JFrog Security

The JFrog Security Research Team empowers developers and companies to excel by identifying, prioritizing, and mitigating software risks.

[JFrog Security @JFrogSecurity]

Read the full research and technical details: https://t.co/Zz6cnSojNq

[JFrog Security @JFrogSecurity]

🚨 Ongoing fake interview campaign uncovered.

Applied for a job lately? Be careful with that take-home test.
A single laptop compromised during a job interview reportedly kicked off the $6.3B Binance hack.

JFrog Security Research just tracked a live fake-interview scam from start to finish.
Scammers built an entire fake company just to trick engineers into running a malicious take-home test.

[JFrog Security @JFrogSecurity]

🚨 One HTTP request is all it takes to hijack an AI robot.

JFrog Security Research found 5 CVEs in Reachy Mini, enabling unauthenticated RCE, root escalation, and physical takeover over local Wi-Fi or BLE. 🤖

Full technical analysis + PoC video 👇
https://t.co/8lv5T10dfP

[JFrog Security @JFrogSecurity]

https://t.co/wiYm0NCNKX

[JFrog Security @JFrogSecurity]

One skipped byte -> account takeover.

🚨 Vert.x skips validating the letter 'L', treating `Content-Xength` as a valid `Content-Length` (CVE-2026-102479).

JFrog Research weaponized this "byte debt" with a dangling-byte primitive to bypass reverse proxy socket validation, demonstrating end-to-end response poisoning and session fixation behind real reverse proxies.

Full exploit mechanics and affected open-source projects in our writeup 👇

[JFrog Security @JFrogSecurity]

🚨 testmetest goes beyond npm.
JFrog Security Research identified 42 armed GitHub repositories across 11 legitimate owners hiding an npm publisher, plus a new native addon that decrypts its payload at runtime and stays dormant in CI, sandboxes, and analysis tools.

The campaign spans 25 npm package names. Check whether you installed any testmetest or @iobandamwer packages and remove them if found.

Full analysis: https://t.co/oLtvs4L3wU

[JFrog Security @JFrogSecurity]

🔎 Read the full research and technical details:
https://t.co/fL1OLPEsiX

🛠️ Get the open-source Brotli2Shell scanner:
https://t.co/BaVmemtCgt

[JFrog Security @JFrogSecurity]

🚨 Brotli2Shell goes beyond HTTP2Shell.

CVE-2026-111497 is a CVSS 9.2 out-of-bounds write in Google’s Brotli decoder that has been exploited for RCE and impacts far beyond HTTP.

JFrog reproduced RIP control in FFmpeg via a crafted JPEG XL file and identified additional attack paths in ClickHouse, .NET, and Apache Arrow, where some fixes were still unavailable at the time of writing.

We’ve also released an open-source scanner to uncover potential exposure beyond vulnerable package versions.

Full research and technical details in our blog 👇

[JFrog Security @JFrogSecurity]

We are actively monitoring Node2Shell / CVE-2026-111497. Xray customers can easily check if they are impacted through Xray Threat Hub or Xray Impact Search. JFrog Advanced Security customers can further check impact through Contextual Analysis

[JFrog Security @JFrogSecurity]

🔎 We break down the LiteLLM hijacking, the attack details, and what you need to know in our blog 👇
https://t.co/xZI8jcqLm2

[JFrog Security @JFrogSecurity]

🚨 JFrog Security Research has identified a supply-chain attack involving malicious code in the LiteLLM 1.107.0 PyPI release. Avoid this version and investigate environments where it was installed or executed. More details will be shared soon in our blog post.

[JFrog Security @JFrogSecurity]

🔎 We break down the LiteLLM hijacking, the attack details, and what you need to know in our blog 👇
https://t.co/xZI8jcrjbA

[JFrog Security @JFrogSecurity]

🚨 JFrog Security Research has identified a supply-chain attack involving malicious code in the LiteLLM 1.107.0 PyPI release. Avoid this version and investigate environments where it was installed or executed. More details will be shared soon in our blog post.

[JFrog Security @JFrogSecurity]

🔎 For the full breakdown of PHP2Shell CVEs and what organizations should do now, read our blog 👇
https://t.co/4fLwQxqNPS

[JFrog Security @JFrogSecurity]

🚨 PHP2Shell: 2 critical RCEs in PHP. Patches are coming, but don't wait to prepare.

