Daily Digest

AI API Key Hijacking, Critical Exploits, and EU Reporting Mandate

September 1, 2026
8 articles (5 new, 3 updated)
24 min read

Summary

Critical Vulnerabilities Under Active Exploitation:

  • CVE-2026-82329 (JFrog Artifactory Auth Bypass): A critical authentication bypass vulnerability in self-hosted JFrog Artifactory instances is being actively exploited, allowing unauthenticated attackers to gain administrative privileges. Patches were released on August 28, 2026, and immediate updates are recommended.
  • CVE-2026-0768 (Langflow AI RCE): A critical remote code execution vulnerability (CVSS 9.8) in the Langflow AI low-code platform is under active exploitation. Unauthenticated attackers can execute arbitrary code with root privileges, leading to reconnaissance and credential theft. Attacks have been observed originating from Russia.
  • CVE-2026-78319 (SAUTER Building Controllers RCE): A critical remote code execution vulnerability (CVSS 9.8) affects SAUTER building automation controllers due to a TOCTOU race condition. This flaw could allow unauthenticated attackers to gain full control of devices managing essential building systems. Patches are available.

Threat Landscape Updates and Emerging Risks:

  • [UPDATE] Attackers Hijack AI API Keys: AI safety non-profit METR disclosed two security incidents demonstrating 'token jacking' threats. A March 2026 incident resulted in approximately $600,000 in fraudulent AI credit consumption, and a May 2026 campaign involved automated probing and credential stuffing. These incidents highlight the need for robust AI resource security.
  • [UPDATE] AI Scripts Target Siemens PLCs: Forescout's Vedere Labs demonstrated AI's ability to accelerate exploit development against industrial control systems, porting an RCE exploit between PLC models in under 8 hours. This research supports warnings about AI-driven threats to critical infrastructure, indicating increased attack speed and a lower barrier to entry for sophisticated OT exploits.
  • [UPDATE] McKesson Breach and Ransom Demand: The ShinyHunters group has issued a $55 million ransom demand to McKesson following a data breach. The attack targeted both Snowflake and Salesforce instances, impacting customer data across multiple business units and confirming a double-extortion tactic.
  • Phishing Campaign Targets 9,000+ Orgs: A large-scale phishing campaign has targeted over 9,000 organizations with debt-relief-themed emails. The campaign uses social engineering to lure victims into vishing calls, aiming to steal financial and personal information.

Policy and Industry Notes:

  • EU Cyber Resilience Act Reporting Mandate: Manufacturers of connected products sold in the EU must comply with the Cyber Resilience Act's (CRA) new reporting obligations starting September 11, 2026. The rules mandate reporting actively exploited vulnerabilities and severe incidents to ENISA within 24 hours.

Filter by Category

New Articles (5)

Critical JFrog Artifactory Auth Bypass Flaw Under Active Exploit

CRITICAL

JFrog Artifactory Auth Bypass (CVE-2026-82329) Exploited

A critical authentication bypass vulnerability, CVE-2026-82329, in self-hosted JFrog Artifactory instances is being actively exploited. The flaw allows unauthenticated attackers to gain administrative privileges. Patches were released on August 28, 2026, and organizations are urged to update immediately as attackers are observed creating admin tokens in the wild.

September 1, 2026
5 min read
CVE-2026-82329JFrogArtifactoryAuthentication BypassSupply Chain Security +1 more
Critical JFrog Artifactory Auth Bypass Flaw Under Active Exploit

Critical RCE Flaw in Langflow AI Platform Actively Exploited

CRITICAL

Langflow RCE Vulnerability (CVE-2026-0768) Actively Exploited

A critical remote code execution (RCE) vulnerability, CVE-2026-0768 with a CVSS score of 9.8, in the Langflow AI low-code platform is being actively exploited. The flaw allows unauthenticated attackers to execute arbitrary code with root privileges, leading to reconnaissance and credential theft. Attacks have been observed originating from Russia.

September 1, 2026
4 min read
CVE-2026-0768LangflowAI SecurityRCEActive Exploitation +1 more
Critical RCE Flaw in Langflow AI Platform Actively Exploited

Critical RCE Flaw in SAUTER Building Controllers Threatens Physical Systems

CRITICAL

SAUTER Building Controller RCE Flaw (CVE-2026-78319) Disclosed

A critical remote code execution vulnerability (CVE-2026-78319, CVSS 9.8) affects SAUTER building automation controllers. The flaw, a TOCTOU race condition, could allow unauthenticated attackers to take full control of devices managing HVAC and other essential building systems. Patches are available.

