Apiiro found 2,539 secrets across 1,994 public repositories containing Claude Code settings files, including historical commits and forks. It did not test whether the credentials worked; one contacted organization confirmed its key was live.
A researcher found South Korea’s NCSC domain still listed two nameservers on expired aegis-k[.]com. The registry referral was fixed, but the agency’s zone still lists them and lacks DNSSEC; the article reports no evidence of abuse.
Researchers say default admin credentials and a path-confusion bypass exposed two unnamed automakers’ identity servers, enabling customer account takeovers and remote control of test cars. Both firms fixed the issue about two hours after disclosure.
