Search: “jbig2”

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

More JFrog Artifactory bugs under attack, and all 3 have patches

Multiple attackers are exploiting three JFrog Artifactory CVEs, including critical auth-bypass CVE-2026-82329, to gain admin access and install backdoors.

Wiz confirmed in-the-wild exploitation of all three JFrog Artifactory vulnerabilities: CVE-2026-42018 (high, improper authentication token leak), CVE-2026-42016 (high, privilege escalation), and CVE-2026-82329 (critical, unauthenticated authentication bypass). Starting August 15, attackers chained the first two bugs against self-hosted instances to gain admin access and dropped a custom Rust backdoor for C2; from September 1-8 several attackers exploited CVE-2026-82329. Post-exploitation included persistent admin accounts, Groovy plugins for remote code execution, web shells, token minting, key theft, and reconnaissance. Patching velocity has been slow, with 49-62% of organizations still vulnerable to individual bugs weeks after fixes were released.

The Register · Security·updated Sep 14, 09:27 UTC · 2d ago·first Sep 11, 17:43 UTC · 5d agoExploit / PoC in the wild 7 sourcesCVE-2026-42018CVE-2026-42016CVE-2026-82329

80

Attackers Pounce on Critical Artifactory Bug Following Disclosure

Attackers began exploiting CVE-2026-82329, a critical authentication bypass in JFrog Artifactory, shortly after disclosure, gaining admin-level access on affected systems.

CVE-2026-82329 is a critical authentication bypass in JFrog's Artifactory repository manager that enables attackers to gain admin-level access on affected systems. Exploitation started soon after the flaw's disclosure. Artifactory is widely used to manage software artifacts, making compromised instances a software supply chain risk.

Dark Reading·Sep 1, 21:05 UTC · 15d agoExploit / PoC in the wild 2 sourcesCVE-2026-82329

76

Re: rosbridge_library Protocol.incoming() quadratic CPU cost in JSON fallback

David Wheeler notes a rosbridge_library quadratic CPU cost flaw was publicly disclosed on oss-security without prior coordination.

In an oss-security reply, David A. Wheeler pointed out that a poster had just publicly disclosed details of a quadratic CPU cost issue in rosbridge_library's Protocol.incoming() JSON fallback path. Wheeler referenced the mailing list's stated norms encouraging public discussion of open-source security flaws. The reply itself contains no fix, CVE, or exploitation details.

oss-security·Sep 14, 19:53 UTC · 2d agoVulnerability 3 sources

12

Enterprises Warned of Attacks Exploiting WSO2 Vulnerability

Attackers are actively exploiting CVE-2026-5430 (CVSS 10), a WSO2 JWT authentication bypass, to access enterprise API credentials and sensitive data.

WatchTowr's honeypot network recorded the first exploitation attempt of CVE-2026-5430 on September 13, roughly two months after the CVE record was published in early August. The flaw, patched by WSO2 in April with an advisory in May, carries a maximum CVSS score of 10 and allows JWT authentication bypass via tokens signed with unsupported algorithms, enabling unauthorized access and full account takeover. A forged JWT observed in the wild granted access to API backend endpoints, credentials, and consumer keys and secrets for every registered application. WSO2's API Manager, API Control Plane, Traffic Manager, and Universal Gateway are affected, and the platform serves nearly 1,000 enterprise customers in banking, government, telecom, and logistics.

SecurityWeek·updated 15:05 UTC · 7h ago·first 08:39 UTC · 13h agoExploit / PoC in the wild 3 sourcesCVE-2026-54302· 1 read

84

ZDI-26-648: (Pwn2Own) OpenAI Codex External Control of System or Configuration Setting Remote Code Execution Vulnerability

ZDI published a Pwn2Own advisory for CVE-2026-19590, enabling remote code execution in OpenAI's Codex agent via system or configuration control.

Zero Day Initiative advisory ZDI-26-648 documents an External Control of System or Configuration Setting vulnerability in OpenAI Codex, demonstrated at Pwn2Own. A remote attacker could achieve arbitrary code execution, with user interaction required such as opening malicious content. The flaw is tracked as CVE-2026-19590 with a CVSS rating of 7.8. No exploitation in the wild is reported.

