Feed aggregator

COLUMBUS, Ohio (WCMH) - The Ohio State Fair announced a new variety of food items that attendees can try this year from July 29 through Aug. 9. More than 15 new vendors and 25 food options are joining the fair. Many new sweet treats have been added from Cracker Jack Sundae, Biscoff Cookie Butter Frozen [...]

COLUMBUS, Ohio (WCMH) -- A 35-year-old man was given a $500,000 bond Monday morning after he was charged with felony child endangerment in connection to the death of his one-year-old son. Deshawn Butler also set received $10,000 bonds on four separate prior misdemeanor domestic violence charges in Franklin County Municipal Court, bringing the total to [...]

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a recent data leak in which a contractor published dozens of internal CISA credentials — including AWS Govcloud keys — in a public GitHub repository for almost six months before being notified by KrebsOnSecurity. Experts say the gaps identified in the agency’s initial response provide important lessons that all security teams should absorb.

On May 15, 2026, the security firm GitGuardian asked for help in notifying CISA about the existence of a public GitHub repository called “Private CISA” that included 844 MB of sensitive CISA-related data. One of the exposed files, titled “importantAWStokens,” included the administrative credentials to three Amazon AWS GovCloud servers. Another file — “AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems.

CISA quickly acknowledged our initial alert, but took more than 48 hours to invalidate the AWS keys and many other important secrets leaked in the GitHub repo. In its report on the data leak, CISA said the complexities of the agency’s systems and interconnections with federal and industry partners caused its key rotation to take longer than anticipated.

“Drawing on this experience, CISA encourages others to maintain mature and well-tested key management capabilities,” the report notes.

CISA also admitted it can do better when it comes to responding to security incident notifications from external parties. The postmortem stresses that clear and distinct reporting channels are essential to ensure that incidents affecting the organization itself are handled differently from those involving its products or customers.

“In CISA’s case, these channels were not well defined, leading the security researcher to try multiple avenues – including emailing the contractor, submitting through CISA’s vulnerability disclosure platform (which is intended for vulnerabilities impacting the broader cybersecurity community), and ultimately involving a reporter,” reads the analysis written by Preston Werntz and Brad Libbey, the acting chief information officer and acting chief information security officer at CISA, respectively.

CISA said it is refining its reporting channels to make them easier and faster for researchers. “Additionally, while many researchers rely on the security.txt file, organizations can ensure clarity by publishing reporting instructions in multiple prominent locations,” the CISA authors wrote.

Guillaume Valadon, the GitGuardian researcher who first contacted KrebsOnSecurity about the exposed CISA credentials, said CISA ignored nine automated alerts about the exposed credentials prior to our notification on May 15. Valadon’s company constantly scans public code repositories at GitHub and elsewhere for exposed secrets, automatically alerting the offending accounts of any apparent sensitive data exposures.

“Letting nine notification emails go unanswered is how a one-day incident becomes a six-month exposure,” Valadon wrote in an analysis of CISA’s report. “Make it trivial to report a leak about you, not just about your products. The person reporting a leak to you is not the threat. Publish a security.txt, but do not stop there. Put reporting instructions in several prominent places, and make sure a report about your own infrastructure does not land in a product-bug queue.”

The report’s authors also emphasized the importance of continuously scanning public code repositories like GitHub for exposed secrets, and said CISA has since rotated all secrets and created an action plan to improve management of developer secrets and to better monitor for them going forward.

The report notes that while CISA had developed a playbook for responding to cybersecurity incidents, that playbook somehow didn’t include what to do in situations involving GitHub or other cloud services. Valadon said the report validates the need to scan continuously — not just quarterly — for exposed secrets.

“The Private-CISA repository sat public for six months,” Valadon wrote. “Continuous monitoring of public GitHub surfaced it. Comprehensive internal scanning could have caught the plaintext passwords and committed backups long before they left the building.”

CISA gave itself passing grades on several areas of security preparedness that it said helped the agency gauge the scope and impact of the exposed secrets, including enhanced logging capabilities, and the adoption of zero-trust principles in both its production and development systems. CISA said those detailed logs allowed it to show that no customer or mission data was exposed, and that the leaked credentials were not used outside of CISA’s environments. The agency said the contractor who exposed the secrets had their system access revoked.

Valadon reckons the biggest takeaway is the CISA postmortem itself, and praised the agency for being transparent about what worked and what didn’t.

“To my knowledge, it is also the first time a national cybersecurity agency has publicly advocated for secrets scanning and for simplifying relations with security researchers,” Valadon wrote. “That is exactly the incident communication we should expect from every organization.”

Ohio Stadium Tours will offer special "Turf Tours" from July 22 to 31, allowing guests to watch the field's transformation and receive a piece of the National Championship turf as a keepsake.

MARYSVILLE, Ohio (WCMH) — A head-on and fiery crash resulted in the death of one person and four hospitalizations in Union County late Sunday night. At around 11:55 p.m. Marysville police responded to a crash at the intersection of State Route 31 and Mill Road in a north section of the city. Officers discovered a [...]

