Kodem Security Research Team

JFrog Artifactory Under Attack: Affected Versions, IOCs, and the First-Hour Response Runbook

JFrog Artifactory vulnerability chain CVE-2026-82329, CVE-2026-42018 and CVE-2026-42016 reached admin in under five minutes. Affected versions, IOCs, runbook.

CVE-2026-78676: How a Dormant git-config Value Becomes Code Execution in GitPython

CVE-2026-78676 turns dormant git-config values into live core.hooksPath directives on any GitPython write. Affected versions, the 3.1.59 fix, and the runbook.

scrambleeeer PyPI Reverse Shell: The Payload That Waits for You to Call It

scrambleeeer and scrambleeer hid a PyPI reverse shell that fires on library use, not install. Get the affected versions, the IOCs, and the first-hour runbook.