[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyqNo2AVfOq_WRtDJL1qn_Ro1-FZM6qjZJHysbSRrZb4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":58},"e162d046-51f8-4d3a-bf70-2abb94d26301","seven-actively-exploited-flaws-added-to-cisa-kev-reverse-shells-and-crypto-miners-in-the-wild","055dd0a8-052e-4338-b40e-693b50a63bbd","Seven Actively Exploited Flaws Added to CISA KEV: Reverse Shells and Crypto Miners in the Wild","Threat actors are actively exploiting seven newly catalogued vulnerabilities across widely deployed products from SonicWall, Sangoma, JFrog, and others, using them to deploy reverse shells, escalate privileges, and install cryptocurrency miners. The chaining of multiple vulnerabilities — linked in at least one case to Qilin ransomware operators — demonstrates that unpatched systems in internet-facing positions can become entry points for severe, multi-stage attacks. CISA's Known Exploited Vulnerabilities catalog serves as a critical signal that these flaws are being weaponized in the wild, not just theoretically possible. Organizations that lack timely patch cycles or continuous vulnerability scanning are at acute risk of full compromise, data loss, or ransomware deployment.","**Immediate Actions:**\n- Apply patches or vendor-recommended mitigations for all seven CISA KEV-listed vulnerabilities across SonicWall, Sangoma, JFrog, Kludex, Kestra, and Berri LiteLLM products immediately.\n- Run an authenticated vulnerability scan against all internet-facing assets to identify any exposure to the newly catalogued CVEs.\n- Temporarily restrict or firewall external access to affected services until patches are confirmed applied.\n\n**Long-Term Improvements:**\n- Establish a formal emergency patching SLA (e.g., 24–72 hours) for any vulnerability appearing on the CISA KEV catalog.\n- Maintain a continuously updated asset inventory that maps software versions to known vulnerabilities, enabling rapid impact assessment.\n- Implement network segmentation to isolate internet-facing appliances and limit lateral movement if a perimeter device is compromised.\n\n**Detection Measures:**\n- Deploy endpoint and network-based detection rules targeting reverse shell behaviors, unauthorized outbound connections, and cryptocurrency mining process signatures.\n- Monitor logs from edge devices (firewalls, gateways, API servers) for anomalous authentication events, privilege escalation attempts, and unexpected process spawning.\n- Subscribe to CISA KEV catalog alerts and integrate them into your vulnerability management platform for automated prioritization.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SI-3: Malicious Code Protection","NIST SC-7: Boundary Protection","NIST RA-5: Vulnerability Monitoring and Scanning","CISA KEV Catalog Binding Operational Directive (BOD) 22-01","ITIL 4: Change Enablement (emergency change procedures)","NIST CSF 2.0: DE.CM (Continuous Monitoring)","NIST CSF 2.0: RS.MI (Incident Mitigation)",{},"published","2026-09-03T08:20:55.670771+00:00","2026-09-03T08:20:55.577+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fcisa-adds-seven-exploited-flaws-as.html","cisa-adds-seven-exploited-flaws-as-attackers-deploy-reverse-shells-and-crypto-mi-bf0dad","CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":40,"name":41,"slug":42,"description":43,"color":44},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",{"id":46,"name":47,"slug":48,"description":49,"color":50},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[52],{"id":53,"date":54,"edition":55,"title":56,"audio_url":57},"1cf74fcc-130b-4c3c-8eb6-1da1cae97627","2026-09-03","afternoon","ThreatNoir Afternoon Brief — September 3","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-03\u002Fthreatnoir-afternoon-brief-2026-09-03.mp3",[59,62,65],{"slug":36,"name":60,"problem":61},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":42,"name":63,"problem":64},"Automated patch management","Known holes get closed in days, not months.",{"slug":66,"name":67,"problem":68},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]