Please turn JavaScript on
Find more feeds

GitGuardian Blog - Take Control of Your Secrets Security

Following GitGuardian Blog - Take Control of Your Secrets Security's news feed is very easy. Subscribe using the "follow" button on the top right and if you want to, choose the updates by topic or tag.

We will deliver them to your inbox, your phone, or you can use follow.it like your own online RSS reader. You can unsubscribe whenever you want with one click.

Keep up to date with GitGuardian Blog - Take Control of Your Secrets Security!

GitGuardian Blog - Take Control of Your Secrets Security: GitGuardian Blog - NHI Governance & Secrets Security

Is this your feed? Claim it!

Publisher:  Unclaimed!
Message frequency:  0.45 / day

Message History

Responding to php2shell PHP Vulnerability When You Don’t Know What Secrets Are Deployed

TL;DR

Pre-auth RCE in default PHP setups: PHP fixed php2shell on Oct. 21, 2026. It abuses how PHP handles out-of-memory fatal errors and works against Apache mod_php and PHP-FPM on common CMS, webmail, and e-commerce apps.Every secret on the host is exposed: The RCE can potentially allow attackers to read config.php and .e...

Read full story
Railway October 2026 Incident: Treat Every Environment Variable as Exposed
What happened in the Railway security incident

On Oct. 21, 2026, Railway disclosed anomalous activity on the systems that store customer environment variables.

An unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted values. Railway is asking all customers to rotate their environment variables, including ...


Read full story
What Is Credential Layer Security? The Layer Every Other Control Trusts
TL;DRThe credential layer is every surface holding a secret: Code, cloud, laptops, SaaS, collaboration tools, and public sites all hold plaintext credentials, and a single key can travel through all of them during its lifetime.Six controls form a connected program: Discover, prioritize by access risk, connect to owners, remediate copies, prevent...

Read full story
Leaked API Keys in LLMs: How AI Agents Expose Secrets
TL;DRLLMs can reproduce real leaked keys: Using only API output access, researchers recovered DeepSeek and Google keys from Qwen3-27B, GPT-Codex 5.3, and Claude Haiku 4.5, and every key had a matching public GitHub occurrence.Agents pull secrets in from the laptop: Developer endpoints hold credentials in .env files, shell history, and MCP config...

Read full story
Why We Built the Good Samaritan Program

Before GitGuardian was a company, it was a side project. We were two data scientists looking for the answer to one question: how prevalent were leaked secrets on GitHub? So we built a system that scanned every public commit in real time. The scale of what people were exposing—passwords, cloud keys, the credentials that run real businesses—was far larger than we could have ima...


Read full story