COLUMBUS, Ohio (WCMH) – The Applebee's near Polaris Fashion Place has permanently closed after 27 years of business. The casual American restaurant chain recently shut down its location at 1161 Polaris Parkway in north Columbus. It's unclear exactly when the eatery shuttered, though Google reviews suggest it closed about two to three weeks ago. NBC4 [...]

COLUMBUS, Ohio (WCMH) – The Ohio Supreme Court has declined to hear the appeal of the last Wagner family member awaiting trial for the Pike County massacre, leaving the death penalty on the table for his upcoming case. On Tuesday, the high court announced in an entry order that it would not consider George “Billy” [...]

COLUMBUS, Ohio (WCMH) -- Democratic gubernatorial candidate Amy Acton faced backlash from her party last week after she told The Toledo Blade she does "not support boys playing in girls sports." “I do not support boys playing in girls sports. This is already settled law in Ohio, and as governor I will enforce and uphold [...]

COLUMBUS, Ohio (WCMH) -- Two of Columbus’ most prominent bike lane projects are nearing completion, giving cyclists safer north-south routes through Clintonville and signaling how the city’s broader Bike Plus plan is beginning to take shape. The protected bike lane on North Fourth Street, the longest of its kind in the city at about 2.2 [...]

COLUMBUS, Ohio (WCMH) -- Records obtained by NBC4 offer a clearer picture of the Siders family's life across nearly two decades, up until four adults were charged and 16 children were rescued from a Vinton County home. Gary Siders, 73, Christina Siders, 66, Gary Siders II, 36, and Elizabeth Siders, 33, were arrested, and each was [...]

COLUMBUS, Ohio (WCMH) -- Allison Deehr is carving a path for herself separate from drug use. “I thought I was going to die being a drug user. I thought that was going to be my life, but I’m glad it’s not,” Deehr said. “By not giving up and having just the tiniest bit of hope, [...]

Apple is suing OpenAI for allegedly stealing trade secrets, sparking a heated debate about AI, hardware ambitions, and Silicon Valley's shifting alliances. Leo, Wesley, Lou, and Patrick tackle what Apple's legal gambit could mean for OpenAI's IPO and the future of AI development.

• Apple Sues OpenAI for Trade Secret Theft in Blockbuster Case
• Apple's OpenAI lawsuit highlights broader tensions
• Microsoft says the world is changing faster than it can keep up as it guts commercial, Xbox teams
• Claude Fable 5 promotional access
• Meta says four states want $1.4 trillion in penalties at August youth-safety trial
• Meta Removes A.I. Feature on Instagram After Days of Backlash
• Meta tests 'super sensing' AI glasses that can capture every moment
• Meta Ordered by E.U. to Alter 'Addictive Design' of Instagram and Facebook
• The backlash against Sony ditching PlayStation discs is not slowing down
• Colibrì proof-of-concept gains frontier-level 1.5-TB AI model — novel approach runs on only 25GB of RAM and shows promise for local AI setups
• Waymo called the cops on teen riders, raising privacy concerns
• Waymo says some of its robotaxis ran out of power during San Francisco's July 4 gridlock and had to be towed
• Zombie 'who owns Unix?' lawsuit comes alive again
• Copy That Floppy! - Copy That Floppy!

Host: Leo Laporte

Guests: Wesley Faulkner, Louis Maresca, and Patrick Beja

Download or subscribe to This Week in Tech at https://twit.tv/shows/this-week-in-tech

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit

Sponsors:

• blackhat.com/us-26 and use code TWIT
• joindeleteme.com/twit-biz
• NetSuite.AI/TWIT
• zscaler.com/security
• bitwarden.com/twit
• ZipRecruiter.com/twit

COLUMBUS, Ohio (WCMH) -- The “Columbus Blessing Boxes Project” aims to tackle food insecurity, but over the past month, it has become more difficult to keep their publicly located cabinets filled.   The founder, Gretchen Davis, shared that this summer has shown how in-demand food and other resources are in the community. The program remains dedicated to providing support for those [...]

In this week's Sunday Briefing, a child abuse case in Appalachian Ohio has captivated the nation, a complaint has been filed over Republican gubernatorial candidate Vivek Ramaswamy's campaign finance reporting, and retired judges and justices have called for unbiased courts.

COLUMBUS, Ohio (WCMH) -- Two men were arrested after a man died following a shooting and vehicle crash in northeast Columbus on Wednesday. Dwayne Dowdell, 35 and Devin Taylor, 29, were charged Saturday for the alleged murder of 28-year-old Xavier Gibbs. Police were called to the 1400 block of Carolyn Avenue at around 9:45 p.m. [...]

COLUMBUS, Ohio (WCMH) -- Two victims of a two-alarm fire that broke out in far east Columbus last month have now died. Crews were alerted to a fire at an apartment building in the 1900 block of Bairsford Drive just after 2 a.m. on June 10. Two adults and one child were hospitalized in critical [...]

COLUMBUS, Ohio (WCMH) — Columbus police are seeking clues in a nearly 24-year-old homicide that occurred in the Hilltop. On November 6, 2002, officers responded to reports of a shooting near the area of Columbian and Sullivant avenues. Police said that Troy Burchett was found suffering from a gunshot wound. Burchett was taken to a [...]