CVE-2026-109618 and CVE-2026-109619 carry CVSS 9.2 scores and could let remote attackers execute commands on vulnerable servers.

PHP scheduled patches for October 21 at 14:00 UTC.

⚠️ Act now:
- Inventory every PHP deployment, including embedded runtimes.
- Upgrade to a supported PHP version ahead of time to simplify remediation.
- Evaluate temporarily disabling PHP's session upload-progress feature as a mitigation.

JFrog Xray and Catalog already track both CVEs. Our research team is developing dedicated contextual scanners.

Know your exposure before attackers make their move.

[JFrog Security @JFrogSecurity]

🚨 PHP2Shell: 2 critical RCEs in PHP. Patches are coming, but don't wait to prepare.

CVE-2026-109618 and CVE-2026-109619 carry CVSS 9.2 scores and could let remote attackers execute commands on vulnerable servers.

PHP scheduled patches for October 21 at 14:00 UTC.

⚠️ Act now:
- Inventory every PHP deployment, including embedded runtimes.
- Upgrade to a supported PHP version ahead of time to simplify remediation.
- Evaluate temporarily disabling PHP's session upload-progress feature as a mitigation.

JFrog Xray and Catalog already track both CVEs. Our research team is developing dedicated contextual scanners.

Know your exposure before attackers make their move.

[JFrog Security @JFrogSecurity]

Read the full technical analysis: https://t.co/szb7e2CBLz

[JFrog Security @JFrogSecurity]

🚨 RCE in curl (CVE-2026-92392, HIGH Severity) 🚨

A malicious HTTP/2 server can turn a use-after-free during uploads into remote code execution.

Prerequisites:
● curl -T <file> over HTTP/2 to an attacker-controlled server
● <file> is ~135KB+ and contains <word> <word> <any>\n\n anywhere
● -Z / --parallel for exploitation when PIE/ASLR is on

Affected: 8.12.0–8.22.0
Fix: 8.23.0 (or 8.20.2 / 8.16.2 / 8.14.3)

[JFrog Security @JFrogSecurity]

🚨 RCE in curl (CVE-2026-92392, HIGH Severity) 🚨

A malicious HTTP/2 server can turn a use-after-free during uploads into remote code execution.

Prerequisites:
● curl -T <file> over HTTP/2 to an attacker-controlled server
● <file> is ~135KB+ and contains <word> <word> <any>\n\n anywhere
● -Z / --parallel for exploitation when PIE/ASLR is on

Affected: 8.12.0–8.22.0
Fix: 8.23.0 (or 8.20.2 / 8.16.2 / 8.14.3)

[JFrog Security @JFrogSecurity]

Register a cache block. The server unpickles it. You're root.

🚨 Unauthenticated RCE in LMCache, found by JFrog Research 🚨

CVE-2026-105192

[JFrog Security @JFrogSecurity]

Technical details &gt;&gt; https://t.co/V6CDWmCXIQ

[JFrog Security @JFrogSecurity]

Register a cache block. The server unpickles it. You're root.

🚨 Unauthenticated RCE in LMCache, found by JFrog Research 🚨

[JFrog Security @JFrogSecurity]

🚨 New High-severity Axios CVEs: Same story, different numbers.

Axios recently released CVE-2026-101905 & CVE-2026-101909 as High severity.

🚩 The catch? Just like previous Axios flaws, they are impossible to exploit on their own and require a pre-existing Prototype Pollution vulnerability in your application.

💡 JFrog Severity: Medium. While the impact is high, exploitation strictly depends on a completely separate vulnerability outside of Axios.

These new CVEs follow the exact same pattern of severity inflation we broke down in our recent research:

[JFrog Security @JFrogSecurity]

🚨 Multiple recent Axios CVEs aren't as severe as they seem.

JFrog researchers found that some Prototype Pollution gadget vulnerabilities in Axios are scored based on the impact of an already-compromised application, even though exploitation requires a separate Prototype Pollution vulnerability (as you can see in this PoC).

Read our blog (in the first comment) to understand why context matters more than the score.