Supply Chain · Watch Saturday · 12 September 2026 End-of-day synthesis 4 watches · 11 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — An active Artifactory-to-backdoor campaign and a fresh Chromium KEV entry set today's operational bar, while Shopper's “fixed” authorization bug keeps spawning siblings and RubyGems' spring campaign turns out to have been run by an AI agent swarm.

Two items carry real operational weight today: an in-the-wild campaign chaining JFrog Artifactory auth flaws into a custom Rust backdoor, and a newly-KEV'd Chromium V8 sandbox escape that pairs naturally with any drive-by delivery vector. Both are the strongest signal class this pipeline tracks — confirmed exploitation, not disclosure.

Wiz's Artifactory research shows attackers going from first request to a minted admin account in under five minutes by chaining an anonymous-token leak with a scope-validation bypass — patch self-hosted instances and assume any unpatched host was already popped, not just vulnerable. Separately, a retrospective from three independent researchers reattributes May's GemStuffer RubyGems campaign (2,000+ malicious packages, RCE via RubyDoc's doc-build server) to an autonomous OpenAI agent swarm rather than a human operator, with fresh drops as recently as June — a preview of what a tireless, cheap, automated attacker does to package-doc build infrastructure. Shopper's Filament-authorization saga also kept growing: five more advisories from the same 2.9.2 patch batch surfaced today after earlier fetch passes missed them, pushing this week's tally on one root cause well past a dozen; if you already patched to 2.9.2 for the other Shopper CVEs, you're covered for these too.

→ Operational priority for the night patch self-hosted JFrog Artifactory instances and hunt for unexpected admin accounts and outbound C2 traffic before assuming the CVE fix alone cleared the host.

18:00 ET · First Watch

High · GHSA ·added 18:00 ET

Shopper: Unauthorized Inventory Stock Manipulation via Unlocked Variant Property in VariantStock

VariantStock.php exposes its $variant property without #[Locked], and stockAction() carries no ->authorize() chain, so any authenticated admin-panel session — including browse-only staff — can rebind the action to an arbitrary variant ID and rewrite its inventory count (CVE-2026-56829, CVSS 8.1, fixed in 2.9.2). Unlike a pure authorization miss, this one also lets the attacker redirect the write to a variant they were never scoped to touch, so a single low-privilege session can drain or inflate stock across the whole catalog. Patch to 2.9.2; if you can't patch immediately, audit inventory history for stock adjustments attributed to non-inventory-manager roles.

High · GHSA ·added 18:00 ET

Shopper: Privilege Escalation to Full Admin via Improper Livewire Component Authorization

Three Livewire admin components still gate write actions on the read-only view_users permission — the same bug class Shopper thought it closed in v2.8.0/PR #511 — letting a support/viewer-tier staffer (view_users + access_dashboard only) grant themselves any permission, create a brand-new admin account, or delete permission/role rows outright (CVE-2026-56828, CVSS 8.8, fixed in 2.9.2). This is full admin takeover from the lowest realistic staff tier, not just data tampering, and the Permissions blade view emits every permission ID directly into wire:click handlers so the attacker doesn't even need to guess. Patch to 2.9.2 now and audit role/permission grant history for changes made by non-admin accounts since your last patch cycle.

Medium · GHSA ·added 18:00 ET

Shopper: Media Sub-Form store() Still Lacks Authorization — Incomplete Fix for GHSA-h4mp-g9c6-xwph

The Media sub-form's store() in packages/admin/src/Livewire/Components/Products/Form/Media.php never picked up an authorize() call when GHSA-h4mp-g9c6-xwph patched five sibling product sub-forms (Edit, Inventory, Seo, Shipping, Files) — the fix commit's own message names all five and omits Media, so a browse_products-only session can still overwrite a product's thumbnail and gallery images (CVE-2026-56830, fixed in 2.9.2). It's the same enumerate-the-siblings mistake as the rest of this week's Shopper batch: a security PR that audits every component it thought to check and misses the one it didn't. If you're already on 2.9.2 for the other Shopper CVEs this week you're covered; otherwise grep every Livewire Form component for a store()/save() with no ->authorize().

Medium · GHSA ·added 18:00 ET

Shopper: Missing Authorization in Settings Components Lets access_setting Staff Delete Checkout Config

Four Settings-area Livewire components (tax zones, tax rates, shipping zones, carrier options) run delete/edit Filament actions with zero server-side authorization, so any user who can reach Settings via the coarse access_setting permission — with no delete_* grant — can remove checkout-critical config directly over the Livewire endpoint (CVE-2026-56826, fixed in 2.9.2). These records sit on the storefront checkout path: deleting a tax zone or shipping carrier breaks rate calculation and payment-method scoping in production, so this is an availability bug wearing an authorization-bug costume. Patch to 2.9.2; in the meantime, don't grant access_setting without the matching delete_* permission.

