Four Days From Patch to Weaponized (09/01/2026)

Four days. That is the interval between JFrog shipping a patch on August 28 and attackers weaponizing the flaw today. If your artifact repository is reachable from the internet and you have not applied 7.161.20, that window has already closed.

Top 5 Critical Security Alerts

1. A 9.8 in Artifactory Mints Admin Tokens Without Credentials

CVE-2026-82329 is an authentication weakness in JFrog Access that, under default configuration, lets an unauthenticated attacker with network access forge credentials and generate administrator-level tokens. Affected builds span 7.111.4 through 7.161.19 across six release branches, with 7.161.20 shipping August 28. Exploitation began September 1, with operators generating admin tokens and enumerating users, groups, credential sets, and federated access topologies. JFrog’s guidance is to patch internet-exposed systems immediately, inspect audit logs, rotate exposed credentials, and review connected systems for changes. The Hacker News

Operator Note: The enumeration step is the tell, because it is reconnaissance for binary tampering rather than for data theft. An attacker with admin on your artifact repository can modify what your pipeline ships, and that reaches every system you deploy to. Patch first, then treat the credential rotation as mandatory rather than precautionary, since the flaw hands over exactly the tokens you would otherwise trust.

2. Iranian Operators Are Posing as Recruiters

The campaign approaches targets as recruiters and delivers cross-platform remote access tools inside coding tests, which arrive as a normal part of a hiring process the candidate has agreed to. The Hacker News

Operator Note: This is the second recruiter-shaped campaign we have carried in a week, after the phishing kit that rejected personal email addresses, and the coding test is a sharper delivery mechanism than a login page. A candidate expects to run unfamiliar code, on their own machine, without telling anybody. Our piece on the recruiter who only wants your work email covers why nobody reports these.

3. Thirteen Malicious Packagist Packages Target iPhone Wallets

The packages target unpatched iPhones to steal cryptocurrency wallet seed phrases. Packagist is the PHP package registry, so the delivery path runs through developer dependencies rather than an app store. The Hacker News

Operator Note: A seed phrase is the one credential with no reset path, which makes this materially worse than an account compromise. The registry angle matters more for most organizations: this is the third package ecosystem story in two weeks, after the npm CAPTCHA hosting and the browser extensions, and none of those are covered by the software composition tooling most teams already run.

4. Breeze Comet Runs Hundreds of Fraudulent Brazilian Payment Transactions

The group executed hundreds of fraudulent transactions through Brazilian payment systems. The volume is what distinguishes this from ordinary card fraud in the region. The Hacker News

Operator Note: Payment fraud at this volume usually means the operators found a process gap rather than a technical flaw, since a technical flaw tends to get closed after the first few attempts. If you operate in any instant-payment market, the control worth checking is what your velocity limits do when a legitimate-looking merchant suddenly transacts at ten times its baseline.

5. Nutex Confirms Patient and Employee Data Theft

The healthcare facilities operator has confirmed that patient and employee data was stolen in an August incident, which we first carried on August 25 when the company disclosed it was investigating. The Record

Operator Note: A week between disclosing an investigation and confirming data theft is a normal timeline and it is also the window in which affected people learn nothing. If you are ever on the disclosing side, decide in advance what you will say during that gap, because saying nothing is itself a decision that gets read as evasion.

Additional Security Alerts

Threat Intelligence

• Leaked Russian cyber-operations training materials have surfaced: Primary material on how an adversary trains its own people is rare enough to be worth reading directly. Schneier on Security
• Threat actors want repeatable attacks rather than better ones: A useful corrective to the sophistication framing, and it matches what CISA said last week about decades-old defect classes. The Hacker News

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.