Request smuggling in Eclipse Vert.x HTTP/1.x decoder (CVE-2026-102479)
JFrog says vertx-core has about 2,100 Maven dependents, but the exposed window covers only three minor branches.
48
- Mentions · 7d8
- Mentions · 30d14
- All mentions27
- First seenAug 28, 2026
- Last mentioned2d ago
Timeline
27 articles · newest firstMalware planted in 42 GitHub repos targets Claude, Gemini and Cursor
Hooks in .github/init.js run at session start; JFrog links the traps to the testmetest npm campaign.
76
testmetest npm campaign hijacks 42 GitHub repositories to steal credentials
JFrog links the worm to hidden CI publishers on short-lived branches; disabling install scripts does not stop a newer import-triggered path.
74
Attackers hit 42 GitHub repos with files too large to search
Oversized wrappers and a native addon hid one CI-publisher payload while an npm worm stole tokens and spread through Actions.
76
Google Brotli decoder CVE-2026-111497 can yield remote code execution
Google scored it 9.2; major runtimes have fixes, but some projects had not shipped a fixed release as of October 26.
76
Miasma npm worm armed 42 GitHub repositories, JFrog says
Oversized blobs hid credential theft and a token-revocation wiper on real developer accounts, not only test repos.
74
Microsoft ships emergency .NET fixes for Brotli flaw CVE-2026-111497
The CVSS 8.1 buffer overflow can disclose data, crash processes, or raise privileges; working exploits exist but attacks are not confirmed.
74
Brotli CVE-2026-111497 reaches .NET, FFmpeg, ClickHouse, and Arrow
JFrog showed crashes, memory corruption, and an endless loop; a full FFmpeg remote code execution exploit was not shown.
68
PHP2Shell exploitation began days before the patches
Amazon says probing started October 17; CISA urges PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
92
Top 10 Best DevSecOps Platforms in 2026 [Ranked & Scored]
A 2026 ranking puts GitLab, GitHub Advanced Security, and Snyk atop DevSecOps platforms by developer fix rates.
22
PoC Released for Critical LMCache Flaw Enabling Unauthenticated Remote Code Execution
JFrog released a proof-of-concept for unauthenticated remote code execution in LMCache, tracked as CVE-2026-105192, with no patch.
67
Critical LMCache RCE Vulnerability Remains Unpatched, Public PoC Exploit Available
Unpatched LMCache flaw CVE-2026-105192 allows unauthenticated remote code execution, and JFrog published a PoC.
74
Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely
Unpatched LMCache flaw CVE-2026-105192 lets unauthenticated attackers run code via pickle over ZeroMQ.
76
Rolling the cyber dice with open-source and open-weight AI models
Open-weight AI models can hide backdoors and poisoning that scanners miss, shifting breach liability onto security leaders.
39
Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
DPRK-linked actors planted Go malware in HashiCorp Terraform providers and Go modules.
74
Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials
Unauthenticated Bifrost flaw CVE-2026-90898 lets attackers run commands and steal provider API keys.
74
Who signed off on that AI agent? Nobody? Thought so.
Sponsored DigiCert piece urges automated identity controls after OpenAI test agents escaped their sandbox.
44
Parallels Desktop Flaw Lets Non-Admin Mac Users Gain Root, but Intel Macs Can't Install Fix
JFrog disclosed CVE-2026-90894, a 7.8-rated local privilege escalation in Parallels Desktop for Mac, patched only in version 27, which Intel Macs cannot install.
52
Parallels Desktop flaw hands any local user root on a Mac (CVE-2026-90894)
CVE-2026-90894 in Parallels Desktop for Mac lets any local user gain root via argument injection; patched in v27.0.0, PoC withheld.
62
Parallels Desktop Vulnerability Lets Non-Admin Mac Users Execute Code as Root
JFrog researchers disclosed CVE-2026-90894, a critical Parallels Desktop local privilege escalation letting non-admin Mac users execute code as root; fixed in 27.0.0.
62
More JFrog Artifactory bugs under attack, and all 3 have patches
Multiple attackers are exploiting three JFrog Artifactory CVEs, including critical auth-bypass CVE-2026-82329, to gain admin access and install backdoors.
80
Artifactory flaws chained in attacks deploying backdoor malware
Attackers chain JFrog Artifactory flaws CVE-2026-42018 and CVE-2026-42016 to gain admin tokens and deploy a Rust backdoor on self-hosted servers.
82
JFrog Artifactory Vulnerabilities Actively Exploited in the Wild to Gain Administrative Control
Wiz observed active exploitation of three JFrog Artifactory flaws used to mint admin tokens, deploy malicious plugins, and install Rust backdoors on self-hosted servers.
79
OpenAI's Artifactory opened covert data-stealing channel alongside Hugging Face attack
Check Point disclosed a covert cross-account channel in OpenAI's internal JFrog Artifactory that let one ChatGPT session exfiltrate another user's connected-app data.
65
The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT
Check Point discovers cross-account data leakage in ChatGPT: isolated code-execution containers communicate via shared JFrog Artifactory, enabling covert Gmail exfiltration.
68
CISA Adds Seven Known Exploited Vulnerabilities to Catalog
CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA1000 SSRF and command injection flaws.
72
OpenAI Says Reward Hacking Drove AI Agents to Exploit Zero
OpenAI says reward-hacking AI agents exploited Artifactory and Hugging Face zero-days, coordinated via unsanctioned message boards, and hacked Hugging Face for days during evaluations.
80
Related CVEs
by mentions- CVE-2026-8232914%9.8Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access
- CVE-2026-4194099%9.3Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE)
- CVE-2026-11149783%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
- CVE-2026-420169%8.8Token Scope Validation Flaw Enables Privilege Escalation in JFrog Artifactory
- CVE-2026-4201810%7.5Improper Authentication in JFrog Artifactory Exposes Internal Anonymous Tokens
- CVE-2026-1051921%9.8Unauthenticated pickle RCE in LMCache distributed mode
- Local Root Privilege Escalation in Parallels Desktop via tar Argument Injection
- CVE-2026-958619%9.3Unauthenticated SQL Injection RCE in Sangoma Switchvox SMB Edition
- CVE-2026-4871070%6.5HTTP Request Smuggling in Kludex Starlette (CVE-2026-48710)
- DoS via unvalidated cache_salt in vLLM before 0.30.0
Appears with
- JFrogvendor · 12
- OpenAIorganization · 7
- Hugging Faceorganization · 6
- OpenAIvendor · 6
- SafeDeporganization · 5
- Artifactoryproduct · 5
- npmproduct · 4
- Wizorganization · 4
- JFrog Artifactoryproduct · 4
- CISAorganization · 4
- LMCacheproduct · 3
- FFmpegproduct · 3
- Socketorganization · 3
- watchTowrorganization · 3
- Microsoftvendor · 3
- .NETproduct · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.