September 1, 2026
4 min read
CVE-2026-78319SAUTERICSOT SecurityRCE +1 more
Critical RCE Flaw in SAUTER Building Controllers Threatens Physical Systems

EU Cyber Resilience Act's 24-Hour Reporting Mandate Starts Sept 11

INFORMATIONAL

EU Cyber Resilience Act Reporting Rules Effective Sept 11, 2026

Manufacturers of connected products sold in the EU must comply with the Cyber Resilience Act's (CRA) new reporting obligations starting September 11, 2026. The rules mandate reporting actively exploited vulnerabilities and severe incidents affecting their products to ENISA within 24 hours.

September 1, 2026
4 min read
Cyber Resilience ActCRAEUENISACompliance +1 more
EU Cyber Resilience Act's 24-Hour Reporting Mandate Starts Sept 11

Phishing Campaign Targets 9,000+ Orgs with Debt-Relief Lures

MEDIUM

Large-Scale Phishing Campaign Uses Debt-Relief Vishing Tactics

A large-scale phishing campaign has targeted over 9,000 organizations with 24,700 debt-relief-themed emails in two weeks. The attack uses social engineering to trick victims into calling scammer-controlled phone numbers (vishing) to steal financial data and other personal information.

September 1, 2026
4 min read
PhishingVishingSocial EngineeringCheck PointCybercrime
Phishing Campaign Targets 9,000+ Orgs with Debt-Relief Lures

Updated Articles (3)

Attackers Hijack AI API Keys to Fuel Gray Market "Transfer Stations"

HIGH

Token Jacking: The New Threat to AI Development Resources

Update:

AI safety non-profit METR disclosed two security incidents, providing a real-world example of the 'token jacking' threat. In March 2026, a stolen API key led to approximately $600,000 in fraudulent AI credit consumption, confirming the significant financial risk highlighted in the original report. A separate, sustained campaign in May 2026 involved automated infrastructure probing, credential stuffing, and phishing attempts, aligning with the attack vectors previously identified. While no sensitive data was lost, these incidents underscore the critical need for robust AI resource security and credential management.

August 6, 2026
Updated: September 1, 2026
8 min read
Token JackingAI SecurityAPI SecuritynpmSupply Chain Attack +3 more
Attackers Hijack AI API Keys to Fuel Gray Market "Transfer Stations"

Threat Actors Use AI Scripts to Target Siemens PLCs in Critical Infrastructure

HIGH

AI-Generated Attacks Target Siemens PLCs

Update:

Forescout's Vedere Labs successfully used AI to port an RCE exploit (CVE-2021-31886) between two WAGO PLC models in just over 8 hours for $535. This experiment provides concrete evidence for how AI can dramatically accelerate exploit development against industrial control systems, lowering the barrier to entry for threat actors. The research directly supports warnings about AI-driven threats to critical infrastructure, such as the ongoing campaign targeting Siemens PLCs. It highlights the increased speed of attack and the potential for a wider range of actors to develop sophisticated OT exploits, posing a significant escalation in the threat landscape for critical infrastructure.

August 28, 2026
Updated: September 1, 2026
5 min read
ICSSCADASiemensPLCCritical Infrastructure +4 more
Threat Actors Use AI Scripts to Target Siemens PLCs in Critical Infrastructure

McKesson Discloses Breach After ShinyHunters Claims Patient Data Theft

HIGH

McKesson Data Breach Claimed by ShinyHunters Extortion Group

Update:

The ShinyHunters group has issued a $55 million ransom demand to McKesson following the data breach. New information indicates that the attack targeted not only Snowflake but also Salesforce instances, impacting customer data in oncology, multispecialty, and medical-surgical business units. This confirms a double-extortion tactic by the threat actors, significantly increasing the financial and operational implications of the incident.

August 29, 2026
Updated: September 1, 2026
5 min read
Data BreachShinyHuntersHealthcareSnowflakeData Exfiltration +1 more
McKesson Discloses Breach After ShinyHunters Claims Patient Data Theft

📢 Share This Publication

Help others stay informed about cybersecurity threats

📅 Daily Edition

Curated and deduplicated every day from dozens of trusted sources — giving you one clean, consolidated view of what matters in cybersecurity.

🔢 Deduplication Applied

Related stories are merged into a single evolving article rather than repeated as separate entries — cutting through noise so you only read what's new.

🔗 Full Articles Linked

Every entry links to its full enriched article — complete with MITRE ATT&CK mappings, extracted IOCs, and actionable detection and mitigation guidance.