Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Received an Apple Threat Notification? How to Verify and Respond Safely

  An Apple threat notification is not a routine security warning. Apple issues these high-confidence alerts when its threat intelligence ind...

All the recent news you need to know
RCE
Critical Vulnerability Cyber Security JFrog Artifactory Organization Security RCE

Attackers Exploit CVE-2026-82329 to Forge JFrog Artifactory Admin Tokens



Cybersecurity researchers have observed attackers exploiting a critical JFrog Artifactory vulnerability shortly after its public disclosure. The flaw allows unauthenticated attackers to obtain administrative privileges on vulnerable self-hosted installations.

Tracked as CVE-2026-82329, the authentication-bypass vulnerability carries a CVSS severity score of 9.8. JFrog published its advisory and released security updates on August 28, 2026. Threat-intelligence researchers subsequently detected exploitation attempts beginning on September 1.

What Is JFrog Artifactory?

JFrog Artifactory is an artifact repository manager used by development teams to store, manage and distribute software packages and binary files.

Because Artifactory often connects directly to software-development and deployment pipelines, administrator-level access could allow attackers to manipulate repositories, steal credentials or introduce malicious components into software builds.

How CVE-2026-82329 Works

The vulnerability affects JFrog Access, the component responsible for authentication and credential management.

According to research shared by watchTowr, Artifactory installations without an additional join key configured may receive a fallback or “phantom” join key. Attackers can potentially abuse this condition to forge access and generate administrator-level authentication tokens.

Successful exploitation does not require an existing account or user interaction. An attacker only needs network access to a vulnerable Artifactory installation operating under the affected configuration.

The vulnerability does not directly provide remote-code execution. However, administrative control over an artifact repository could allow attackers to modify packages, create unauthorized accounts, access sensitive credentials and interfere with connected build systems.

Exploitation Detected in the Wild

WatchTowr researchers reported observing attackers use the vulnerability to generate administrator tokens and enumerate information about users, groups, credentials and federated-access configurations.

Some activity appeared limited to confirming whether a system was vulnerable. In a smaller number of cases, attackers reportedly created backdoor accounts and examined the compromised environment for opportunities to maintain access or expand the intrusion.

Researchers had not observed widespread scanning or mass exploitation when the activity was initially reported. Nevertheless, the rapid transition from public disclosure to exploitation demonstrates the limited time organizations have to secure internet-facing systems.

The Canadian Centre for Cyber Security has also warned that open-source reporting indicates active exploitation of CVE-2026-82329.

Patched JFrog Artifactory Versions

JFrog has released fixes across multiple supported Artifactory branches. Self-hosted customers should upgrade to the applicable fixed release:

  • 7.111.21

  • 7.117.28

  • 7.125.20

  • 7.133.29

  • 7.146.38

  • 7.161.20

JFrog says affected cloud environments have already been fortified and do not require customer action. Administrators of self-hosted deployments should consult the official JFrog security advisory to identify the correct update for their installation.

Recommended Security Measures

Organizations operating self-hosted JFrog Artifactory installations should:

  • Install the appropriate security update immediately.

  • Restrict internet access to Artifactory management interfaces.

  • Review audit logs for unexpected token or administrator-account creation.

  • Revoke unauthorized tokens and remove unfamiliar user accounts.

  • Rotate credentials and secrets accessible through the affected environment.

  • Inspect repositories for unauthorized package or configuration changes.

  • Examine connected CI/CD systems for evidence of lateral movement or artifact tampering.

CVE-2026-82329 is particularly dangerous because compromising a central artifact repository can affect more than the initially targeted server. Attackers with administrative access may be able to interfere with the software-development process and distribute modified components through trusted internal channels.

No public evidence currently confirms that CVE-2026-82329 is connected to the previously reported OpenAI and Hugging Face AI-agent activity involving an internal Artifactory environment. The two stories should be treated as separate security incidents.


Read more »
KrebsonSecurity
Credential Theft Cyber Security Data Breach driver’s license FBI Identity Theft KrebsonSecurity

FBI Investigates Dark Web Service Offering 153 Million Driver’s Licenses

 



The FBI has opened an investigation into an apparent breach involving identity verification provider IDScan.net after a newly launched dark web service began advertising access to more than 153 million U.S. and Canadian driver’s license records.

The service, named Nexus, appeared on the Russian cybercrime forum Exploit on August 31, claiming access to identity documents belonging to more than 170 million people across North America. Its advertised database includes more than 153 million driver’s licenses, over 10 million identification cards, more than three million travel or international identity documents, and at least 579,000 medical cards.