ZDI Published Advisories·Sep 10, 05:00 UTC · 6d agoVulnerability 4 sourcesCVE-2026-195901

52

ZDI-26-669: Adobe Acrobat Reader DC JBIG2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI advisory ZDI-26-669 details an out-of-bounds read (CVE-2026-81978) when Adobe Acrobat Reader DC parses JBIG2 files.

The Zero Day Initiative published advisory ZDI-26-669 for an out-of-bounds read triggered when Acrobat Reader DC parses JBIG2 files. Successful exploitation allows a remote attacker to disclose sensitive information from affected installations. User interaction is required, such as opening a malicious file or visiting a malicious page. ZDI rated the issue 3.3 and assigned CVE-2026-81978.

ZDI Published Advisories·Sep 10, 05:00 UTC · 6d agoAdvisory 19 sourcesCVE-2026-81978

15

Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode

Check Point's hasherezade details static deobfuscation of JSCeal, a V8-bytecode stealer targeting cryptocurrency applications since March 2024.

JSCeal is an infostealer distributed as compiled V8 bytecode (.jsc) executed by a bundled Node.js runtime, aimed at cryptocurrency applications. Other vendors track the same family under the names WEEVILPROXY or MeadowLocust. Check Point Research has tracked the campaign since early 2024, with activity dating back to March 2024. The write-up presents a static approach to unpacking the bytecode without executing it.

Check Point Research·Aug 31, 13:38 UTC · 16d agoMalware in the wild1

55

JSCeal Hides Crypto Malware in V8 Bytecode

Check Point details JSCeal, a crypto-stealing malware delivered as compiled V8 bytecode, and built a decompiler pipeline to expose its capabilities.

JSCeal, tracked by Check Point Research since early 2025, is a cryptocurrency stealer delivered as heavily obfuscated JavaScript compiled to V8 bytecode (.jsc) and run by a bundled Node.js runtime. Check Point, presenting at Black Hat USA 2026, extended the open-source View8 decompiler into a pipeline that recovered readable code from 23 samples, revealing theft of browser credentials and cookies, Telegram sessions, keystrokes, screenshots, HTTPS traffic interception with attacker-controlled certificates, and automated Google account takeover. Targeted overrides rewrite content for Binance, Bybit, and Ledger users. Later samples added AES-256-CBC encryption with externally supplied keys and expanded targeting to macOS.

Security Affairs·Sep 7, 10:19 UTC · 9d agoMalware1

58

ZDI-26-588: Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability

ZDI disclosed a server-side request forgery in Fabric.js loadFromJSON (CVE-2026-19504) that can leak sensitive information from affected implementations.

Zero Day Initiative advisory ZDI-26-588 describes a server-side request forgery vulnerability in the Fabric.js canvas library's loadFromJSON function. Exploitation requires interaction with the library and attack vectors vary by implementation, potentially exposing sensitive information. The issue is rated 4.0 on the CVSS scale and tracked as CVE-2026-19504. The advisory does not report exploitation in the wild.

ZDI Published Advisories·Aug 24, 05:00 UTC · 23d agoVulnerabilityCVE-2026-19504

15

IdeaAMBIG: Benchmarking Implementation-Critical Gaps in Research-Idea Specifications

IdeaAMBIG benchmark of 660 specification-gap instances shows LLMs localize implementation-critical research gaps poorly, with best model at 9.6% defect recovery.

IdeaAMBIG is a benchmark of 660 evidence-grounded instances evaluating whether research-method specifications provide enough information for faithful implementation: 163 real-world gaps from reproducibility reports and GitHub issues plus 497 controlled synthetic gaps. It tests codification-readiness assessment, defect localization, and clarification action generation across 13 LLMs. The best model achieves only a 9.6% Macro Defect Recovery Rate on real-world instances, though 80.6% clarification success when given the annotated defect, and an oracle study shows gold resolutions raise codification-ready rates from 14% to 98%. Defect localization emerges as the main bottleneck across all evaluated models.

