InfoSec.Watch - Issue #152

Exploitation: confirmed — malicious code executed at build time; malicious versions removed.

Rust’s Security Response Team disclosed a supply-chain attack involving the crates.io ecosystem after verifying that the proc-macro1 crate used a build script to download a malicious payload. The team says arrayref version 0.3.10 was republished to depend on the malicious crate, while internment 0.8.7 and append-only-vec 0.1.9 were also affected. The malicious versions were removed after being available for roughly 86 to 107 minutes, and the affected maintainer account was locked. Rust’s team says it does not believe the crate author acted maliciously and assesses that the author’s computer or credentials were likely compromised.

The short exposure window does not make this a short-lived problem. Cargo caches, CI runners, builder images, lockfiles, artifacts, and credentials reachable from build systems can preserve the consequence after the registry entry disappears.

Sources: Rust Security Response Team

Exploitation: active targeting and capability development per NSA/FBI; not evidence of widespread successful compromise.

The NSA and partner agencies warned that cyber actors are conducting targeted reconnaissance and capability development against U.S.-based Siemens S7 series programmable logic controller installations. The agencies say the activity includes AI-generated exploitation scripts disguised as legitimate monitoring tools. The warning spans critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities, and the NSA cautions that the activity is not necessarily limited to Siemens products.

This is an active-threat warning, not evidence that every exposed PLC has been compromised. That distinction matters. But it is enough to change the priority of internet exposure, remote engineering access, and monitoring around industrial control assets. Poorly protected PLCs can translate a cyber foothold into process disruption, equipment damage, or safety consequences.

Sources: NSA · FBI

Exploitation: confirmed — CISA KEV entry Aug 19.

CVE-2026-64849 is a critical server-side request forgery issue in MLflow’s model-registry webhook delivery path. MLflow’s advisory explains that redirects and DNS rebinding can bypass SSRF protections, allowing an attacker to make the tracking server reach internal services or cloud metadata endpoints. The webhook test path can also return response data to the requester. NVD records the vulnerability in CISA’s Known Exploited Vulnerabilities catalog with an August 19 entry date, and lists versions before 3.15.0 as affected. MLflow 3.15.0 includes the fix for the DNS-rebinding SSRF bypass.

The risk is broader than “an ML tool has an SSRF.” MLflow is often placed near models, artifacts, credentials, cloud services, and internal infrastructure. A server-side callback feature therefore inherits network trust that an external attacker may not otherwise have.

Sources: MLflow advisory · MLflow 3.15.0 release · NVD

Exploitation: confirmed — CERT Polska; CISA KEV entry Aug 21.

CERT Polska reported active exploitation of CVE-2026-73570, an unauthenticated command-injection flaw in Zimbra Collaboration’s SNMP monitoring path when notifications are enabled. Zimbra lists 10.1.20 as the fixed release. CISA added the CVE to its Known Exploited Vulnerabilities catalog on August 21. CERT Polska also published concrete log and filesystem locations defenders can use to hunt for exploitation.

Sources: CERT Polska · Zimbra · CISA

Exploitation: not established in retrieved sources.

Citrix published fixes for CVE-2026-19490, a critical authentication-bypass issue affecting NetScaler ADC and Gateway in specified Gateway/AAA configurations, alongside CVE-2026-19489, a SIP ALG denial-of-service flaw. Citrix says there are no workarounds for the affected configurations and directs customers to the fixed builds.

Source: Citrix

Exploitation: not established in retrieved sources.

GitLab’s 19.2.4, 19.1.6, 19.0.8, and 18.11.11 patch releases address CVE-2026-19478. Under certain conditions, GitLab says an unauthenticated user could remotely modify or delete public projects and user data. GitLab.com and Dedicated were already patched; self-managed customers should update.

Source: GitLab

Exploitation: confirmed — ongoing ransomware operation per FBI/CISA.

An August 18 update to the joint Medusa ransomware advisory adds investigative findings through April 2026, including more than 500 victims across multiple critical-infrastructure sectors. The FBI also describes rapid exploitation of newly disclosed flaws, use of initial-access brokers, and Interactsh infrastructure used to validate successful exploitation.

Source: FBI

Exploitation: confirmed — all four in CISA KEV.

On August 18, CISA added four vulnerabilities to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation: CVE-2026-33824 (Microsoft IKE Service Extensions double free), CVE-2026-55040 (Microsoft SharePoint weak authentication), CVE-2026-59310 (Broadcom VMware vCenter path traversal), and CVE-2026-65400 (Apple macOS improper authentication). All four had vendor fixes before exploitation was confirmed. Federal agencies were given until August 21.

Source: CISA

The pattern this week is the clock, not the category. Rust’s arrayref versions were malicious for about 86 to 107 minutes before removal, yet anything that pulled them in that window still has to be hunted down. MLflow’s CVE-2026-64849 reached CISA’s exploited catalog the same week its fix shipped; Zimbra’s CVE-2026-73570 got there four days after CERT Polska reported attacks; and the four flaws CISA added on August 18 (vCenter, SharePoint, macOS Screen Sharing, Windows IKE) were all exploited after vendor patches existed. The FBI’s Medusa update says the group weaponizes new disclosures within 24 hours. Patch cadence is no longer the only number that matters. The other is how far back your evidence lets you look when the patch arrives after the exploit.

Action: Hunt Rust development and CI environments for the malicious crates and affected package versions disclosed in the crates.io incident. Treat any positive hit as a potential build-host compromise until investigation shows otherwise.

Who runs it: AppSec or DevSecOps with CI/platform owners. Escalate positive findings to SOC/incident response.

Check these specifically: [email protected], [email protected], [email protected], and any version of proc-macro1, proc-macro-en, aovine, arone, aronenao, or tinymember. Search Cargo.lock files, developer Cargo registries, shared CI caches, builder/container layers, and retained outbound-network logs around the August 20 incident window.

Evidence you're done: Saved scan/query output covering developer and CI caches; an inventory of affected lockfiles/projects; evidence that contaminated caches or builders were rebuilt; and, for any positive hit, an incident record documenting scope and rotation of CI, cloud, registry, or other credentials that were reachable from the build environment.

A vulnerability’s severity is fixed at disclosure. Its cost to you is set by two dates you control: when the fix reached the system, and how far back you can see what happened before it did. Every story this week narrows the space between those dates. Rust removed its malicious crates in under two hours; the question for anyone who built during that window is not the patch but the residue in caches, images, and tokens.

The Aug 18 KEV batch makes the same point from the other side: four fixes were available and four exploits ran anyway. The mature response to a short exploitation window is not faster patching alone. It is retained logs, build provenance, and network egress records that let you close a ticket with evidence rather than an assumption.