Stay updated with the latest cybersecurity news. This daily roundup covers critical vulnerabilities now being exploited in the wild, major healthcare and identity-data exposures, supply-chain attacks, and nation-state campaigns targeting developers. Patch quickly, rotate secrets, and treat untrusted “IT support” and “job assessment” files as hostile.
1. Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens
Published: 2026-09-01
Threat actors are exploiting CVE-2026-82329 (CVSS 9.8), an authentication-bypass bug in JFrog Artifactory, only days after disclosure and the August 28 patch. Under default configuration, a “phantom” join key can be abused to forge access and mint administrator tokens, enumerate users and credentials, and threaten software supply chains. Affected branches include 7.161.x through 7.161.19 and several older maintained lines. Upgrade immediately to 7.161.20 or the fixed build for your branch.
2. Critical Langflow RCE Exploited to Steal OpenAI and AWS Keys
Published: 2026-09-01
Unauthenticated remote code execution in Langflow’s custom-component code validator, CVE-2026-0768 (CVSS 9.8), is being used to harvest environment secrets. VulnCheck honeypots recorded exploitation ramping from 50+ attempts over the weekend to about 360 by Monday, with traffic mainly from Russia. Attackers query LANGFLOW_SUPERUSER, OPENAI_API*, and AWS_ACCESS* / AWS_SECRET*, read /root/.cache/langflow/secret_key, and check SSH and bash history. Treat exposed Langflow instances as compromised, upgrade (researchers point to a fix that removed the dangerous exec() path), and rotate cloud and LLM keys.
3. Aesto Health Breach Hits 9.5 Million Patients
Published: 2026-09-01
Alabama healthcare-data vendor Aesto Health reported to HHS that 9,540,683 people were affected after attackers accessed part of its AWS environment between December 2 and December 18, 2025. Stolen or accessed data can include names, dates of birth, SSNs, driver’s licenses, financial account numbers, medical and insurance records, and taxpayer IDs. At least two dozen provider clients were impacted. The incident is among the largest confirmed U.S. healthcare breaches of 2026. Patients should watch for medical-identity fraud and enroll in the offered credit monitoring.
4. Nearly 22,000 Microsoft Exchange Servers Still Exposed to Mailbox Takeover
Published: 2026-09-01
Shadowserver counted 21,899 internet-facing Exchange servers still unpatched for CVE-2026-62911, an authentication capture-replay / elevation-of-privilege flaw patched in August 2026 Patch Tuesday. Successful abuse can let attackers take over every mailbox on the server, send and read mail, and download attachments. A public PoC is circulating; NCSC-NL and Germany’s BSI have warned operators to patch now. Exchange 2016/2019 only receive the fix via paid Extended Security Updates. Isolate leftover on-prem servers from the internet and migrate off end-of-support builds.
5. FBI Probes Dark-Web Shop Selling 153 Million Driver’s Licenses
Published: 2026-09-01
A new Exploit-forum service branded “Nexus” is selling scans of more than 153 million U.S. and Canadian driver’s licenses, plus millions of other IDs and travel documents. KrebsOnSecurity traced the images to data collected by Louisiana identity-verification firm idscan.net; the FBI’s New Orleans field office opened an investigation. Listings reportedly include licenses for senior U.S. officials. Anyone who used ID-scan or similar KYC services should assume document images may be in circulation and freeze credit where available.
6. Iranian Hackers Use Fake Coding Tests to Drop Cross-Platform RATs
Published: 2026-09-01
Iran-linked Mirage Kitten (also tracked as Nimbus Manticore) is posing as recruiters on LinkedIn and sending time-boxed “take-home” coding challenges that hide two new RATs: Node.js-based NodeRabbit and obfuscated JavaScript PollCat. Targets include developers in aviation, aerospace, and fintech across the Middle East and Africa. Archives look like Express/React/Vite projects; malware can start before the victim finishes the fake OTP challenge and runs on Windows, Linux, and macOS. Never run unsolicited assessment ZIPs on a work machine; review them in an isolated VM.
7. BGP Hijack Pushes Malicious Virtualizor Update to Hosting Servers
Published: 2026-09-01
From about 20:57 UTC on August 28 to 06:10 UTC on August 30, attackers announced a more-specific Hetzner prefix (162.55.80.0/24) and diverted Softaculous / Virtualizor update and billing traffic. They obtained valid Let’s Encrypt certs for Virtualizor domains, so clients saw no TLS warning. Because update packages were not cryptographically verified, a small number of installations received a malicious update that could run as root on hypervisors. Softaculous restored routing, shipped Virtualizor 3.2.9.9 with a Security Analyzer, and told operators to rotate credentials and hunt for IoCs such as java-jre-update.service.
8. Phishers Abuse Faronics Deploy to Install ScreenConnect
Published: 2026-09-01
Huntress tracked invoice- and tax-themed phishing that enrolled more than 457 endpoints into the legitimate Faronics Deploy cloud management platform between July 21 and August 20. Once the agent was installed, attackers used remote scripting (PowerShell, curl, mshta, msiexec) to drop ConnectWise ScreenConnect, giving a second hands-on remote-access channel if the Faronics agent is later removed. Block unexpected RMM enrollments, alert on new ScreenConnect installs, and treat “please install this management agent” emails as high-risk.
Stay Vigilant
This week’s pattern is familiar and getting faster: public CVEs are weaponized in days, AI and developer tooling is treated as a credential vault, and attackers keep hiding inside trusted software (Artifactory, Exchange, RMM, VPS update channels, coding tests). Priorities for the next 24–48 hours:
- Patch JFrog Artifactory, Langflow, Exchange, PaperCut, and any internet-facing RMM or VPS panel.
- Rotate OpenAI, AWS, and other secrets stored in AI workflow tools.
- Hunt for unexpected ScreenConnect, Faronics Deploy, or unsigned “update” services.
- Warn developers that LinkedIn coding tests are an active delivery path.
Subscribe for the next daily roundup, keep backups offline and tested, and do not install remote-admin tools from email. Stay safe online.