erroneo.us
Search all guides⌘K

Digest · Friday

Security digest: August 28, 2026

1 editorial brief and 10 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: JFrog Artifactory: Exploited Auth Bypass to Admin (KEV). Every team running self-managed JFrog Artifactory 7.x below 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20, especially instances reachable from the internet or from untrusted build workloads.
  • Go: 3 critical advisories (github.com/free5gc/free5gc, github.com/klever-io/klever-go). Check with govulncheck ./....
  • Maven: 3 critical advisories (org.yamcs:yamcs-core). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • PyPI: 2 critical advisories (plone.app.portlets, plone.app.event). Check with pip-audit (or: pip show <package>).
  • Composer (PHP): 2 critical advisories (pimcore/pimcore). Check with composer audit.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2026-82329, CVE-2026-42018

JFrog Artifactory: Exploited Auth Bypass to Admin (KEV)

If you run self-hosted Artifactory below the fixed builds, treat it as exploited until shown otherwise: upgrade, then hunt for rogue admins, Groovy plugins and stolen signing keys, because patching does not remove them.

Must act: Every team running self-managed JFrog Artifactory 7.x below 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20, especially instances reachable from the internet or from untrusted build workloads.

Can relax: Teams already on the fixed builds who have checked for persistence; JFrog's advisories list only self-managed releases, so SaaS customers should confirm their status with JFrog rather than assume either way.

  1. Upgrade every self-managed Artifactory node to 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20 or later for your branch.
  2. Until patched, remove internet exposure and restrict access to trusted networks and build systems.
  3. List user plugins in $JFROG_HOME/var/etc/artifactory/plugins/ and remove anything you did not deploy; restart the JVM to clear in-memory implants.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 10

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Go 3

Check: govulncheck ./...

Maven 3

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

Composer (PHP) 2

Check: composer audit

PyPI 2

Check: pip-audit (or: pip show <package>)