An examination of the service indicates that the claimed volume may be credible. A search without filters reportedly produced about 11.5 million pages of records, with approximately 15 results per page. Canadian licenses accounted for roughly 1.1 million results, including 473,673 records from Ontario, while most listings originated from the United States.

The dataset also contains marijuana dispensary cards, commercial driver’s licenses and records marked “CAC,” potentially referring to U.S. government Common Access Cards. Nexus operators claim the information is being obtained through an ongoing compromise of a major identity verification company serving Fortune 500 customers. They claim to have continuously extracted new records for more than a year.

Evidence examined by KrebsOnSecurity also indicates that the database may still be receiving stolen information. The number of available driver’s license records reportedly increased by nearly 400,000 within 24 hours.

The exposed records are unusually detailed. One license examined by Krebs contained six image files showing the front and back of the document, including standard, infrared and ultraviolet captures. Each file carried a timestamp. In several cases, those timestamps corresponded closely with victims’ real-world activities.

Krebs tested the apparent pattern by obtaining permission to search for licenses belonging to more than a dozen acquaintances. Nine licenses were located, and each individual confirmed travelling on or around the dates associated with the image timestamps. Further comparison with rental records indicated the timestamps appeared consistent with Greenwich Mean Time.

The evidence initially pointed toward airports, but that theory weakened because the database contained no passports and several individuals had not presented their licenses at airport security. Two federal employees who appeared in the dataset said they used other government identification at airport checkpoints, but later handed their state licenses to Hertz when renting vehicles.

A particularly revealing comparison involved Krebs’ own license and his mother’s. Their records carried timestamps only seconds apart, corresponding to the time both licenses were handed to a Hertz representative. Another exposed license belonged to security researcher Zach Edwards, whose timestamp matched a trip to Las Vegas for DEF CON. Edwards said he showed his license to TSA, his hotel and Planet 13, but identified the dispensary as the only location that definitely scanned it.

That connection is notable because Planet 13 announced in 2022 that it had deployed IDScan.net’s VeriScan technology across 16 check-in stations at its Las Vegas SuperStore. The system captures government-issued identification, performs document authentication and can use white-light, infrared and ultraviolet imagery. IDScan.net says its technology performs more than 21 million identity verifications each month across more than 20,000 locations.

IDScan.net also publicly lists major organizations using its technology, including Hertz, Target, FedEx and Caesars Entertainment. Its current platform supports ID scanning, document authentication, data parsing and integrations through APIs and software development kits.

IDScan.net told KrebsOnSecurity that it was investigating but had not provided a substantive public explanation of the suspected incident. Its documentation shows that its systems can retain raw files generated during scans, while its security documentation describes encryption for data at rest and in transit.

The FBI’s New Orleans field office subsequently opened an official investigation into the suspected breach. The development adds a law-enforcement dimension to an incident that could expose highly sensitive identity information at unprecedented scale.

The potential consequences extend beyond conventional credential theft. Driver’s license information is legally recognized as identifying information, and stolen identity data can be used to open accounts, obtain services, commit financial fraud or impersonate victims.

The incident also exposes a difficult security trade-off in modern identity verification. Organizations increasingly depend on third-party systems to scan government credentials for travel, rentals, retail, financial services and age verification. TSA began enforcing REAL ID requirements for domestic air travel in May 2025, further embedding government-issued identification into everyday verification processes.

For now, the precise intrusion path, affected customers and total number of compromised individuals remain unconfirmed. However, the combination of detailed document images, matching timestamps, apparent fresh data collection and the FBI investigation makes Nexus a serious warning about the risks created when sensitive identity documents are concentrated within third-party verification infrastructure.

Read more »
Hacker attack
BGP Hijacking cloud hosting Cyber Attacks Cybersecurity Breach Exposed Servers file server attacks Hacker attack

Hackers Hijack BGP Routes to Deliver Malicious Virtualizor Update

 

Hijackers compromised network routes used by Softaculous and redirected traffic to servers where they distributed a rogue Virtualizor update to a limited number of installations. Virtualizor is a web-based control panel made by Softaculous that hosting providers use to set up, manage and sell their virtual private servers (VPS). 

According to an urgent security advisory from Softaculous, the attack occurred between 20:57 UTC on 28th August and 06:10 UTC on 30th August. The hijackers rerouted a block of IP addresses hosted by Hetzner through a Border Gateway Protocol (BGP) hijacking before redirecting traffic to the company’s software update infrastructure and client/billing portal. BGP hijacking works by having an attacker or misconfigured network publish a false route for a targeted IP address range. 