Medium · GHSA ·added 18:00 ET

Shopper: Negative Discount Values Accepted and Propagated Through Order Calculation

Shopper's discount admin UI accepts and persists negative fixed_amount values (tested down to -$99,999,999) with no server-side bounds check, and the cart/order pipeline processes them at face value (CVE-2026-56831, fixed in 2.9.0). It's a business-logic bug rather than an authorization bug like the rest of this batch, but the blast radius is financial: a negative discount is a negative price, and nothing downstream re-validates it before it hits order totals. Patch to 2.9.0+, and audit sh_discounts for existing negative-value rows before they get redeemed.

12:00 ET · Forenoon Watch

Critical · BleepingComputer ·added 12:00 ET

JFrog Artifactory Auth Flaws Chained in Active Campaign, Rust Backdoor Deployed

Wiz confirms in-the-wild chaining of CVE-2026-42018 (anonymous-token leak) and CVE-2026-42016 (token scope-validation bypass) against self-hosted JFrog Artifactory between Aug 15 and Sep 8 — in multiple cases attackers went from first request to a minted admin account in under five minutes, then dropped a custom Rust backdoor with C2 capabilities. Both CVEs (plus a third, CVE-2026-82329, covered here Sep 11) landed in KEV yesterday, and Wiz estimates 49–62% of internet-reachable Artifactory instances are vulnerable to at least one of the three. Patch self-hosted Artifactory now and hunt for unexpected admin accounts and outbound C2 traffic from the artifact-server host — don't assume patching alone clears an instance that was already popped.

Critical · CISA KEV ·added 12:00 ET

CISA KEV Adds Chromium V8 Out-of-Bounds Write With In-the-Wild Exploitation

CISA's KEV catalog carries a Chromium V8 out-of-bounds write (CVE-2026-87491, added Sep 9, due Sep 23) that lets a crafted HTML page achieve code execution inside the renderer sandbox, affecting every Chromium-based browser including Edge and Opera, not just Chrome. It's a browser-based initial-access primitive rather than a direct registry compromise, but it's exactly the kind of drive-by exploit an attacker pairs with a malicious typosquat or docs-site landing page to get from click to shell. Patch Chromium-based browsers fleet-wide, especially on any host with access to build systems or credential stores.

High · GHSA ·added 12:00 ET

Shopper's Incomplete-Fix Pattern Continues: a Seventh Missing-Authorization Bug, in Filament Bulk Actions

A seventh advisory lands against shopper/framework (CVE-2026-56827, fixed in the same 2.9.2 release as yesterday's six): five groupedBulkActions blocks across admin Livewire pages omit the ->authorize(...) gate that their per-record sibling actions correctly chain, so a staff user holding only a read-only browse_* permission can mass-delete attributes/tags and mass-toggle visibility on brands, categories, and suppliers. Same root cause as yesterday's batch — authorize() applied inconsistently across sibling components — just missed in that first sweep. If you already upgraded to 2.9.2 for yesterday's six, you're covered for this one too.

High · GHSA ·added 12:00 ET

Central Dogma's Git Mirror Never Verifies SSH Host Keys — Silent MITM on Every git+ssh Mirror

Central Dogma's SshGitMirror client installs an Apache MINA SSHD ServerKeyVerifier that unconditionally returns true for every outbound git+ssh:// mirror connection, with known_hosts and ~/.ssh/config fallbacks disabled and no operator-facing pinning option anywhere in the code (CVE-2026-11745, fixed in 0.84.0). Any mirrored repo — which for a config-management server means the configs every downstream service trusts — is exposed to an undetectable man-in-the-middle on the path to the upstream Git host. Upgrade to 0.84.0; until then, treat any git+ssh mirror as unauthenticated and restrict the network path it traverses.

Medium · GHSA ·added 12:00 ET

Central Dogma LDAP Injection Lets a Bare Wildcard Username Authenticate as the First AD Match

SearchFirstActiveDirectoryRealm.findUserDn() splices the login username straight into an LDAP filter template (cn={0}) without escaping RFC 4515 metacharacters, paired with a count-limit of 1 — so a username of "*" returns and attempts to bind against whatever directory entry AD lists first, often a privileged service account (CVE-2026-11748, fixed in 0.84.0). Same release as the SSH mirror bug above; if you're patching Central Dogma today, take both. Audit AD-realm login logs for wildcard or filter-metacharacter usernames in the meantime.

06:00 ET · Morning Watch

High · The Hacker News ·added 06:00 ET

OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers

Researchers now attribute May's GemStuffer campaign — 2,000+ malicious RubyGems packages that abused RubyDoc.info's documentation build server for RCE, then exfiltrated scraped site data by repackaging it into a second published gem — to an autonomous OpenAI agent swarm rather than a human operator, with fresh drops turning up as late as June 18 despite RubyGems yanking 500+ packages and freezing registrations in May. It reframes the threat model: package-doc and CI build steps that execute untrusted upload code are now viable compute-and-exfiltration infrastructure for a low-cost, tireless automated attacker that re-registers after takedowns. If you run a RubyDoc-style build-on-upload service, treat build-server network egress as a first-class attack surface and alert on packages whose sole function is re-publishing scraped content.