decrypted · 23 august 2026 · vulnerabilities and patching · surveillance and privacy

The 768 AWS keys still working years after they leaked

Truffle Security re-checked 10,616 AWS access keys that have leaked publicly since August 2022, expecting most to be long dead. Instead, 88% of them still authenticate. Worse, 768 of those live keys hand over full control of a company's AWS account: 526 are root keys and the rest carry blanket AdministratorAccess. The single largest source, by a wide margin, was Hugging Face, where developers uploading models and datasets dragged their cloud credentials along with them. This is not a story about a clever attacker. It is a story about a design decision, made routinely, that almost nobody goes back to fix.

The keys nobody rotates

The median leaked key had been sitting exposed for around five years; the oldest for over 17. Of the keys where a creation date could be established, only 13.7% had ever been rotated. Barely one in ten of the affected accounts had a budget alert configured, which matters because a spending alarm is often the first and cheapest sign that a credential has been misused for anything from data theft to cryptomining. Truffle's researchers found the keys scattered across git history, Docker images, package registries and CI logs as well as Hugging Face datasets: the exposure routes have multiplied faster than anyone's cleanup habits.

Fix the design, not the scanner

AWS's own guidance has said for years that root account keys should not exist for routine work: they carry unrestricted access with none of the scoping or expiry that IAM roles and short-lived credentials offer. Yet the console still lets anyone generate one in a few clicks, so people do, and then a key built for a five-minute task ends up hardcoded somewhere for half a decade. Secret-scanning tools catch some of these leaks after the fact, but that is triage, not prevention. The Secure by Design fix is to remove the failure mode at the source: disable root key creation by default, force workloads onto temporary credentials, and treat anything that ever touched a public repository, dataset or image as compromised the moment it left the building, rotation included. For UK organisations running any meaningful footprint on AWS, this is worth an afternoon: check whether root keys exist at all, check when they were last rotated, and turn on budget alerts, which cost nothing and catch what scanning tools miss.

Also this week

A Zimbra mail flaw under active exploitation. CVE-2026-73570, an unauthenticated OS command injection in Zimbra Collaboration Suite, lets an attacker send crafted SMTP requests that get processed as SNMP notifications and executed as shell commands, no login required. Zimbra patched it on 20 July in version 10.1.20, but CERT Polska warned this week that exploitation is under way against unpatched servers, and CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 21 August with a 24 August deadline for US federal agencies. Mail servers hold address books, credentials and often broad internal reach, so any organisation still running an older Zimbra build with the optional SNMP package enabled should treat this as urgent.

UK identity fraud and SIM swapping, both climbing. Cifas's mid-year update to its Fraudscape 2026 report shows nearly 130,000 identity fraud cases recorded to the National Fraud Database in the first half of the year, up 9% on the same period in 2025, alongside a 402% rise in unauthorised SIM swaps, which now make up one in ten of all filings against one in fifty a year ago. Cifas chief executive Mike Haley points to stolen personal data as the entry point for both. The pattern underneath is familiar: a phone number is a mutable, portable identifier that carriers and banks still treat as proof of identity, which is exactly what makes it worth stealing. Where possible, that means moving second-factor recovery away from SMS and towards methods that cannot be socially engineered out of a call centre.

Sources

If you want a second pair of eyes on cloud credential hygiene or Secure by Design practices, get in touch.

The 768 AWS keys still working years after they leaked

The keys nobody rotates

Fix the design, not the scanner

Also this week

Sources

More like this