JFrog Security

@JFrogSecurity

The JFrog Security Research Team empowers developers and companies to excel by identifying, prioritizing, and mitigating software risks.

USA / Israel

research.jfrog.com

Replies Reposts Media

JFrog Security
@JFrogSecurity
11h
Auth is off by default. One unauthenticated POST -> shell. 🚨 Two unauthenticated RCEs in the Bifrost AI Gateway, found by JFrog Research 🚨 Technical details >> research.jfrog.com/vulnerabilitie… research.jfrog.com/vulnerabilitie…
JFrog Security
@JFrogSecurity
Sep 21
🚨 Anatomy of a Live npm Supply-Chain Campaign: "Equation of Compromise" Threat actors are targeting developers with trojanized math libraries. The payload doesn't run for everyone, it only decrypts when the victim's code solves one specific linear matrix. Read the full
1
JFrog Security
@JFrogSecurity
Sep 17
CVSS 10.0, but the evidence doesn't add up... again. CVE-2026-82617 ReDoS vulnerability received a CVSS 10.0 from Apache. ❌ No arbitrary code execution ❌ No data disclosure ❌ Not enabled by default The impact is limited to denial of service, and exploitation requires the
5
JFrog Security
@JFrogSecurity
Sep 16
🚨 Parallels Desktop runs as root, and that can be exploited now! 🚨 Our team discovered a 0-day LPE vulnerability: CVE-2026-90894. Any local user can gain root access, no need for admin group. Fix immediately by upgrading to version 27.0.0. Full technical details on our blog
1
JFrog Security
@JFrogSecurity
Sep 15
The JFrog Security Research team investigated the GemStuffer campaign run by rogue OpenAI agents and uncovered over 3,000 malicious RubyGems packages, beyond initial estimates. The wildest part? The AI left distinct fingerprints across the registry. How the agent swarm operated
8