--- title: JFrog's Artifactory bug gets exploited, BGP hijack hits... description: Today's supply chain stories aren't hypothetical: a critical JFrog Artifactory auth bypass is being actively exploited days after disclosure, and a BGP hijack... canonical: https://daily.dev/posts/jfrog-s-artifactory-bug-gets-exploited-bgp-hijack-hits-softaculous-for-33-hours-cchnkhnsi twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: JFrog's Artifactory bug gets exploited, BGP hijack hits Softaculous for 33 hours | daily.dev og:description: Today's supply chain stories aren't hypothetical: a critical JFrog Artifactory auth bypass is being actively exploited days after disclosure, and a BGP hijack... og:url: https://daily.dev/posts/jfrog-s-artifactory-bug-gets-exploited-bgp-hijack-hits-softaculous-for-33-hours-cchnkhnsi og:image: https://api.daily.dev/og/posts/ccHNKhnSi.png og:image:alt: JFrog's Artifactory bug gets exploited, BGP hijack hits Softaculous for 33 hours og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # JFrog's Artifactory bug gets exploited, BGP hijack hits Softaculous for 33 hours **[Backend Digest](https://daily.dev/sources/backend_digest)** · 4 min read · 0 upvotes · 0 comments ## Summary Today's supply chain stories aren't hypothetical: a critical JFrog Artifactory auth bypass is being actively exploited days after disclosure, and a BGP hijack redirected Softaculous update traffic to malware for over a day. On the infrastructure side, S3-backed write-ahead logs are becoming a real pattern for stateless storage systems, and Cloudflare squeezed 100TB of RAM out of its DNS cache with some careful Rust restructuring. There's also a good TLA+ writeup on how retry storms become self-sustaining even when every component's contract still holds. ## Content **TLDR:** Today's supply chain stories aren't hypothetical: a critical JFrog Artifactory auth bypass is being actively exploited days after disclosure, and a BGP hijack redirected Softaculous update traffic to malware for over a day. On the infrastructure side, S3-backed write-ahead logs are becoming a real pattern for stateless storage systems, and Cloudflare squeezed 100TB of RAM out of its DNS cache with some careful Rust restructuring. There's also a good TLA+ writeup on how retry storms become self-sustaining even when every component's contract still holds. --- ## JFrog Artifactory auth bypass actively exploited, admin tokens already minted CVE-2026-82329 (CVSS 9.8) lets unauthenticated attackers with network access grab admin privileges via a 'phantom' join key on instances missing a second configured join key. watchTowr saw attackers minting admin tokens and enumerating users, groups, and credentials as early as September 1, just days after JFrog's August 28 disclosure. Patches are out (7.111.21 through 7.161.20), but they don't revoke tokens minted before the fix, so rotating admin tokens and auditing logs is not optional here. [Read more](https://daily.dev/posts/fl2nmMeCb) ## BGP hijack turned a Softaculous update into a malware drop for 33 hours Attackers exploited weak BGP filtering at Hetzner to hijack the IP space Softaculous uses to serve Virtualizor updates, and pushed malware disguised as legitimate patches. The update client never verified packages cryptographically, so there was nothing to reject the payload. Hetzner reclaimed the address space once, the attacker just took it back, and it took nearly 10 hours to respond the second time. [Read more](https://daily.dev/posts/bt4TZaZNE) ## S3 as the write-ahead log: how Turbopuffer, Chroma, and WarpStream skip Raft entirely A growing pattern uses S3 as the source of truth for WALs instead of local disk plus replication, letting compute nodes stay fully stateless. It works because S3 gives strong read-after-write consistency and conditional writes via If-None-Match, which lets multiple writers order a log without leader election. The tradeoff is real: a single S3 round trip costs tens of milliseconds, so these systems batch and accept 100-200ms commit latency in exchange for never managing replication topology or leader failover. [Read more](https://daily.dev/posts/RywHYJXZX) ## Cloudflare freed 100TB of RAM by rewriting its DNS cache's memory layout Behind 1.1.1.1, Cloudflare's Big Pineapple cache dropped per-entry memory from 953 to 420 bytes by replacing growable Rust Vecs