Cyber news for UK businesses, Monday 9 November 2026
Claude Code can save passwords in a file that ends up on GitHub When a developer picks “Yes, and don’t ask again”, the coding assistant can store the approved command word for word, secrets included. Apiiro found 1,122 public copies of that file holding at least one secret, though it did not test whether they still work. If you or your web developer use coding assistants, search your repositories for the file. Change every password and key it ever held first, then remove it. Our guide to secret rotation shows the order.
Attackers are using AI agents to hunt for secrets in public code Microsoft said threat actors are using an agentic AI framework to search public GitHub repositories for exposed credentials and API keys. In one case an agent went from scanning GitHub to taking data from Azure Key Vault in five minutes. Check that no keys sit in your code, and rotate any that do. You can also run our free web vulnerability scan on your public site.
Chainalysis says every user’s credentials were exposed The company says its investigation found names, usernames, password hashes and live tokens for all users exposed. It took some services offline and told customers to reset passwords on other systems where they reuse them. Whatever tools you use, give every account its own password.
OpenSSH flaw on Alpine Linux is being attacked (published 6 November) Attackers tried to exploit CVE-2026-123158 within hours of disclosure, and one gained root on a honeypot. It affects Alpine Linux’s default OpenSSH setup, not most other Linux systems. If your host or developers run Alpine, update to OpenSSH 10.6p2 or the distribution’s patched package and restart sshd.
Not sure which of your logins or keys have already leaked? Breachy, our breach exposure monitoring, can show you. See also yesterday’s cyber news for UK businesses.