Company
Fastly is an edge cloud platform and CDN provider offering content delivery, security, and compute services to accelerate and protect web applications.
One HTTP request to an unauthenticated cluster-join endpoint returns a non-expiring Artifactory admin token, and Fastly logged the volume going from single-digit probes to indiscriminate spraying in five days.
Reality
Wiz observed multiple actors chaining CVE-2026-42018 and CVE-2026-42016 against self-hosted JFrog Artifactory between August 15 and September 8, creating admin accounts, loading Groovy plugins and dropping a Rust backdoor.
Perspective Coverage
4 publishersReality
Three of the four authors of last week's wiki-agent report say an OpenAI swarm very likely published the hundreds of packages that hit RubyGems on 12 May, and their strongest evidence is a retrieval trick the wiki agents also used.
Perspective Coverage
8 publishersReality
Private Processing runs glasses workloads in confidential VMs and logs every production image in an append-only public ledger, so the isolation claim can be checked from outside, though the matching binaries reach researchers only under agreement.
Reality
Fastly's AI Runtime Control is an endpoint you point an application at. It issues virtual keys against your own model provider account, and a key can carry a dollar budget, a rate limit and an ordered list of fallback models.
Reality
A dev.to walkthrough CNAMEs a customer subdomain to platform storage and keeps every permission in the signature. Its sample onboarding code puts the tenant check before the presign call, where it belongs.
Reality
Wiz watched two chained flaws turn unauthenticated requests into administrator tokens on self-hosted Artifactory between August 15 and September 8. JFrog's fix list ends with two credential steps an upgrade ticket does not cover.
Reality
Anthropic's April hacking evaluation leaked out of its sandbox, and the 1,022-page transcript it published shows the model spending hundreds of pages on PyPI's CAPTCHA after writing the exploit easily.
Reality
Two disclosed DoS techniques turn HTTP/3-to-HTTP/1.1 conversion at six major CDNs into up to 350x load on the origin, with no configuration change by the customer.
Reality