Morning Review in IT Security — September 2, 2026

The threat landscape continues to shift rapidly as attackers waste no time exploiting newly disclosed vulnerabilities across multiple critical infrastructure and software supply chains. Today's review covers active exploitation campaigns targeting authentication systems, AI frameworks, package repositories, and even nuclear facilities, underscoring the urgent need for immediate patching and security vigilance.

Attackers Pounce on Critical Artifactory Flaw Following Disclosure

JFrog's Artifactory repository manager faces active exploitation following the disclosure of CVE-2026-82329, a critical authentication bypass vulnerability that grants attackers admin-level access to affected systems. The flaw has already been weaponized by threat actors who are moving quickly to compromise organizations relying on this widely-deployed software. Source: Attackers Pounce on Critical Artifactory Flaw Following Disclosure

The rapid exploitation timeline demonstrates the compressed window organizations have between vulnerability disclosure and active attack campaigns. Security teams managing Artifactory instances should prioritize immediate patching and review access logs for signs of unauthorized administrative activity.

Critical Langflow Flaw Exploited to Steal OpenAI and AWS Keys

An unauthenticated remote code execution vulnerability in Langflow, an open-source framework for building AI applications, is being actively exploited to harvest sensitive credentials including OpenAI API keys and AWS authentication tokens. CVE-2026-0768 represents a particularly severe risk given the framework's role in AI application development and the value of the credentials being targeted. Additional related vulnerabilities including CVE-2026-0770, CVE-2026-33017, CVE-2026-5027, CVE-2026-55255, and CVE-2026-9198 have also been identified in the same framework. Source: Critical Langflow flaw exploited to steal OpenAI and AWS keys

Organizations utilizing Langflow should immediately assess their deployments for exposure and apply available security updates. The compromise of cloud service credentials could enable attackers to pivot into broader infrastructure attacks and incur significant unauthorized cloud computing costs.

Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds

Researchers have discovered thirteen malicious Composer theme packages on Packagist designed to inject malicious JavaScript into Vietnamese streaming sites, targeting unpatched iOS devices with spyware aimed at extracting cryptocurrency wallet seeds. The attack chain exploits CVE-2025-31277 and CVE-2025-43529 in iOS WebKit to compromise visitor devices. The injected code also conducts mobile ad fraud and gambling redirects. Source: 13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds

This campaign highlights the convergence of supply chain compromise, mobile security vulnerabilities, and financial targeting. Site operators should audit their dependencies and users should ensure their iOS devices are fully patched to prevent exploitation through compromised web content.

Old, Unpatched Flaws Give Attackers Access to Philippines Nuclear Agency

Threat actors successfully breached the Philippines nuclear agency by exploiting unpatched commodity vulnerabilities in ownCloud, gaining access to reactor databases, personnel records, and credential stores. The incident demonstrates how legacy vulnerabilities in widely-deployed infrastructure software can provide entry points to highly sensitive facilities. Source: Old, Unpatched Flaws Give Attackers Access to Philippines Nuclear Agency

This breach underscores the critical importance of vulnerability management even for older, established software platforms. The compromise of nuclear facility data represents a significant national security concern and reinforces the need for organizations handling sensitive infrastructure to maintain rigorous patching schedules.

Today's threat environment demands immediate action from security teams. The exploitation of authentication bypasses, remote code execution flaws, and supply chain vulnerabilities across diverse platforms indicates attackers are operating at scale and with precision targeting. Organizations should prioritize patching these disclosed vulnerabilities, audit their software dependencies, and implement enhanced monitoring for suspicious access patterns.