@JFrogSecurity

The JFrog Security Research Team empowers developers and companies to excel by identifying, prioritizing, and mitigating software risks.

 USA / Israel
research.jfrog.com/
Joined November 2017
  • Tweets1.6K
  • Following308
  • Followers6.1K
381Media
🚨 JFrog Security Research has identified a supply-chain attack involving malicious code in the LiteLLM 1.107.0 PyPI release. Avoid this version and investigate environments where it was installed or executed. More details will be shared soon in our blog post.
30
157
101
1,334
339,842
🔎 We break down the LiteLLM hijacking, the attack details, and what you need to know in our blog 👇 research.jfrog.com/post/lite…
7
2
36
20,617
🔎 We break down the LiteLLM hijacking, the attack details, and what you need to know in our blog 👇 research.jfrog.com/post/lite…
JFrog Security
@JFrogSecurityOct 21
🚨 JFrog Security Research has identified a supply-chain attack involving malicious code in the LiteLLM 1.107.0 PyPI release. Avoid this version and investigate environments where it was installed or executed. More details will be shared soon in our blog post.
2
7
25
5,262
🔎 For the full breakdown of PHP2Shell CVEs and what organizations should do now, read our blog 👇 research.jfrog.com/post/php2…
JFrog Security
@JFrogSecurityOct 21
🚨 PHP2Shell: 2 critical RCEs in PHP. Patches are coming, but don't wait to prepare. CVE-2026-109618 and CVE-2026-109619 carry CVSS 9.2 scores and could let remote attackers execute commands on vulnerable servers. PHP scheduled patches for October 21 at 14:00 UTC. ⚠️ Act now: - Inventory every PHP deployment, including embedded runtimes. - Upgrade to a supported PHP version ahead of time to simplify remediation. - Evaluate temporarily disabling PHP's session upload-progress feature as a mitigation. JFrog Xray and Catalog already track both CVEs. Our research team is developing dedicated contextual scanners. Know your exposure before attackers make their move.
3
10
32,957
🚨 PHP2Shell: 2 critical RCEs in PHP. Patches are coming, but don't wait to prepare. CVE-2026-109618 and CVE-2026-109619 carry CVSS 9.2 scores and could let remote attackers execute commands on vulnerable servers. PHP scheduled patches for October 21 at 14:00 UTC. ⚠️ Act now: - Inventory every PHP deployment, including embedded runtimes. - Upgrade to a supported PHP version ahead of time to simplify remediation. - Evaluate temporarily disabling PHP's session upload-progress feature as a mitigation. JFrog Xray and Catalog already track both CVEs. Our research team is developing dedicated contextual scanners. Know your exposure before attackers make their move.
1
3
1
19
37,792
Read the full technical analysis: research.jfrog.com/post/curl…
JFrog Security
@JFrogSecurityOct 15
🚨 RCE in curl (CVE-2026-92392, HIGH Severity) 🚨 A malicious HTTP/2 server can turn a use-after-free during uploads into remote code execution. Prerequisites: ● curl -T over HTTP/2 to an attacker-controlled server ● is ~135KB+ and contains \n\n anywhere ● -Z / --parallel for exploitation when PIE/ASLR is on Affected: 8.12.0–8.22.0 Fix: 8.23.0 (or 8.20.2 / 8.16.2 / 8.14.3)
4
10
1,794
🚨 RCE in curl (CVE-2026-92392, HIGH Severity) 🚨 A malicious HTTP/2 server can turn a use-after-free during uploads into remote code execution. Prerequisites: ● curl -T over HTTP/2 to an attacker-controlled server ● is ~135KB+ and contains \n\n anywhere ● -Z / --parallel for exploitation when PIE/ASLR is on Affected: 8.12.0–8.22.0 Fix: 8.23.0 (or 8.20.2 / 8.16.2 / 8.14.3)
42
6
203
22,228
Register a cache block. The server unpickles it. You're root. 🚨 Unauthenticated RCE in LMCache, found by JFrog Research 🚨 CVE-2026-105192
1
1
13
1,651
Technical details >> research.jfrog.com/vulnerabi…
JFrog Security
@JFrogSecurityOct 7
Register a cache block. The server unpickles it. You're root. 🚨 Unauthenticated RCE in LMCache, found by JFrog Research 🚨
There's a new version of this post
1
388
🚨 New High-severity Axios CVEs: Same story, different numbers. Axios recently released CVE-2026-101905 & CVE-2026-101909 as High severity. 🚩 The catch? Just like previous Axios flaws, they are impossible to exploit on their own and require a pre-existing Prototype Pollution vulnerability in your application. 💡 JFrog Severity: Medium. While the impact is high, exploitation strictly depends on a completely separate vulnerability outside of Axios. These new CVEs follow the exact same pattern of severity inflation we broke down in our recent research:
JFrog Security
@JFrogSecurityJul 1
🚨 Multiple recent Axios CVEs aren't as severe as they seem. JFrog researchers found that some Prototype Pollution gadget vulnerabilities in Axios are scored based on the impact of an already-compromised application, even though exploitation requires a separate Prototype Pollution vulnerability (as you can see in this PoC). Read our blog (in the first comment) to understand why context matters more than the score.
8
1
19
3,980
Auth is off by default. One unauthenticated POST -> shell. 🚨 Two unauthenticated RCEs in the Bifrost AI Gateway, found by JFrog Research 🚨 Technical details >> research.jfrog.com/vulnerabi… research.jfrog.com/vulnerabi…
3
4
5
1,152
🚨 Anatomy of a Live npm Supply-Chain Campaign: "Equation of Compromise" Threat actors are targeting developers with trojanized math libraries. The payload doesn't run for everyone, it only decrypts when the victim's code solves one specific linear matrix. Read the full teardown of the trigger, payloads, and threat actor infrastructure on our blog: research.jfrog.com/post/equa…
1
20
1
15
2,580
CVSS 10.0, but the evidence doesn't add up... again. CVE-2026-82617 ReDoS vulnerability received a CVSS 10.0 from Apache. ❌ No arbitrary code execution ❌ No data disclosure ❌ Not enabled by default The impact is limited to denial of service, and exploitation requires the application to explicitly opt in to the vulnerable name-finder functionality and process attacker-controlled input. ⚠️ Don't rely on the CVE severity score alone. Assess the actual exploitability and impact in your environment.
5
7
1
30
6,286
🚨 Parallels Desktop runs as root, and that can be exploited now! 🚨 Our team discovered a 0-day LPE vulnerability: CVE-2026-90894. Any local user can gain root access, no need for admin group. Fix immediately by upgrading to version 27.0.0. Full technical details on our blog >> research.jfrog.com/vulnerabi…
1
12
31
2,330
The JFrog Security Research team investigated the GemStuffer campaign run by rogue OpenAI agents and uncovered over 3,000 malicious RubyGems packages, beyond initial estimates. The wildest part? The AI left distinct fingerprints across the registry. How the agent swarm operated and the full list of 3,000+ packages: research.jfrog.com/post/gems…
8
34
5
98
143,088
🚨NextJS, Sharp and ImagicMagick affected by Critical libheif vulnerability 🚨 A heap buffer overflow CVE-2026-84383 in libheif (along with 10 other vulnerabilities) has been reported to result in RCE when parsing malformed HEIC/HEIF/AVIF images. Popular web tools parsing AVIFS like @nextjs and sharp were reported as affected. The JFrog security research team found that @ImageMagick is also affected by the vulnerability and verified a DoS POC. Users are recommended to upgrade: - libheif to version 1.23.2 - sharp to version 0.35.4 - next.js to versions 15.5.24 or 16.3.3 🔎 Note that other popular tools utilizing libheif may be affected.
4
42
8
219
36,660
CVSS 9.8, but the code doesn't add up. CVE-2026-47890 and CVE-2026-59313 in Spring claim critical impact, but: ❌Same root cause: a stray \r corrupting an SSE stream ❌Spring scores both 2.6, Low, same vector ❌CISA scores both 9.8, Critical, no server-side compromise possible And it's not an isolated case: of 6 Critical-rated Spring CVEs published the same day, only 1 holds up against Spring's own advisory. ⚠️Don't take a CISA score at face value. Verify against the vendor advisory before patching or prioritizing. Read our full analysis:research.jfrog.com/post/when…
1
4
24
2,958
Load more