The Watch

CSO First Look reports the JFrog Artifactory flaw was exploited in the wild to generate admin tokens. The consequence is provenance, not server control. An attacker holding an admin token can publish or replace artifacts that CI/CD consumes and deploys without complaint, because every downstream integrity check trusts the repository. Applying the fix leaves the minted tokens minted and the binaries unverified. For anyone who ships software, that drags contractual disclosure and breach-notification questions into what reads like a routine change ticket.

Two Artifactory CVEs

The sources diverge here, and it is worth reading slowly. Risky.Biz lists CVE-2026-82329, improper authentication, exploited in the wild and now in KEV. SANS separately records CVE-2026-66384, a path traversal in Artifactory added to KEV on 2026-08-27. Two distinct entries against the same product in the same window. A ticket that cites only one CVE scopes half the problem.

Why the scanner misses this list

Risky.Biz makes the structural point. LiteLLM, Kestra, Artifactory and Starlette sit in engineering's deployment inventory, not IT's. They are frequently self-hosted on internal subnets treated as trusted, they rarely carry an EDR agent, and one of them is a library rather than a product. SANS adds same-shape KEV entries for Gitea (listed 2026-08-25), ownCloud CVE-2023-49105, PaperCut NG/MF (CVE-2026-82078 and CVE-2026-81578, one of them missing authentication on a critical function), Adobe ColdFusion CVE-2026-48282 and Citrix NetScaler CVE-2026-8452. Across three independent accounts, the exploited entries cluster in build and package infrastructure rather than at the perimeter.

A KEV entry against your artifact registry puts every build inside the exposure window into question. The open item is which recent builds you can still prove you authored.

The order that holds up

Patching first and hunting later is how six-month dwell times begin on an actively exploited asset. The sequence that survives an audit is revoke, verify, patch, hunt. Every Artifactory access and admin token gets revoked and reissued, because the credential outlives the bug. Checksums, signatures and provenance attestations get verified on anything published or modified inside the exposure window, alongside a map of which production deployments consumed those artifacts. Unverifiable artifacts belong in the compromised column. Token-creation and admin-privilege logs get audited back to the earliest plausible exploitation date.

CSO First Look and CSO Update both note that exploitation reporting does not always bind cleanly to vendor PSIRT advisory IDs and affected version ranges. The primary advisories are the record of what is actually affected, which matters once these CVE numbers land in a board slide or an insurance questionnaire.

The count decides the response, not the exploit. Risky.Biz reports one researcher published working local privilege-escalation code against CrowdStrike Falcon, Microsoft Defender, Avast and Kaspersky. The Falcon variant circulates as "FalconFlank," and proof-of-concept code sits on public GitHub. Four vendors from one researcher points at how kernel-adjacent security agents are built rather than at a defect in one product. Swapping vendors does not address that.

Where the sources disagree, and why it matters

Risky.Biz treats it as a P1, detection-first item and recommends validating detections against the public PoC in a lab. The Hacker News is markedly more cautious: no CVE identifier, no CVSS score, no vendor advisory, disclosure that was not coordinated, and a researcher operating under four aliases. Its recommendation is to hold the item with the CrowdStrike TAM rather than escalate, on the grounds that a hype-driven false alarm on an in-house EDR spends credibility that will be needed later.

Both readings converge on the same near-term work: sensor version currency, tamper protection and uninstall-token enforcement at 100% measured at the endpoint rather than at policy level, and telemetry on tier-1 assets that does not depend on the agent under discussion. All of it is worth having whether or not the claim holds.

If the only witness to a compromise is the agent the attacker escalated through, the vendor's word is the only account available.

The rest of the control plane is worse

SANS supplies the items that carry actual CVEs and are getting less attention. Wazuh CVE-2026-61800 is root remote code execution across versions 4.4.0 through 4.14.6, rated CVSS 9.1. A Wazuh instance acting as SIEM or agent manager collects from everything and is trusted by everything, which makes it the highest-value target in most estates. Kyverno CVE-2026-54523, at 9.6, is privilege escalation in the Kubernetes admission controller, so the policy guarantees and the compliance evidence resting on them can be defeated without producing a log line. Also on the list: GitPython below 3.1.59 in CI images, and rsync below 3.5.0 on daemon-mode backup paths.

And a campaign that turns the controls off first

The Hacker News documents a live campaign that disables Windows Update and weakens Defender before doing anything else. The campaign does not evade the baseline, it lowers it permanently: the host stays soft for the next intruder too. It also produces cheap, high-signal detections that depend on no unverified exploit claim. Detection candidates: wuauserv start-type changes, Defender Event ID 5007 configuration changes, and newly created exclusion paths.

The strategic read across all three accounts is specific. Any 2026 defense-in-depth model that assumes EDR and OS patching survive intact through an incident needs re-validation. Single-vendor endpoint reliance is a concentration risk with a public exploit attached.

Document authentication rests on an asymmetry. The fraudster sees the front of the card. The verifier sees the covert layers. The Nexus corpus removes that asymmetry for 153 million people. The records included infrared and ultraviolet captures, the security-feature layers verification systems read to decide a document is genuine. The proof of authenticity was sold alongside the identity. The market went dark hours after Krebs on Security published; the corpus is now circulating in private hands.

The dependency that does not appear in the inventory

The FBI's New Orleans field office is investigating IDScan.net after timestamps from the firm's customers matched leaked scans. The firm runs roughly 21 million identity checks per month for clients including Hertz, Target and more than 1,000 cannabis dispensaries. Techpresso makes the fourth-party point that matters at the register: the provider can arrive through a reseller, a franchisee, an age-gating widget or an OEM-embedded SDK. Most vendor inventories will not list it at all.

The detection gap is the ugly part. A replayed authentic scan returns a clean verdict from the vendor, with no signal in the verification log. What stays observable is behavior: new-device login paired with ID re-verification, repeat verification attempts across accounts, clean document scores arriving from residential-proxy address space, abnormal shifts in age-gate approval rates.

Caller ID and voice, same week

Risky.Biz supplies the evidence that this is not theoretical. ShinyHunters vished their way into Jack Henry, a bank IT provider, with 7,200-plus customers notified. In the same window the adversary-in-the-middle phishing market scaled faster than takedowns. Outsider returned with 700-plus new pages after a Google lawsuit. Knight Office is in the wild, and BlueKit is under simultaneous analysis by four vendors. An authentic IR/UV-complete scan combined with commodity voice cloning satisfies the automated document check and the human agent behind it.

Every control we report as "we can spot a fake ID" is a control we have already lost, and continuing to report it is the larger failure.

The move

The fix is a policy change with near-zero capital cost. Document-image submission and caller ID stop counting as sufficient factors anywhere in account recovery, privileged password resets, MFA resets and payment-detail changes. The replacements are in-person proofing, manager attestation over a separate channel, authoritative DMV verification services, or cryptographic credentials such as mobile driver's licenses under ISO 18013-5. Shops that have run a vishing pass against the new policy have a baseline number. The rest have an assumption.