As an avid football watcher, I obviously have been doing Fantasy football for a number of years now.
In my early days being an AI Engineer I tried to crate an algorithm and all these different prediction charts and models to find the best picks and most importantly, the best sleeper picks.
And what I have found... is that it is basically just random luck. There is no algorithm currently available that you can you use to get all the sleeper picks and dominate your fantasy league because you could predict the future.
But compared to cybersecurity, we can actually create some models NOT to predict the future but to instantly catch and flag malicious behavior in your network.
And with the current state of cybersecurity, the attackers were the sleeper picks everyday. The first touch looks like nothing. VPN traffic. A CI token. A vendor update. A print job. Then they wake up.
Here is what actually hit over the past seven days.
SonicWall SMA 1000, two new zero days, chained into RCE
The most pressing edge story this week is a new pair of holes on SonicWall SMA 1000. A new chain on the same product family that already sat in KEV last month. CVE-2026-83548, CVSS 10.0. Unauthenticated SSRF in the Appliance Work Place interface. CVE-2026-83549, CVSS 7.8. Command injection in the Appliance Management Console once the attacker already holds admin. SonicWall says they investigated a case that shows both being used together to run code on the box.
SMA 1000 models 6210, 7210, and 8200v. Builds 12.4.3-03453 and 12.5.0-02835 and older. Hotfixes are 12.4.3-03526 and 12.5.0-02952. SSL VPN on SonicWall firewalls and the SMA 100 line sit outside this advisory. Shadowserver still counts more than 400 of these appliances on the internet.
SonicWall has not named the actor and has not published IoCs. The ask is upgrade, then reimage, rotate every password, and reset TOTP if you find anything. Same product family that UTA0533 used in July with CVE-2026-15409 and CVE-2026-15410 to drop KNUCKLEBALL. CISA later tied that older pair to ransomware. This week's chain lands on the same front door.
The dodge is VPN traffic. An unauthenticated request into Work Place can look like a remote worker reaching an app. An EDR agent behind the gateway never sees root on the appliance. A playbook waiting for last month's KNUCKLEBALL hash has nothing for a chain that still has no public implant name. The tell is an SMA 1000 that starts talking to destinations and internals it has no history with after a Work Place hit.
And in a separate incident, the sleeper sat in the artifact store every build already trusts.
JFrog Artifactory, phantom join key, minted admin tokens
JFrog Artifactory, CVE-2026-82329, CVSS 9.8. Authentication bypass in JFrog Access on self managed instances. Default config. No login required. watchTowr says instances without an extra join key get a phantom join key that lets an attacker mint administrator tokens. JFrog patched it on August 28 in 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20. JFrog Cloud was already covered.
Exploitation started September 1, days after the writeup. Honeypots saw a small set of IPs from mixed geographies. Some hits were just CVE checks that stopped. Others enumerated users, groups, credential sets, and federated access topologies. In limited cases they created backdoor users. Guillermo Rauch called it an RCE bomb because Artifactory hosts the binaries downstream systems already pull. Collin Hogue-Spears noted that upgrading the binary does not kill a token already issued.
Minting a token and listing users can look like an admin API doing its job. Signature packs have nothing for a days old auth bypass with no malware family. The miss is treating that first Access call as business as usual while someone can already replace the artifacts the rest of the company installs.
Different attack, same week, and this time the trusted name was the hypervisor update itself.
BGP hijack pushes a poisoned Virtualizor update, then root
From late August 28 UTC through early August 30 UTC, an unauthorized BGP announcement diverted Softaculous traffic, including Virtualizor updates and the client billing portal. Virtualizor said the route was unauthorized. The attacker stood up a valid Let's Encrypt certificate during the window, so the diverted HTTPS showed no warning. The update client has no cryptographic package check. Installations that phoned home in that window could take a modified package.
Virtualizor calls it a handful of servers. AlbaHost, a hosting provider, checked 34 hypervisors and found the same malicious edits on 5. Three legitimate Virtualizor files were altered. A root cron ran the new code. An attacker key landed on the root account. Java 17 was installed if missing. A Java payload ran as root, persisted as java-jre-update.service, and created an account named proxyuser. AlbaHost logged a password SSH login to that account from 193.32.127.248. C2 sat at cdn.nerat.cc. The vendor scanner also looks for /usr/lib/jvm/.cache/jre-runtime.dat and edits in globals.php, _universal.php, and zzvirtservice.
