CISA secrets left sitting on GitHub.

**Executive summary:** This CyberWire Daily roundup reports multiple active security incidents and advisories: leaked AWS GovCloud keys from a CISA contractor, INTERPOL takedown of MENA phishing infrastructure, a patched Microsoft Authenticator token-theft flaw, Poland moving officials off Signal after targeted phishing, emergence of a stealthy SHub macOS infostealer, a critical Universal Robots vulnerability, a 4.6M-card dump on a Dark Web marketplace, and a $76M synthetic Bitcoin (Echo Protocol) breach.