Independent researcher Ben Zimmermann discovered 26,400 valid credentials for cloud and AI services in public repositories on Gitee, a Chinese code-hosting service.
The vulnerability or weakness
The vulnerability lay in developers leaving sensitive credentials, such as AccessKey pairs for Alibaba Cloud, in public code repositories, making them accessible to anyone.
Earlier attacks and coverage
- Linux Flaws Exposed Before Fixes as Root Exploit Goes Public (2026-10-26)
- ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident (2026-10-20)
Business impact
Organizations may face financial losses due to unexpected charges, data breaches, and service interruptions if the credentials are misused.
Users affected
Developers and organizations who committed their credentials to public repositories are at risk, as their sensitive information could be exploited.
