JFrog Artifactory Flaws Actively Exploited, Enabling Full Supply-Chain Compromise

·8 views

JFrog disclosed and patched three authentication and authorization vulnerabilities in self-hosted Artifactory in September 2026, with CVSS scores ranging from 7.5 to 9.8. The most critical flaw, CVE-2026-82329, allows attackers to forge a cluster join token via an empty default join key and escalate to platform administrator. Security vendors reported that attackers were chaining these flaws to create persistent admin accounts, install malicious plugins, and export credentials and repository configuration. Because Artifactory acts as a central credential store for CI/CD pipelines, a compromised instance can expose every downstream build system that trusts it, including cached packages. CISA added the vulnerabilities to its Known Exploited Vulnerabilities catalog on September 12, 2026, setting a federal remediation deadline of September 25, with JFrog recommending upgrades to fixed versions 7.161.20 or 7.133.11 depending on the branch.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Ireland's DPC fines Google €403M for mishandling user location data

Ireland's Data Protection Commission (DPC) has imposed a €403 million fine on Google following an inquiry into how the company processed users' location data. The investigation examined whether Google's handling of location information complied with the EU's General Data Protection Regulation (GDPR). The DPC, which serves as Google's lead data regulator in the EU due to the company's European headquarters being in Ireland, found violations significant enough to warrant the substantial penalty. This ruling adds to a growing list of major GDPR enforcement actions taken against large technology companies operating in Europe.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Angular Concepts Explained Through a Simulated Junior Developer Interview

A DEV Community article presents Angular fundamentals through a fictional technical interview between a candidate named Pedro and an interviewer named João. The dialogue-based format covers core Angular concepts including project structure, Services, and separation of responsibilities. Key topics addressed include why HTTP calls belong in Services rather than components, how Route Guards protect authenticated routes, and the role of HTTP Interceptors in automatically attaching authorization tokens. The format is designed to help beginners learn by observing how a real interview scenario might unfold, including moments where the candidate answers incorrectly and receives corrections.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google Gemini Expands Into AI-Powered Shopping With Cart and Visual Search Tools

Google is integrating shopping capabilities across Gemini, AI Mode, and its Shopping Graph, aiming to make AI-assisted product discovery a more connected part of the buying journey. A promotional demo suggests users may soon research purchases, compare products, and browse using camera images directly within Gemini. Google's I/O 2026 materials also highlight a Universal Cart concept that can aggregate items from Search, Gemini, YouTube, and Gmail into a single intelligent cart. The initiative includes Buy buttons on eligible product listings within AI Mode, pointing toward purchase paths that extend beyond traditional search results. Exact availability, supported markets, and merchant requirements for these features have not yet been officially confirmed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Analysis of 22,901 Resume PDFs Finds 80% Have Major Parsing Flaws

A free resume-checking tool analyzed 22,901 PDF resumes submitted between May and September 2026, finding that only 5.8% had zero layout issues, while 79.8% contained at least one major or critical problem. Contrary to popular advice, hidden layout tables were the most common critical flaw, flagged in 32.7% of files, nearly four times more frequent than the two-column layouts that most guides warn against. These invisible tables, often inherited from word processor templates, cause text extractors to scramble job titles, dates, and bullet points into the wrong order. Other widespread issues included decorative icons or emoji disrupting text parsing (48.9%), non-standard fonts (46%), and non-standard section headings like 'Professional Journey' that can cause entire resume sections to go undetected (39.2%). Contact details placed in header or footer bands were missed by many parsers in 22.1% of files, since some applicant tracking systems only read the main body layer of a PDF.

0 comments Read more at DEV Community