CRITICAL/ SEPTEMBER 2, 2026TODAY’S BRIEFING — #166
JFrog Artifactory, Langflow critical flaws exploited; TeamPCP arrested
JFrog Artifactory CVE-2026-82329 (CVSS 9.8) exploited to mint admin tokens; Langflow CVE-2026-0768 RCE active for API key theft. Two alleged TeamPCP supply-chain attackers arrested in Australia. iOS spyware campaign harvesting wallet seeds.
CVE-2026-82329JFrog Artifactory — Authentication bypass (CVSS 9.8) enabling admin token minting; actively exploited in the wildCVE-2026-0768Langflow — Unauthenticated RCE; actively exploited to steal OpenAI and AWS credentialsCVE-2026-82078Papercut Mf — Unsafe Reflection; chained with CVE-2026-81578; CISA KEV added 2026-08-31CVE-2026-81578Papercut Mf — Missing authentication for critical function; unauthenticated configuration modification; CISA KEV added 2026-08-31
Read the full briefing →