Client area and payment traffic may have hit the attacker server. As of September 2, Virtualizor had not confirmed account or card theft. Patch 9, Virtualizor 3.2.9.9, shipped September 1 with a Security Analyzer. Cryptographic package signing is still future work. AlbaHost said a confirmed root box needs a clean rebuild.
EDR on a guest VPS never sees root on the hypervisor. A playbook waiting for a named ransomware family is watching the wrong layer. The leak is later. The early tell is a hypervisor that fetched an update from a prefix it has no history with, then held outbound C2 and a new SSH user.
Three names in and the fourth was the print server sitting in the building for years.
PaperCut NG and MF, unauthenticated RCE, confirmed customer hits
PaperCut NG and MF. PaperCut said it has confirmed customer incidents. Huntress reproduced an unauthenticated chain on a stock NG 25.0.11.75758 and saw limited exploitation on two customer boxes. CVE-2026-81578, CVSS 8.8, improper access control in the web management interface. An unauthenticated request can point the rendered page at one place and the executed component at another, so the auth check trusts the page it drew and misses the action behind it. That writes config. CVE-2026-82078, CVSS 9.4, unsafe dynamic class loading in the database connection utilities. Config plus a driver name with no allowlist becomes arbitrary Java inside pc-app.exe.
Huntress saw base64 commands that decoded to whoami & ver on August 26, under two minutes of activity, and whoami & ver & tasklist on August 27. A Java class named Udydn.class fingerprinted the host, listed files, wrote Udydn.out, then deleted the output and server.log. Derby booted an in memory database called pwn. Later reporting also tied SimpleHelp and AnyDesk to persistence on at least one path. watchTowr said probing moved to hands on keyboard, with in memory payloads keyed so only that operator could come back, consistent with initial access brokers. CISA put both CVEs in KEV with a September 14 federal deadline. Emergency Release 3 supersedes the first two patches. Huntress said 47 percent of the about 2,500 PaperCut installs they track still sit on v23 or older, with no patch for that branch.
A web request to the Application Server is what this product is for. An EDR waiting for a ransomware family name is late, and the actor deleted the log that would have held the Java blob. The tell is pc-app.exe spawning whoami, a Derby boot for a database named pwn, and then a print box that starts holding AnyDesk or SimpleHelp.
What this week means
SonicWall, JFrog, Virtualizor, PaperCut. Four separate incidents. The same shape underneath. The first touch looks like a name you already have on the board. VPN, artifact store, hypervisor update, print server. Then the sleeper wakes up. Trust is thickest there. Visibility is thinnest. After the first hit, the rest looks like a remote worker, a CI token, a vendor patch, or a print job.
Detections stay broken for attacks that do not match a named playbook. LogLM is a foundation model built as an encoder on network metadata. It learns normal deeply enough that a genuine deviation is legible on its own, with no prewritten signature for that CVE or family required first.
On SonicWall, the first Work Place request can be thin in netflow. A completed campaign still needs C2 off that appliance or reach into hosts the VPN sits in front of. That traffic sits outside a healthy SMA baseline. On JFrog, minting an admin token can look like Access doing its job. Poisoned artifacts leaving toward build agents, or a new federated topology, sit outside a healthy artifact baseline. On Virtualizor, the update fetch to a hijacked prefix, the C2 to cdn.nerat.cc, and the SSH from 193.32.127.248 are the grammar. On PaperCut, the first unauthenticated config write may look like admin UI. whoami from pc-app.exe, then AnyDesk or SimpleHelp outbound, is recon and C2 on a print server that has no history with those destinations.
That is the generalizability. New name on the board, same grammar underneath it.
AI SOCs are only as good as the detections that feed them. When a zero day or a novel sequence slips past those detections, the rest of the stack has nothing left to reason over.
Draft night scores the big names. The sleeper is the traffic after kickoff. Branch61G keeps watching that layer.
Sources for this week include The Hacker News and BleepingComputer on SonicWall SMA 1000 CVE-2026-83548 and CVE-2026-83549, The Hacker News and BleepingComputer on JFrog Artifactory CVE-2026-82329 as reported by watchTowr, The Hacker News and BleepingComputer on the Virtualizor BGP hijack and AlbaHost hypervisor findings, and The Hacker News plus Huntress on the PaperCut NG and MF chain CVE-2026-81578 and CVE-2026-82078, later added to CISA KEV.