Hugging Face daily papers·Sep 8, 20:00 UTC · 8d agoAI research

30

ZDI-26-693: Linux Kernel ksmbd Share Configuration Race Condition Remote Code Execution Vulnerability

ZDI-26-693: authenticated race condition in Linux kernel ksmbd share configuration allows remote code execution on ksmbd-enabled systems; CVSS 8.5.

ZDI advisory ZDI-26-693 discloses a race condition in the Linux kernel's ksmbd share configuration that allows remote attackers to execute arbitrary code on affected installations. Exploitation requires authentication, and only systems with ksmbd enabled are vulnerable. ZDI assigned a CVSS rating of 8.5; no CVE is listed in the advisory text.

ZDI Published Advisories·Sep 14, 05:00 UTC · 2d agoVulnerability1

45

IdeaAMBIG: Benchmarking Implementation-Critical Gaps in Research-Idea Specifications

IdeaAMBIG benchmark with 660 instances measures whether LLMs can spot and fix underspecified research-method details for faithful implementation.

Researchers introduce IdeaAMBIG, a benchmark of 660 evidence-grounded instances (163 real-world gaps from reproducibility reports and GitHub issues, 497 controlled synthetic gaps) built from papers, codebases, and reproduction artifacts. It evaluates codification-readiness assessment, defect localization, and clarification action generation. Across 13 LLMs, the best model achieved only 9.6% Macro Defect Recovery Rate on real-world instances but 80.6% clarification success when given the annotated defect. An oracle study showed gold resolutions raise the codification-ready rate from 14% to 98%, identifying defect localization as the main bottleneck.

arXiv cs.AI / cs.LG / cs.CL·Sep 9, 17:59 UTC · 7d agoAI research2

28

CISA Added JFrog Artifactory Vulnerability to its Known Exploited Vulnerabilities Catalog (CVE-2026-82329)

CISA added the actively exploited JFrog Artifactory flaw CVE-2026-82329 (CVSS 9.8) to its KEV catalog; unauthenticated attackers gain admin access.

CISA added CVE-2026-82329, a critical improper authentication flaw in JFrog Artifactory, to its Known Exploited Vulnerabilities Catalog with a September 5, 2026 patch deadline. The CVSS v3.1 9.8 flaw allows unauthenticated attackers with network access to obtain administrative privileges under the default configuration. WatchTowr honeypot data shows attackers minting administrator tokens, enumerating users, groups, and federated access topologies, and in some cases creating backdoor users for persistence. Users must upgrade to Artifactory 7.161.20 or the applicable fixed release; Qualys detects vulnerable assets via QID 735249.

Qualys ThreatPROTECT·Sep 3, 13:09 UTC · 13d agoExploit / PoC in the wildCVE-2026-82329

84

CVE-2026-87785: Apache Syncope: JWT subject spoofing

Apache Syncope disclosed low-severity CVE-2026-87785, a JWT subject spoofing flaw enabling authentication bypass in affected syncope-core-spring versions.

CVE-2026-87785 is a low-severity authentication bypass by spoofing vulnerability in Apache Syncope related to the configured JWKS settings for internal JWT authentication. Affected versions are syncope-core-spring 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security·Sep 14, 15:59 UTC · 2d agoVulnerabilityCVE-2026-87785

15

7th September – Threat Intelligence Report

Check Point weekly bulletin: exploited SonicWall SMA 1000 zero-days (CVE-2026-83548/49), JFrog Artifactory auth bypass, and a 2.8M-patient Baylor Genetics breach.

Check Point's weekly bulletin covers breaches including Thomson Reuters' C-Track platform (court records across 11 US states and Canada), Baylor Genetics (2.8M patients and employees, SSNs included), Hit casinos in Slovenia, and Dropbox (~5,000 accounts via abused Lenovo email verification). SonicWall patched two exploited SMA 1000 zero-days, including CVE-2026-83548, a CVSS 10.0 pre-authentication SSRF, while JFrog fixed exploited authentication bypass CVE-2026-82329 (CVSS 9.8). Malware and actor coverage includes Gambling Goblin, JSCeal, Mirage Kitten's NodeRabbit/PollCat campaign, and DPRK Contagious Interview macOS activity, plus a FalconFlank privilege-escalation PoC against CrowdStrike Falcon.

