Today’s digest is a reminder that trust boundaries keep moving: a repo manager’s default configuration handed out admin access, a developer’s own AI coding assistant became the attack surface, and a fresh batch of CISA-confirmed exploited flaws spans everything from a firewall appliance to an LLM proxy. Here’s what’s new since yesterday’s digest.
Vulnerability watch: Attackers exploit critical JFrog Artifactory auth bypass to forge admin tokens
JFrog disclosed CVE-2026-82329 on August 28 — an authentication weakness in self-managed Artifactory instances that lets an unauthenticated attacker with network reachability generate their own administrator token. Instances that never set a join key receive a “phantom” one by default, and attackers who obtain it can mint valid admin credentials outright. WatchTowr reported active exploitation starting September 1, with attackers using forged tokens to enumerate users, groups, and federated access topologies; read stored artifacts; alter security configuration; and potentially poison packages flowing downstream to every consumer of that Artifactory instance. JFrog Cloud environments were unaffected — this is a self-hosted-only issue. Fixed versions are 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20, and later. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 2. SecurityWeek · BleepingComputer · The Hacker News
If you run a self-managed Artifactory instance, patch today and don’t stop there — a forged admin token can rewrite security settings and tamper with artifacts your build pipelines already trust, so treat this as a potential software-supply-chain incident, not just an access-control bug. Audit recently created tokens and any package pushed or modified since August 28.
AI security watch: Malicious .git configs can hijack Claude Code, Cursor, and other AI coding agents
Manifold Security disclosed eight flaws across seven command-line AI coding agents, all rooted in the same mechanism: core.fsmonitor, a legitimate Git performance setting that names a command Git runs to detect changed files, is read straight out of a repository’s own .git/config. Any routine operation that refreshes the index — including git status and git diff — executes that command, outside the agent’s sandbox and without a user-approval prompt. Because exploitation only requires a repository to arrive on disk with its .git directory intact — cloning a malicious repo, or even unzipping one — an attacker-controlled command runs with the developer’s full privileges the moment the agent touches it. Fixes have shipped for Goose, Claude Code, and Cursor; Hermes Agent, Qwen Code, Grok Build, and a second affected path in Claude Code were still executing repository-supplied commands when Manifold retested on September 1. The Hacker News
If your engineers use any AI coding agent against untrusted or third-party repositories — including a “just cloning it to look” one-off — confirm the agent is on a patched build before the next git status runs against it. This is a good moment to also check what your endpoint telemetry would actually show if a core.fsmonitor command spawned a shell on a developer laptop today.
Patch watch: CISA adds seven actively exploited flaws to KEV, including two new SonicWall SMA1000 bugs
CISA added seven vulnerabilities to its Known Exploited Vulnerabilities catalog on September 2, all confirmed under active exploitation: a SQL injection in Sangoma Switchvox (CVE-2026-9586), an HTTP request/response smuggling flaw in the Starlette framework (CVE-2026-48710), an OS command injection in Kestra OSS (CVE-2026-49869), an improper-authentication issue in BerriAI’s LiteLLM proxy (CVE-2026-59822), the JFrog Artifactory bypass above (CVE-2026-82329), and two new SonicWall SMA1000 flaws — an SSRF (CVE-2026-83548) and an OS command injection (CVE-2026-83549) — distinct from the SMA1000 zero-days chained earlier this year. Federal agencies are on the standard BOD 22-01 remediation clock for each. CISA
SonicWall’s SMA1000 line has now had multiple, unrelated CVEs added to KEV within a matter of weeks — if you run this hardware, don’t assume last patch cycle covers you; re-check your current firmware version against SonicWall’s latest advisory specifically. For the LiteLLM and Starlette flaws, remember these sit inside application dependencies your teams may not track as closely as first-party code — confirm your SBOM or dependency scanning actually surfaces them.
Final thought
Three stories, one theme: the systems we trust by default — a repo manager’s default join key, a developer tool reading config out of the very repo it’s about to operate on, an internet-facing appliance — keep turning out to be exactly where attackers look first. None of today’s fixes require new tooling, just faster patching and a willingness to re-verify configuration you assumed was safe. If you want a second set of eyes on your patch cadence or AI-tooling exposure, see our how-to guides or book a discovery call.