsoft CVSS 3.1 score of 8.8.