Check Point Research·Sep 7, 14:54 UTC · 9d agoAdvisory in the wildCVE-2026-83548CVE-2026-83549CVE-2026-823291

70

VU#308749: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Insecure deserialization in Kaltura's legacy HTML5 Player V2 (mwEmbed) allows arbitrary file read and remote code execution; Player V7 is unaffected.

CERT/CC issued VU#308749 for two flaws in Kaltura's HTML5 Player V2 library (mwEmbed/html5lib), both caused by the same insecure deserialization bug. The flaws enable arbitrary file read and remote code execution via the exposed mwEmbedLoader.php endpoint. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases; the currently supported Player V7 is unaffected. No evidence of exploitation was cited.

CERT/CC Vulnerability Notes·Aug 25, 16:11 UTC · 22d agoVulnerability

50

CVE-2026-73178: Apache Syncope: JWT Access Token takeover

Apache Syncope discloses CVE-2026-73178, an important-severity flaw enabling JWT access token takeover in versions 3.0.x through 4.1.2.

Apache Syncope disclosed CVE-2026-73178, an Exposure of Sensitive Information to an Unauthorized Actor vulnerability rated important that allows JWT access token takeover. Affected versions include syncope-core-provisioning-java 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to the latest fixed releases.

oss-security·Sep 14, 15:19 UTC · 2d agoVulnerabilityCVE-2026-731781

42

IBM security advisory (AV26-922)

Canadian Cyber Centre relays IBM advisory for Langflow, MQ, and Sterling File Gateway flaws including MQ remote code execution (CVE-2026-13293).

Canadian Cyber Centre advisory AV26-922 relays IBM fixes for Langflow OSS (versions through 1.11.5 across release lines), IBM MQ (10.0.0.0 and 9.x LTS/CD through 9.4.5.1), and Sterling File Gateway (through 6.2.2.1). CVE-2026-13293 is a remote code execution flaw in IBM MQ Java messaging caused by an incomplete security scanner blocklist enabling network-based code execution. CVE-2026-19290 is an improper access control vulnerability in IBM Sterling File Gateway. Administrators are urged to review and apply the necessary updates.

Canadian Centre for Cyber Security·Sep 15, 14:29 UTC · 1d agoAdvisoryCVE-2026-13293CVE-2026-19290

30

CVE-2026-87802: Apache Syncope: SRA OAuth2 JWT signature verification bypass

Low-severity CVE-2026-87802 in Apache Syncope SRA allows JWT signature forgery in OAuth 2.0 setups without JWKS URI.

CVE-2026-87802 is a low-severity improper cryptographic signature verification flaw in Apache Syncope SRA affecting versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. When SRA is configured for OAuth 2.0 without a JWKS set URI assigned, an attacker can forge tokens, bypassing JWT signature verification.

oss-security·Sep 14, 16:02 UTC · 2d agoVulnerabilityCVE-2026-87802

15

[webapps] Joomla JCE_2.9.15 - Remote Code Execution

A remote code execution proof of concept for Joomla Content Editor (JCE) 2.9.15 was published on Exploit-DB.

Exploit-DB added a webapps proof-of-concept for remote code execution affecting the Joomla Content Editor (JCE) component version 2.9.15. JCE is a widely deployed editor extension used on Joomla websites. The entry provides no CVE id and no evidence of in-the-wild exploitation.

Exploit-DB·Aug 17, 00:00 UTC · Aug 17, 2026Exploit / PoC1

40

JFrog security advisory (AV26-867) – Update 1

CISA added actively exploited CVE-2026-82329 in JFrog Artifactory to its KEV catalog; administrators of affected versions should patch.

Canada's Cyber Centre (advisory AV26-867, Update 1) relays a JFrog security advisory covering Artifactory, where open-source reporting indicates CVE-2026-82329 is being exploited in the wild. CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 2, 2026. Multiple Artifactory release lines prior to fixed versions (e.g., prior to 7.111.21 through 7.161.20) are affected; users and administrators are urged to apply available updates.

Canadian Centre for Cyber Security·Sep 2, 18:55 UTC · 14d agoExploit / PoC in the wildCVE-2026-82329

78