Cisco's 10/10 Critical Flaw 🚨 & CISA's Own Keys Leaked on GitHub 🔓

Two stories from today's security headlines deserve everyone's attention: a maximum-severity Cisco bug that hackers are already using to take over enterprise networks, and a jaw-dropping leak where the U.S. government's own cyber agency had administrator keys sitting in public view for half a year.

📶 Cisco's SD-WAN Got a Perfect 10 — And That's Very Bad News

Cisco disclosed a critical authentication bypass flaw (CVE-2026-20182) in its Catalyst SD-WAN Controller and Manager that scored a perfect 10.0 on the severity scale — the worst rating a vulnerability can get. The bug lets an unauthenticated attacker on the internet walk in and grant themselves full administrator access to the device that routes traffic between a company's offices, data centers, and cloud apps.

Why should you care? Cisco SD-WAN runs the backbone of thousands of enterprise networks, including banks, hospitals, retailers, and government agencies. Cisco confirmed the flaw is being actively exploited, and a threat group tracked as UAT-8616 is already using it to steal admin password hashes, API tokens, and even AWS credentials from victims. If your company runs Cisco SD-WAN, patching is not optional — it's an emergency.

Read more

🏛️ The Cyber Agency That Left Its Own Front Door Unlocked

In an irony almost too painful to read, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) — the federal body literally tasked with protecting America's digital infrastructure — had a contractor leave 844 MB of sensitive credentials sitting in a public GitHub repo from November 2025 until mid-May 2026. The repo, ironically named "Private-CISA," contained plaintext passwords, AWS GovCloud admin keys, internal system details, and SAML certificates.

Researchers at GitGuardian flagged it and CISA pulled it offline within 26 hours, but the keys were exposed for roughly six months. Some credentials were still active when discovered. While CISA says there's no evidence (yet) of active exploitation, this is the kind of breach that erodes public trust in the agency meant to set the standard. The takeaway for every business: secrets management isn't a "nice to have" — even cybersecurity experts can slip up, and the cost of one careless commit can be catastrophic.

Read more

Stay ahead of threats with GOCO Security at gocosecurity.com.