Today's cybersecurity landscape is marked by urgent exploitation of critical vulnerabilities in widely used software, with attackers swiftly moving to leverage newly disclosed flaws. We also see major data breaches impacting millions of individuals and sophisticated threat actor campaigns targeting various sectors.
Critical JFrog Artifactory Flaw Actively ExploitedVulnerability
Threat actors are actively exploiting a critical authentication bypass vulnerability (CVE-2026-82329) in JFrog Artifactory, a popular software repository. This flaw, with a CVSS score of 9.8, could allow attackers to gain administrative access just days after its public disclosure. Security researchers have confirmed ongoing exploitation attempts.
Why it matters: If you use JFrog Artifactory, immediately apply the latest patches to prevent unauthorized administrative access to your software repositories.
Read more at The Hacker News ↗
Langflow AI Platform Vulnerability ExploitedVulnerability
A critical remote code execution flaw (CVE-2026-0768) in Langflow, an open-source framework for building AI applications, is being actively exploited. Attackers are leveraging this vulnerability to steal credentials, tokens, and sensitive API keys, including those for OpenAI and AWS. The flaw allows unauthenticated attackers to execute arbitrary Python code.
Why it matters: If your website or business uses Langflow, patch immediately to prevent credential theft and unauthorized access to your AI development environment.
Read more at BleepingComputer ↗
SonicWall SMA1000 Zero-Days Under AttackVulnerability
SonicWall has issued a warning about two zero-day vulnerabilities (CVE-2026-83549 and CVE-2026-83548) affecting its SMA1000 remote access appliances. These flaws can be chained together by attackers to achieve unauthenticated remote code execution. SonicWall is urging customers to apply updates to mitigate the risk.
Why it matters: If your business uses SonicWall SMA1000 devices, prioritize applying available patches to prevent potential remote code execution and unauthorized network access.
Aesto Health Data Breach Impacts Over 9.5 Million PatientsBreach
Aesto LLC, operating as Aesto Health, has disclosed a significant data breach affecting more than 9.5 million individuals. The incident involved the theft of personal and health information from the healthcare technology company's AWS infrastructure. Details about the exact nature of the compromised data were not fully specified beyond patient information.
Why it matters: Healthcare providers or businesses using third-party services like Aesto Health should verify their vendors' security practices and have incident response plans for supply chain breaches.
Read more at BleepingComputer ↗
New Dark Web Service Selling 153 Million Drivers LicensesBreach
A new service has appeared on the dark web offering digital scans of over 153 million drivers licenses from individuals in the United States and Canada. The data appears to have been siphoned from a widely used identity verification company based in Louisiana. The FBI's New Orleans field office has initiated an official inquiry into the source of these images.
Why it matters: Small businesses that collect or process identity documents should be aware of the increased risk of identity theft and ensure robust security measures are in place for sensitive data.
Read more at Krebs on Security ↗
Ransomware Gang Claims Nutex Health BreachRansomware
Nutex Health, a healthcare facilities operator, has confirmed a cyber incident in August where patient, employee, and business data was stolen, followed by an extortion attempt by a ransomware gang. The company has filed disclosures with federal regulators regarding the breach. Specific details about the ransomware group were not immediately available.
Why it matters: Ransomware attacks continue to target healthcare; small healthcare practices must implement strong backups, network segmentation, and staff training to protect sensitive patient data.
METR AI Research Non-Profit Suffers Credential TheftBreach
METR (Model Evaluation and Threat Research), a non-profit evaluating frontier AI models, disclosed two security incidents involving unauthorized access attempts. In one instance, attackers stole an API key, resulting in approximately $600,000 worth of public AI model credits being consumed. No sensitive information is believed to have been compromised.
Why it matters: Businesses utilizing AI services should treat API keys as highly sensitive credentials and implement strong access controls, monitoring, and rotation policies to prevent costly misuse.
Read more at The Hacker News ↗
Iranian Hackers Deliver Cross-Platform RATs Through PhishingThreat
The Iranian Nimbus Manticore hacking group is using newly discovered cross-platform Remote Access Trojans (RATs) developed with Node.js and JavaScript. They employ a phishing tactic, posing as recruiters and delivering the malware through fake coding tests, expanding their targeting to include Linux and macOS systems. This indicates an evolution in their toolset and reach.
Why it matters: Be highly suspicious of unsolicited recruitment emails, especially those requiring you to download or execute code; always verify the legitimacy of senders and attachments.
Read more at The Hacker News ↗
Malicious Packagist Packages Target iPhones for Crypto TheftThreat
Researchers have found 13 malicious Composer theme packages on Packagist designed to inject JavaScript into Vietnamese movie and comic streaming sites. When these libraries are installed, the injected code deploys spyware on unpatched iOS devices, primarily aimed at stealing cryptocurrency wallet seeds. The code also facilitates mobile ad-fraud and gambling redirects.
Why it matters: Website owners must be cautious when integrating third-party libraries; vet all packages, keep software updated, and regularly scan your site for malicious injections to protect visitors.
Read more at The Hacker News ↗
Nearly 22,000 Microsoft Exchange Servers Remain VulnerableVulnerability
Despite a critical patch being available, almost 22,000 Microsoft Exchange servers exposed online have not addressed a high-severity authentication bypass vulnerability. This flaw allows attackers to completely hijack user mailboxes, posing a significant risk to organizations still running unpatched versions. The persistent vulnerability highlights slow patch adoption.
Why it matters: If your business uses Microsoft Exchange, prioritize patching this authentication bypass immediately to prevent attackers from taking over user mailboxes and accessing sensitive data.
Read more at BleepingComputer ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.