security

Unauthenticated intruders can mint admin tokens, and exposed servers are already being hit

Security researchers reported that someone is exploiting CVE-2026-82329, a critical JFrog Artifactory authentication-bypass bug, just days after the vendor patched the 9.8-rated flaw. And we don’t know if that someone is human.

Artifactory is a widely used tool for managing software artifacts, packages, binaries, and AI models. It’s also popular with AI agents that go rogue and need to communicate with each other while remaining undetected by their human babysitters.

In July, OpenAI and JFrog revealed that OpenAI’s models broke out of their cages to hack Hugging Face by exploiting Artifactory zero-days, and at Black Hat, the model provider said agents used Artifactory to build message boards and help each other access the open internet.

JFrog disclosed CVE-2026-82329 on Friday, and by Tuesday, attackers had already begun exploiting internet-exposed systems, according to exposure-management biz watchTowr’s threat-intel team, which reported “attackers minting themselves admin tokens.” 

In addition to creating new administrative credentials, watchTowr’s honeypot network caught miscreants “enumerating users, groups, credential sets and federated access topologies,” Yordan Ganchev, principal threat intelligence specialist at watchTowr, told The Register.

“Right now, we’re observing exploitation from a small number of IP addresses from varying geographies exploiting multiple of our honeypots,” Ganchev said. “Broad-scale scanning and mass exploitation has not been observed, but that is unlikely to stay the case for long.”

Ganchev urged organizations running vulnerable versions to “urgently patch” internet-exposed systems, and treat them as being potentially compromised – so inspect audit logs, rotate credentials, and investigate connected systems for any unusual changes or backdoor implants.

“When attackers gain admin level access to a central software supply chain system, they can do what every engineering team does best – build, ship and distribute software fast,” he said. “From there, they could tamper with build pipelines, move laterally into production systems and potentially push malicious changes downstream to customers.”

JFrog did not immediately respond to The Register’s inquiries. We will update this story when we receive any response. ®

• X-Bow received nearly $11 million under a new interceptor development contract
• The new interceptor system targets a cost below $750,000 per launch
• Patriot missiles currently cost roughly one-fifth more than this new target

The Pentagon has awarded X-Bow Systems almost $11 million to develop a lower-cost interceptor system under a missile defense program.

The project falls under the Missile Defense Agency’s Rapid Response Small Launcher Technology program and seeks to create a weapon that could cost below $750,000 per launch.

• Anthropic wants AI agents to control programmable machines through common software rules
• Model Hardware Standard (MHS) can connect microscopes, robotic arms, and liquid handling equipment
• MHS allows different laboratory devices to communicate through standardized software drivers

Anthropic opened a preview of its Model Hardware Standard (MHS), designed to let AI agents control programmable machines through shared rules.

The proposed system is intended for laboratories, factories, and workplaces where different instruments must work together without custom software links.

Phishing actors are abusing the legitimate Faronics Deploy endpoint-management platform to gain remote administrative control over victim computers and install the ScreenConnect remote support software.

In activity observed between July 21 and August 20, Faronics-themed lures reached more than 457 endpoints via emails disguised as invoices, tax documents, or other business files.

Faronics Deploy is a cloud-based endpoint management platform that allows IT administrators to remotely enroll and manage computers, deploy software, and execute scripts.

Researchers at managed detection and response company (MDR) Huntress say that the embedded malicious links lead to a website that profiles potential targets and guides them through a malicious download flow.

If the website is reached from an analysis environment, a decoy routine is activated, such as displaying an error message.

Huntress explains that a potential victim is prompted to download and launch a legitimate, signed Faronics Deploy installer that is disguised as an Adobe document, a reader app, or a plugin update.

When the victim runs the Faronics installer, often named ‘Adobe.exe,’ their computer is enrolled in a Faronics deployment controlled by the attackers.

The threat actor then uses Faronics’ remote-deployment functionality to execute PowerShell scripts on the enrolled computer without further user interaction.

These scripts download additional tools from the attacker’s infrastructure or external locations, including GitHub, eventually installing another legitimate remote access tool, ConnectWise ScreenConnect.

“The delivery method varies between scripts, with observed examples using curl or mshta to retrieve additional content, while others invoke msiexec to install payloads hosted on attacker-controlled infrastructure,” Huntress says.

“These scripts are subsequently used to install ScreenConnect, establishing an additional remote access mechanism on the compromised endpoint.”

ScreenConnect gives attackers an additional remote-access channel independent of Faronics, providing hands-on remote control better suited to interactive access while also serving as redundancy if the malicious Faronics deployment is identified and terminated, or if defenders remove its agent.

Huntress notified Faronics of its findings on August 5, and the vendor confirmed the observed malicious activity, countering it by implementing additional anti-abuse measures.

Moreover, Faronics has contacted victimized organizations to notify them about potential compromise.

According to Huntress, the malicious activity dropped significantly starting August 21, indicating that Faronics’ actions worked.

Huntress recommends that administrators check the “C:\ProgramData\Faronics\Logs\” location for a ScriptRunner.log file, which may preserve remotely executed script names and download URLs.

The company says that the ck parameter in Faronics configuration requests is also an indicator, as it identifies the associated customer deployment and can help identify compromised endpoints or malicious accounts.

Administrators should also look for ScreenConnect installations where it is not normally deployed.

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report

It feels like we have been waiting an age for the Range Rover Electric. First announced back in December 2023, JLR’s luxury EV SUV was meant to hit the road in 2024, but extended development testing forced the carmaker to push its arrival back. Now it’s finally here—one of WIRED’s most anticipated rides—the first fully electric Range Rover.

The specs are as mighty as you would expect. Dual 260-kilowatt motors deliver “V8 levels of power” up to 542 horsepower and 850 newton-meters of torque (20 percent more than other motors of the same size, JLR claims). Inside, a double-stacked 118.5-kWh battery with 800-volt split-charging tech can recharge the cell from 10 to 80 percent in 22 minutes (or, if you prefer, 137 miles in 10 minutes). Max range is supposedly 372 miles (according to WLTP standards), and a claimed real-world distance of up to 333 miles.

Photograph: Courtesy of JLR

The Range Rover Electric will launch from a standstill to 60 mph in 4.3 seconds, which is rapid considering the car’s weight, though there’s no official figure.

All this comes at a price, naturally—one that’s high even for Range Rover. Available for order now, the UK entry-level Autobiography model is £154,070, or about $208,000, but this quickly climbs to £225,240 (north of $304,000) for the SV Black long-wheelbase model. It could go higher, too, as the “Ultra” models are listed as “price on application”—shorthand for “If you have to ask, you can’t afford it.” However, US customers can buy a lower SE-spec Range Rover Electric from $138,00—add $2,550 for delivery and destination.