JFrog Security Real Time Posts

A one-letter typo, Content-Xength, is accepted as Content-Length by the Eclipse Vert.x HTTP/1.x decoder (CVE-2026-102479). We chain it into response-queue desync and cross-user session fixation behind real reverse proxies.

JFrog Security Research linked 42 armed GitHub repositories in the testmetest campaign to a hidden npm publisher, an active encrypted data sink and previously reported GitHub Actions cPanel exploitation infrastructure.

CVE-2026-111497 ("Brotli2Shell") is an out-of-bounds write in Google's Brotli decoder that reaches far beyond Node.js and HTTP. JFrog Security Research reproduced a remote crash in ClickHouse, native memory corruption in FFmpeg through JPEG XL, a .NET runtime crash, and an infinite loop in Apache Arrow, and released an open-source scanner that finds Brotli decoding paths version-only scanners miss.

JFrog Security Research is tracking CVE-2026-109618 and CVE-2026-109619, two CRITICAL-severity PHP core vulnerabilities (PHP2Shell) that turn unauthenticated requests into remote code execution and Heartbleed-style memory disclosure. We break down the bug flow, the shipped fix, and the fake PoCs that surfaced around the disclosure.

LiteLLM has been hijacked again: malicious `litellm` 1.107.0 wheels contain an interpreter-startup credential stealer and an hourly remote-code loader absent from the source distribution.

JFrog Security Research is tracking CVE-2026-92392, a HIGH-severity curl/libcurl use-after-free in HTTP/2 uploads that a malicious HTTPS server can turn into client-side remote code execution. We break down the bug, the published exploit, and the narrow conditions it needs.

JFrog Security Research uncovered a targeted npm campaign hidden in cloned math libraries. The backdoor activates only for a specific matrix, receives encrypted tasks through an Ethereum Sepolia smart contract and Slack, and uses a GitHub Actions worker farm to manufacture hundreds of thousands of downloads.

The JFrog Security Research team investigated the GemStuffer campaign done by rogue OpenAI agents - we found more than 3000 RubyGems packages associated with the coordinated attacks.

On August 20, 2026, Spring published 91 CVEs in a single day. CISA's ADP rated six of them Critical. When we checked those scores against Spring's own advisories, they didn't hold up.

JFrog Security Research analyzed a new Mini Shai-Hulud wave on @7nohe/openapi-react-query-codegen. Ten npm versions drop a Trinitite-labeled worm through preinstall and an obfuscated binding.gyp command.