with fixed-size layouts, deduplicating pointers, and restructuring an enum so small record types stopped inheriting the size of the largest variant. Insert throughput went from 625K to 893K entries/sec, and p99 memory per instance dropped from 9.3GB to 5.3GB. This is a genuinely useful pattern reference if you're storing lots of small variably-sized records in Rust and paying for it in RAM. [Read more](https://daily.dev/posts/0SHazuX5H) --- ## Also notable - **TLA+ model shows retry storms self-sustain past a queue threshold even when every contract holds:** A compositional (rely-guarantee) TLA+ model of a retrier-server system finds retry storms become permanently self-sustaining above Q0=18 queued requests (vs recovering below Q0=5), and proposes two fixes: capping retry flux with a token-bucket budget, or switching the server to fresh-first service instead of proportional splitting. [Read more](https://daily.dev/feed-by-ids?id=Kla8cI7In&id=2Na43fwMI) - **ClickHouse's MySQL CDC connector goes GA with parallel snapshotting:** The GA release cuts a 1TB MySQL snapshot from over a day to about an hour using 32 parallel workers, and adds GTID-based replication plus a 72-hour minimum binlog retention as safer production defaults, with billing starting September 1, 2026. [Read more](https://daily.dev/posts/ON4YKiJYn) - **RFC 10008 finally standardizes an HTTP QUERY method, but zero providers have adopted the Accept-Query header:** QUERY is safe and idempotent like GET but carries a body like POST, finally giving search endpoints an alternative to the POST /resource/search workaround that breaks caching, yet none of 26,641 tracked API providers currently declare Accept-Query support. [Read more](https://daily.dev/posts/Jx5IML04M) - **Debezium's INT vs INTEGER mismatch traced to an 8-year-old matcher gap:** A type matcher added to Debezium in May 2017 never included the INTEGER UNSIGNED variant, so streaming mode encoded it as int32 while snapshot mode correctly produced int64, and because the connector never reads back from Schema Registry, a snapshot alone couldn't fix the stale streaming schema. [Read more](https://daily.dev/posts/seqLMDcJO) ## Similar posts on daily.dev - [Exploited JFrog Artifactory bug puts software supply chain on alert](https://daily.dev/posts/exploited-jfrog-artifactory-bug-puts-software-supply-chain-on-alert-fl2nmmecb) · CSO Online · 2 upvotes · 0 comments - [Another Artifactory CVE under attack by AI agents or humans](https://daily.dev/posts/another-artifactory-cve-under-attack-by-ai-agents-or-humans-gtk0sg7ar) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#rust](https://daily.dev/tags/rust) [View this post on daily.dev](https://daily.dev/posts/jfrog-s-artifactory-bug-gets-exploited-bgp-hijack-hits-softaculous-for-33-hours-cchnkhnsi) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/jfrog-s-artifactory-bug-gets-exploited-bgp-hijack-hits-softaculous-for-33-hours-cchnkhnsi","headline":"JFrog's Artifactory bug gets exploited, BGP hijack hits Softaculous for 33 hours","text":"Today's supply chain stories aren't hypothetical: a critical JFrog Artifactory auth bypass is being actively exploited days after disclosure, and a BGP hijack redirected Softaculous update traffic to malware for over a day. On the infrastructure side, S3-backed write-ahead logs are becoming a real pattern for stateless storage systems, and Cloudflare squeezed 100TB of RAM out of its DNS cache with some careful Rust restructuring. There's also a good TLA+ writeup on how retry storms become self-sustaining even when every component's contract still holds.","url":"https://daily.dev/posts/jfrog-s-artifactory-bug-gets-exploited-bgp-hijack-hits-softaculous-for-33-hours-cchnkhnsi","datePublished":"2026-09-03T04:18:06.937Z","dateModified":"2026-09-03T04:18:28.874Z","author":{"@type":"Organization","name":"Backend Digest","logo":"https://media.daily.dev/image/upload/s--9uCSrsAb--/f_auto,q_auto/v1773839398/logos/backend_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/backend_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/backend_digest","name":"Backend Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Backend Digest","item":"https://daily.dev/sources/backend_digest"},{"@type":"ListItem","position":3,"name":"JFrog's Artifactory bug gets exploited, BGP hijack hits Softaculous for 33 hours"}]} ```