Inadvertently, some networks start routing traffic based on the falsified information, giving bad actors access to data. Softaculous confirmed that the attack resulted in a rogue Virtualizor update being distributed to a limited number of installations that fetched their updates during the attack. The company noted that the incident affected only a handful of servers and not the wider Virtualizor user-base. (BleepingComputer) Since the hijacking rerouted requests to the company’s update infrastructure, Softaculous stated that it does not have records of the affected requests. 

The company is recommending that Virtualizor administrators check for the suspicious service /etc/systemd/system/java-jre-update.service. If found, administrators should rotate and lock their API credentials and check their systems for unauthorized SSH keys, users, cronjobs, and outbound connections. Users who accessed the Softaculous client area or provided payment details in the attack window should also change their passwords, check their account activity, and monitor their credit card statements. 

Softaculous’ investigation into the incident is ongoing, although the company stated that there is no indication that its other products were affected. The hijacked routing has been restored, and the fraudulent certificate used during the attack has been reported for revocation. Softaculous released Virtualizor version 3.2.9.9 on 1st September. The update includes a Security Analyzer tool in the administration panel and will roll out cryptographic signing for all software packages. The company will also migrate its infrastructure to a more secure environment. (BleepingComputer)
Read more »
Router Security
Cyber Security Firmware Updates Network Safety NSA Warning Router Security

NSA Warning Exposes Common Router Security Risks

 

The recent warning from the NSA and partner agencies highlights a simple but important reality: routers are often the weakest link in a home or small-office network. Attackers do not need a dramatic new exploit if a device is already exposing old services, default credentials, or remote management features that were never meant to be public. 

The advisory focused on enterprise networking gear, especially Cisco equipment, but the lessons translate well to consumer routers because the same habits create the same openings. In practice, the risk is not just about sophisticated nation-state operations; it is also about ordinary misconfiguration that leaves the door unlocked. 

One of the biggest problems is unnecessary services. Many routers can run SNMP, SSH, Telnet, FTP, USB file sharing, media-server functions, or other optional features, and every extra service increases the attack surface. If a feature was turned on for a one-time setup task and then forgotten, it should usually be disabled. The same caution applies to convenience features like WPS, which can make wireless access easier but can also weaken security if left enabled after setup. The safest rule is to keep only what you actively use and understand. 

Credentials and remote access are the next major concerns. A router’s admin password is separate from the Wi-Fi password, and the admin login protects the settings that control your DNS, firewall, port forwarding, and wireless configuration. If that password is still factory default, short, reused, or predictable, it should be replaced immediately with a unique one stored in a password manager. It is also wise to disable remote management unless you truly need it, because exposing the admin interface to the public internet greatly increases the chance of abuse. If remote access is necessary, a VPN and multi-factor authentication are much safer options. 

Keeping firmware updated is just as important. Router updates often fix security flaws the same way phone or PC updates do, but many people never check whether automatic updates are enabled or whether their device still receives support. If a router has stopped getting patches, it becomes a growing liability because known and newly discovered vulnerabilities can accumulate over time. End-of-life hardware should be replaced rather than trusted indefinitely. For most homes, that means a quick review of services, passwords, remote access, and firmware status can eliminate the most common router risks.
Read more »
Ruby On Rails Vulnerability
AI Security Credential Theft CVE-2026-0768 Cyber Attacks Langflow Vulnerability Remote Code Execution Ruby On Rails Vulnerability

Attackers Turn Langflow and Rails Flaws Into Entry Points for Credential Probing


Observations have shown that threat actors are actively exploiting critical vulnerabilities in Langflow and Ruby on Rails, with attacks moving beyond vulnerability testing to credential discovery and reconnaissance, according to threat intelligence firm VulnCheck. 

The CVE-2026-0768 vulnerability, which has a CVSS score of 9.8, affects Langflow, a low-code platform used to develop artificial intelligence applications. It is a vulnerability in which user-controlled input is not adequately validated and can allow attackers to execute arbitrary Python code with root privileges on vulnerable systems. 

Trend Micro's Zero Day Initiative initially disclosed this vulnerability in January 2026. CVE-2026-66066, also known as KindaRails2Shell, affects Ruby on Rails and has a CVSS score of 9.5. This flaw can be exploited by unauthenticated attackers to gain access to arbitrary files, to expose data regarding Rails processes, and to retrieve sensitive information, including secrets_key_base, Rails master key, database credentials, cloud storage credentials and API tokens. Such access can ultimately lead to remote code execution. 

