Another Artifactory CVE under attack by AI agents or humans

Unauthenticated intruders can mint admin tokens, and exposed servers are already being hit

security Researcher shows how Claude Code can be tricked simply by asking it to summarize a website

Researcher shows how Claude Code can be tricked simply by asking it to summarize a website

virtualization Broadcom pledges to lock down open source Python, Java libraries

Broadcom pledges to lock down open source Python, Java libraries

science German-Japanese researchers invent electricity-free tech that could cool datacenters

German-Japanese researchers invent electricity-free tech that could cool datacenters

NETWORKS A lot of datacenter networks are run by absolute clowns. Not Amazon's

A lot of datacenter networks are run by absolute clowns. Not Amazon's

ai and ml OpenClaw 2.0 pours glitter on slow-burning security dumpster fire

OpenClaw 2.0 pours glitter on slow-burning security dumpster fire

Security researchers reported that someone is exploiting CVE-2026-82329, a critical JFrog Artifactory authentication-bypass bug, just days after the vendor patched the 9.8-rated flaw. And we don't know if that someone is human.

Artifactory is a widely used tool for managing software artifacts, packages, binaries, and AI models. It’s also popular with AI agents that go rogue and need to communicate with each other while remaining undetected by their human babysitters.

In July, OpenAI and JFrog revealed that OpenAI’s models broke out of their cages to hack Hugging Face by exploiting Artifactory zero-days , and at Black Hat, the model provider said agents used Artifactory to build message boards and help each other access the open internet.

JFrog disclosed CVE-2026-82329 on Friday, and by Tuesday, attackers had already begun exploiting internet-exposed systems, according to exposure-management biz watchTowr’s threat-intel team, which reported “attackers minting themselves admin tokens.”

In addition to creating new administrative credentials, watchTowr’s honeypot network caught miscreants “enumerating users, groups, credential sets and federated access topologies,” Yordan Ganchev, principal threat intelligence specialist at watchTowr, told The Register .

“Right now, we’re observing exploitation from a small number of IP addresses from varying geographies exploiting multiple of our honeypots,” Ganchev said. “Broad-scale scanning and mass exploitation has not been observed, but that is unlikely to stay the case for long.”

Ganchev urged organizations running vulnerable versions to “urgently patch” internet-exposed systems, and treat them as being potentially compromised - so inspect audit logs, rotate credentials, and investigate connected systems for any unusual changes or backdoor implants.

“When attackers gain admin level access to a central software supply chain system, they can do what every engineering team does best - build, ship and distribute software fast,” he said. “From there, they could tamper with build pipelines, move laterally into production systems and potentially push malicious changes downstream to customers.”

JFrog did not immediately respond to The Register ’s inquiries. We will update this story when we receive any response. ®

Another Artifactory CVE under attack by AI agents or humans

Unauthenticated intruders can mint admin tokens, and exposed servers are already being hit

Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks

The model provider gave METR the credits for free. An actual customer would not have been so lucky

Platform Engineering 2.0: your platform was built for a different era. AI just exposed it

PARTNER CONTENT: Platform engineering won the argument. Now it has to grow up fast and evolve for the AI era.

Firefox helps iPhone users bypass ads on web sites while making money showing its own ads

Baked-in Firefox ad blocking on iOS begins rolling out slowly today, and is off by default

The teen Bill Gates has answers to the AI-pocalypse the 70-year-old Gates has forgotten

Hacking education to thrive in the AI world is the first and best step in keeping control

Anthropic pledges to try harder to keep models under control, asks partners to chip in

Security ... this time it will be different

security Researcher shows how Claude Code can be tricked simply by asking it to summarize a website

Researcher shows how Claude Code can be tricked simply by asking it to summarize a website

virtualization Broadcom pledges to lock down open source Python, Java libraries

Broadcom pledges to lock down open source Python, Java libraries

security Security vets rally around $4 paper password books for sale in Australia

Security vets rally around $4 paper password books for sale in Australia

science German-Japanese researchers invent electricity-free tech that could cool datacenters

German-Japanese researchers invent electricity-free tech that could cool datacenters

Legal Nuisance-call blocker fined £190k for being a nuisance caller

Nuisance-call blocker fined £190k for being a nuisance caller

AI and ml Apple defies memory shortage with new Mac minis

Apple defies memory shortage with new Mac minis

Security Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks The model provider gave METR the credits for free. An actual customer would not have been so lucky

Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks

The model provider gave METR the credits for free. An actual customer would not have been so lucky

ai and ml Anthropic pledges to try harder to keep models under control, asks partners to chip in Security ... this time it will be different

Anthropic pledges to try harder to keep models under control, asks partners to chip in

Security ... this time it will be different

SYSTEMS Nvidia is building an IP licensing empire on the back of NVLink Even when you think you're not buying Nvidia, you might still be buying Nvidia

Nvidia is building an IP licensing empire on the back of NVLink

Even when you think you're not buying Nvidia, you might still be buying Nvidia

ai and ml Energy biz SSE smacked around in court by a guy and AI Company's three year pursuit of debt from non-existent address ended by Oxford judge

Energy biz SSE smacked around in court by a guy and AI

Company's three year pursuit of debt from non-existent address ended by Oxford judge

security Industry that built the problem offers to sell you the solution 100+ tech giants warn AI attacks are coming, skip the part where they pay for defenses

Industry that built the problem offers to sell you the solution

100+ tech giants warn AI attacks are coming, skip the part where they pay for defenses

Security Russians are posing as Signal support to launch phishing attacks PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!

Russians are posing as Signal support to launch phishing attacks

PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!

Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more

Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack

PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more

Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructure Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included

Black Hat and DEF CON

DEF CON Franklin project enlists hackers to harden critical infrastructure

Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included

Security EQT buys majority in Swiss cybersecurity biz Acronis Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified

EQT buys majority in Swiss cybersecurity biz Acronis

Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified

Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight On the plus side, infosec's a good bet for a long, stable career

Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight

On the plus side, infosec's a good bet for a long, stable career

Debian votes to let contributors code with AI Disclosure optional, quality mandatory

Debian votes to let contributors code with AI

Disclosure optional, quality mandatory

LibreOffice 26.8 is out – local first, and with no AI It looks a bit clunky, but it does the job – and on your own computer

LibreOffice 26.8 is out – local first, and with no AI

It looks a bit clunky, but it does the job – and on your own computer

Keepers of Noble Numbats to be offered a Resolute Racoon: Ubuntu 26.04.1 is coming GRUB's up for furry new update

Keepers of Noble Numbats to be offered a Resolute Racoon: Ubuntu 26.04.1 is coming

GRUB's up for furry new update

AROS, the FOSS recreation of AmigaOS, comes to Raspberry Pi Plus: new official Amiga-branded hardware is coming

AROS, the FOSS recreation of AmigaOS, comes to Raspberry Pi

Plus: new official Amiga-branded hardware is coming

Emperor Penguin Linus Torvalds banishes a bug – with a bot The lad himself finds and fixes a tricky one… or does he?

Emperor Penguin Linus Torvalds banishes a bug – with a bot

The lad himself finds and fixes a tricky one… or does he?

FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash another Word up

FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash another