08/12/2026-08/19/2026 Attackers Exploit MLflow SSRF Flaw, 16 Typosquatted RubyGems Packages, Actively Exploited Ray Flaw  And More.

1. Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets

Two severe vulnerabilities in MLflow and FUXA are under active exploitation. CVE-2026-64849 (CVSS 9.3) is an unauthenticated SSRF flaw in MLflow affecting versions below 3.15.0, allowing attackers to reach cloud metadata endpoints and steal credentials. Exploitation began within hours of disclosure on August 17, 2026, with attackers indiscriminately scanning for exposed instances. The flaw bypasses prior fixes by exploiting web redirect handling.

CVE-2026-25895 (CVSS 9.5) is a missing authentication and path traversal vulnerability in FUXA versions ≤1.2.9, enabling unauthenticated remote code execution via arbitrary file writes. Scanning started August 18, 2026, from a single IP targeting roughly 60 exposed FUXA installations. Attackers are overwriting main.js with junk data, though no RCE payloads have been observed yet.

Organizations should patch immediately, review logs for compromise, and check for exposed credentials.

2. 16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets

Cybersecurity researchers have uncovered a typosquatting campaign targeting RubyGems users with a Windows info-stealer dubbed StubMaker. Discovered on August 15, 2026, the campaign involved 16 malicious gems—including ubnuler, ri18nr, and brumdler—all clumsy typosquats of popular Ruby dependencies. The packages have since been yanked.

The malware harvests browser credentials, crypto wallets, seed phrases, and Telegram data. It exploits Ruby’s package name reuse and unvalidated author fields, allowing attackers to republish yanked gems under new accounts. The attack chain uses an “extconf.rb” hook to fetch a Rust-based loader from GitHub, which launches a Go-based stealer that bypasses Chrome’s app-bound encryption to extract data from Chromium browsers. Stolen information is uploaded to Gofile as a password-protected ZIP, with the link sent to the attacker over unencrypted HTTP.

The same actor also targeted npm with 37 typosquatted packages using postinstall hooks to deliver the identical payload. Researchers recommend isolating infected Windows hosts, rotating credentials, and removing malicious libraries.

3. CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE

Ray, with 43,500 GitHub stars and over 7,900 forks, contains a critical vulnerability tracked as CVE-2025-62593 (CVSS 9.4) enabling remote code execution through DNS rebinding attacks in Firefox and Safari.

The flaw stems from Ray’s lack of authentication on critical endpoints, allowing attackers to execute arbitrary code against developers running Ray who visit malicious websites or view malicious ads. The attack can also target network-adjacent Ray instances inside private corporate networks, using the browser as an intermediary.

The vulnerability primarily affects development and testing environments. It was patched in version 2.52.0. Researchers Avi Lumelsky and Jonathan Leitschuh were credited with discovery.

Threat actors behind the RondoDox botnet incorporated the exploit two days before public disclosure on November 26, 2025. Unpatched instances have also been targeted in the ShadowRay 2.0 campaign, turning GPU clusters into cryptocurrency mining botnets. FCEB agencies must apply fixes by August 20, 2026.

4. SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts

A critical SAP Commerce Cloud vulnerability, CVE-2026-58231, is under active exploitation. Rated 10.0 on CVSS, it stems from insufficient authorization checks and input validation, allowing unauthenticated attackers to abuse a default authentication client and submit crafted input to vulnerable functions. Successful exploitation could enable arbitrary code execution and compromise internal components, severely impacting confidentiality, integrity, and availability.

Defused Cyber detected exploitation attempts on its honeypots just three days after the patch was released. KEVIntel independently confirmed two attempts on August 14 from a U.S.-based IP address.

Onapsis urges customers to patch immediately and rebuild/redeploy the fixed Commerce Cloud version. As a temporary measure, organizations can configure IP Filter Sets to restrict access to the vulnerable endpoint.

The attackers remain unidentified, though previous SAP flaws have been exploited by China-linked groups and ransomware actors.

08/07/2026-08/12/2026 SAP Commerce Cloud Flaw, BDThemes WordPress Supply Chain Attack, Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT And More.

1. SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code

SAP has released patches for a maximum-severity flaw in Commerce Cloud (Data Hub Adapter) that could enable arbitrary code execution. The bug, CVE-2026-58231 (CVSS 10.0), stems from insufficient authorization checks and input validation. CVE.org notes it lets an unauthenticated attacker abuse a default authentication client to submit crafted input to under-validated functions, compromising confidentiality, integrity, and availability. Onapsis has urged customers to patch and redeploy, with an IP Filter Set as a temporary mitigation.

SAP’s August 2026 update also fixes three other critical flaws: CVE-2026-44772 (CVSS 9.9), a code injection bug in Manufacturing Integration and Intelligence letting a low-privileged attacker trigger command execution via a vulnerable servlet fetching external content; CVE-2026-34265 (CVSS 9.8), an out-of-bounds write in NetWeaver/ABAP Platform’s DIAG protocol parsing that can leak data or crash systems; and CVE-2026-44758 (CVSS 9.1), an SSTI/SSRF flaw enabling privileged attackers to run OS commands, fixed by removing the vulnerable servlet.

2. Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations

Two malicious LiteLLM releases, versions 1.82.7 and 1.82.8, sat on PyPI for roughly 40 minutes on March 24 carrying credential-stealing code that harvested cloud keys, SSH keys, Kubernetes tokens, and database passwords. Threat intel firm CloudSEK says a dataset built from ~434,000 captured files maps potential exposure to over 2,500 organizations, though these are files the attackers stole, not victim-confirmed data, and CloudSEK stresses the totals aren’t a victim count. NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp appear among matches; both CloudSEK and LiteLLM recommend rotating credentials rather than waiting for proof of misuse.

The incident is tied to a broader TeamPCP campaign (tracked as UNC6780) that also compromised Aqua Security’s Trivy scanner, force-pushing malicious commits across dozens of version tags. The FBI warned in a July advisory that stolen credentials may be weaponized long after initial compromise, urging rotation of CI/CD secrets, publishing tokens, and cloud credentials, plus checks for campaign-linked repos like tpcp-docs.

3. BDThemes WordPress Supply Chain Attack Creates Rogue Admins and Deploys Webshells

A supply chain compromise has hit WordPress plugin vendor BdThemes, letting attackers silently create rogue admin accounts and install webshells without altering any plugin code. Wordfence, alerted August 7, found threat actors poisoned a JSON banner feed (“Biggopti”) used across plugins like Element Pack, Prime Slider, and Ultimate Post Kit. The feed fetches from a DigitalOcean Spaces bucket; a stored XSS flaw in Prime Slider’s display_id field let attackers inject a payload that fires on admin page load, contacts a C2 server, creates a new admin account via the session’s REST API nonce, and uploads a disguised plugin containing a webshell. That webshell installs persistent Must-Use plugins, including a magic-login backdoor and an account-hiding module. A secondary payload generates deterministic bd_-prefixed credentials from each victim’s hostname. Wordfence links the infrastructure to prior Advanced Responsive Video Embedder and OptinMonster/TrustPulse incidents. Affected plugins were pulled; site owners should audit user lists and mu-plugins directories. 

4. Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

Nearly 800 (now 1,033+) malicious npm packages, using AI-generated typo-squatted names, deliver cross-platform RAT/infostealer malware, per OpenSourceMalware and Sonatype (tracking it as “Flooding Dropper”). Instead of install hooks, READMEs instruct developers to load them via require(), triggering a downloader called WEL1DROPPER that detects the OS/architecture and fetches payloads from Cloudflare Workers or, as fallback, via DNS TXT records from “wel1[.]ru.” Windows payloads patch ETW/AMSI to evade monitoring; macOS uses LaunchAgent persistence; Linux deploys the Sliver C2 framework. A hidden “telemetry.js” file duplicates the downloader logic as camouflage. Domains suggest targeting of Russian financial institutions, and researchers link the campaign to April’s “Moika” dependency-confusion operation.

Separately, Unit 42 documented other npm/PyPI campaigns delivering crypto stealers, cloud credential theft, and CI/CD token exfiltration, plus Chrome extensions covertly turning browsers into residential proxy nodes via embedded bandwidth-sharing SDKs.

5. Microsoft Patch Tuesday for August 2026 Fixed a Zero-Day and Wormable RCE

Microsoft’s August 2026 Patch Tuesday fixes 398 CVEs, 62 rated Critical, including one actively exploited zero-day. CVE-2026-68820, a use-after-free in the WinSock kernel driver (afd.sys), is under active exploitation and can grant SYSTEM privileges via a race condition. The most urgent fix is CVE-2026-62878, a critical, potentially wormable Windows DNS Server stack buffer overflow allowing unauthenticated remote code execution with no user interaction—serious given how widely DNS servers are exposed.

Three more RCE bugs stand out: CVE-2026-62893 in WDS’s unauthenticated TFTP service; CVE-2026-62815 in Microsoft’s QUIC/HTTP-3 implementation, affecting an estimated 13.5 million sites; and CVE-2026-59124, a CVSS 9.8 flaw in HPC Pack Microsoft flags as “exploitation more likely.” An Exchange authentication-bypass bug, CVE-2026-62911, was demonstrated with working exploit code at Pwn2Own Berlin and could let attackers compromise every mailbox on a server. Two publicly disclosed bugs and two TPM 2.0 flaws round out the release.

07/29/2026-08/07/2026 Critical cPanel Vulnerability, JetBrains TeamCity Vulnerability, Trojanized npm Packages Employ NullReceiver Tactic And More.

1. Critical cPanel Vulnerability Allows Execution of SQL Commands as Root User 

A critical privilege-escalation flaw in cPanel & WHM, tracked as CVE-2026-58048, could let authenticated hosting users with MySQL/MariaDB access execute SQL commands with full database administrator privileges. In shared hosting environments, this lets low-privileged users exceed their assigned permissions, potentially exposing customer databases, altering user permissions, extracting credentials, deploying malicious triggers, or reading files via database functions. Where MySQL/MariaDB has elevated filesystem access, exploitation could escalate to full server compromise.The flaw affects all unpatched supported versions of cPanel & WHM. Administrators should update immediately to versions 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, or 138.1.6 (WP2). Where immediate patching isn’t possible, revoking the MySQL feature from affected users mitigates risk while preserving access to existing databases. Security teams should audit logs for unusual database activity—new users, altered privileges, modified stored procedures, or suspicious file operations—especially on accounts with recently created databases.Organizations should treat this as high-priority patching.

2. Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access

Attackers exploited a SQL injection flaw in a public-facing web app to reach an organization’s Oracle database, then used Oracle’s embedded Java Virtual Machine to compile Java source code directly into schema objects—achieving code execution without ever writing an executable to disk. Huntress, tracking the toolkit as “khunt,” traced credential-theft alerts from July 27, 2026 to SYSTEM-level access on the underlying Windows server. The compromised JDBC connection had enough privilege to create Java objects; no Oracle patch fixes this, since it relies on legitimate features and over-permissioned accounts.

The toolkit included six Java classes for command execution, hash extraction, and file operations, plus PL/SQL wrappers. Attackers ran cmd.exe as SYSTEM and staged registry hives and credential files locally, though exfiltration wasn’t confirmed. The technique dates back to a 2006 proof-of-concept but is rarely seen exploited in the wild. Defense requires parameterized queries, input validation, and stripping unnecessary database privileges from application accounts—since EDR tools don’t inspect Oracle’s internals.

3. Hackers Start Exploiting Recent JetBrains TeamCity Vulnerability

CISA warns that threat actors have started exploiting a recently patched critical vulnerability in JetBrains TeamCity, a widely used CI/CD platform central to enterprise development workflows. Tracked as CVE-2026-63077 (CVSS 9.8), the flaw stems from deserialization of untrusted data and lets unauthenticated attackers achieve remote code execution via HTTP/S requests, exploiting the TeamCity agent polling protocol. It affects all TeamCity On-Premises versions, allowing attackers to bypass authentication and run OS commands with server-process privileges.

JetBrains patched the issue in versions 2025.11.7 and 2026.1.3, plus a plugin for 2017.1+, after a private report—initially with no evidence of active exploitation. About a week after disclosure, CISA added the flaw to its KEV catalog, giving federal agencies three days to patch under BOD 26-04. No public details on the attacks have emerged yet. Organizations running TeamCity On-Premises should patch immediately.

4. Critical Paperclip AI Flaws Enable Unauthenticated RCE and Agent Takeover

Oasis disclosed three vulnerabilities in Paperclip, an open-source control plane for autonomous AI agents. The most severe, CVE-2026-41679 (CVSS 10.0), lets unauthenticated attackers self-register, self-approve a board-level API credential via the CLI authorization flow, then exploit a missing authorization check in the company-import route. This allows uploading a malicious agent config that executes arbitrary OS commands once “woken”—yielding full remote code execution and exposing secrets and internal services. It affects versions before 2026.416.0 with default self-registration enabled.

A second flaw (CVSS 8.3) allowed unauthenticated access to cross-tenant data and verbose health endpoints useful for reconnaissance. A third (CVSS 9.6) let attackers use DNS rebinding against Paperclip’s local_trusted mode, tricking victims’ browsers into triggering command execution with no credentials required.

All three stem from implicit trust at authorization boundaries. Paperclip patched the issues in version 2026.416.0; operators should upgrade immediately and treat agent configs as privileged, executable code.

5. Trojanized npm Packages Employ NullReceiver Tactic to Decode C2 IP from Blockchain

Researchers have identified NullReceiver, a North Korea-linked evolution of the EtherHiding blockchain C2 technique, found in trojanized npm packages “bianira-ui” and “fluid-type-ui.” Rather than embedding a C2 address in smart contract calldata, malware decodes the C2 IP directly from the recipient address bytes of an empty, zero-value Ethereum transfer—eliminating any fixed, trackable destination or fingerprintable payload field, while making transactions cheaper.

The malware looks up a hardcoded attacker wallet, reads its latest outbound transaction’s destination address, and converts the first four bytes into an IP. Both packages, downloaded hundreds of times before removal, connected victims to 166.88.134[.]62. OpenSourceMalware later found five more npm packages using this technique.

Shared wallet infrastructure linked these packages to North Korean campaigns, including PolinRider, which has compromised 20+ packages across npm, Go, and PHP over five months using fake interviews, poisoned forks, and typosquatting to infiltrate developer machines.

6. Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks

A supply-chain attack compromised the Keyv and Cacheable npm namespaces, spreading malicious packages across multiple organizations. SafeDep initially confirmed 353 poisoned versions and later raised the total to 1,684 versions across 420 package names, while Aikido reported a different count. The malware used a preinstall script to steal GitHub, npm, cloud, Kubernetes, database, and private-key credentials from developer and CI environments, then reused stolen npm publishing access to spread further. A separate execution path through Claude Code and VS Code workspace hooks also remained in the repository. Researchers warn that any system running an affected version should be treated as compromised. Because package tags changed rapidly, organizations should verify exact package versions and lockfiles instead of relying on namespace blocklists. Although the malicious releases were built through legitimate GitHub Actions workflows with valid OIDC and SLSA provenance, those attestations verified the build process—not that the source code was trustworthy.