Exploitation of CVE-2026-66066 is facilitated by a parsing inconsistency between Rails Active Storage and the libvips image processing library. Attackers can submit specially crafted images to applications that utilize libvips for Active Storage processing and accept uploads from untrusted users in order to exploit the vulnerability Successful exploitation depends on the vulnerable configuration of the affected application. 

During the first few hours on August 30, VulnCheck reported more than 50 detections, but the number increased to about 360 by Monday afternoon. Based on observed activity, attackers may be inspecting environments and searching for credentials and other sensitive information on compromised or exposed systems. 

VulnCheck vice president of threat research Caitlin Condon commented on observed requests including retrieving Langflow environment variables associated with administrator credentials, OpenAI API keys, and AWS access credentials. A number of other files were examined by the attackers, including the /root/.cache/langflow/secret_key file, access information related to SSH, and .bash_history. 

Telemetry indicated that most of the source traffic was originating from Russia, but the initial attacks were observed only against VulnCheck canary systems in the United Kingdom. It has been noted that subsequent activity has expanded to additional locations, indicating that the exploitation process is no longer limited to those initially targeted. 

The Langflow platform has previously been attacked only in limited instances during the period 2026, as reported by VulnCheck. However, 11 additional vulnerabilities have been identified and are currently being exploited in the wild. Langflow has historically seen limited exploitation activity. More than 15,000 successful attacks against instances affected by CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027 have been recorded. This activity shows that Langflow compromises can extend beyond the platform itself as well. 

Attackers were reported to have combined an unauthenticated remote code execution vulnerability, CVE-2026-33017, with an insecure direct object reference vulnerability, CVE-2026-55255, in a campaign observed on June 25, 2012. This campaign targeted approximately 7,000 servers to obtain API keys for OpenAI and Anthropic, as well as credentials for Amazon Web Services, Google Cloud, and Microsoft Azure, and connection details to the database. 

Through such activities, exposed AI application infrastructure is an excellent source of credentials, which can allow access to cloud services, databases, and model providers. By incorporating sensitive tokens into AI workflows, an initial compromise may have a greater impact, particularly when those credentials are reused across a variety of services. 

Langflow has also gained increasing attention as an integral part of the enterprise attack surface rather than being an isolated development tool as a result of the increasing number of attacks. Security teams monitoring deployments are therefore expected to account for credentials, configuration files and connected services which can be accessed upon successful compromise. 

This ongoing exploitation illustrates the growing security concerns associated with internet-facing artificial intelligence infrastructure. An organization should closely monitor Langflow deployments, secure sensitive credentials, and limit unnecessary external exposure in order to reduce the impact of a successful attack.
Read more »
Technology
AI Anthropic Artifical Intelligence Claude Reddit Technology

Anthropic: Infostealer Malware Hacks Claude Sessions to Drain Consumption Usage


Anthropic has warned Claude users that infostealer malware on their systems has stolen active Claude login sessions, letting threat actors to log into accounts and using it.

Anthropic is logging out impacted users out of Claude, eliminating saved payment records, and reimbursing unauthorized charges. 

When a user shared the incident on Reddit, Anthropic replied in an email that, “We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people's computers, then using those login sessions to access Claude accounts and consume their usage.”

Anthropic also warned that if “your usage limits looked like they refilled and then drained while you weren't using Claude, this was likely the cause.”

Experts suggest that infostealers can also copy an already verified session, meaning the threat actor doesn’t require the standard password and multi-factor login process again.

Who is responsible?

In the email sent to impacted account users, Anthropic said the investigation is in progress, but the PCs were already compromised standard-purpose infostealer malware.

According to Anthropic, it has “no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude.”

As per the company, the malware usually enters via malicious apps or downloads and steals locally stored data such as login cookies, app credentials, and browser passwords.

"Your Claude session was likely one of the many things it collected. It appears that a bad actor has now started picking the Claude sessions out of what it collected and using them," Anthropic said.

In the reddit incident, the user shared that they downloaded a pirated game, which led to system compromise. 

Anthropic has found multiple malware such as StealC, Vidar, LummaC2, Acreed on Windows, RedLine, and Atomic Stealer (AMOS) on Macbooks

If you are impacted, Claude will eliminate hacked sessions and revoke saved payment methods to avoid unapproved purchases.

Signing you out of Claude stops the stolen sessions, but it doesn't remove the malware. If it's still on your computer, your next login session could be stolen the same way,” Anthropic warned.

How to stay safe?

  • Impacted users can follow basic security steps such as:
  • Changing passwords
  • Removing malware from the PCs
  • Stopping other sessions

Read more »
Subscribe to: Posts (Atom)

Featured