On September 3, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added seven vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog in one go. Two of them land squarely on software people install on their own servers:

  • CVE-2026-49869 — Kestra OSS command injection, CVSS 10.0
  • CVE-2026-59822 — Berri LiteLLM improper authentication, CVSS 8.8

The other five: CVE-2026-83548 (SonicWall SMA 1000 server-side request forgery, 10.0), CVE-2026-83549 (same product, OS command injection, 7.8), CVE-2026-9586 (Sangoma Switchvox SQL injection, 9.3), CVE-2026-82329 (JFrog Artifactory improper authentication, 9.8) and CVE-2026-48710 (Kludex Starlette HTTP smuggling, 6.5).

The Attackers Aren't After Data — They're After Your CPU

The observed post-exploitation behaviour is documented: attackers deployed reverse shells and established persistence; against LiteLLM deployments they dropped an XMRig miner via an ELF binary; and the Kestra compromise enabled shell execution through the workflow engine, again ending in miner deployment and host resource hijacking.

This is worth spelling out. When the thing you self-host is an internal tool, it's tempting to think "there's no customer data in there, so who cares". Mining doesn't need your data to be profitable — it needs CPU time and bandwidth. The bill and the provider's abuse notice both arrive at your address.

Why This Batch Is So Close to Home for VPS Users

Look at the software types: LiteLLM is the gateway a lot of people put in front of multiple model APIs, Kestra is a workflow and scheduling engine, Artifactory is an artifact repository, and Starlette is the framework underneath FastAPI. Every one of these is a classic "I'll just run one on my VPS" component — and their quick-start docs, in the interest of getting you running in three minutes, very often bind to 0.0.0.0. Install it, never revisit it, and it is on the public internet.

The remediation deadlines say something about urgency too: five of the seven had to be handled by September 5, with CVE-2026-48710 and CVE-2026-59822 due September 16. KEV deadlines legally bind US federal agencies only, but for everyone else the "confirmed exploited in the wild" label is the best patch-prioritisation signal available — it tells you more about present danger than a CVSS number does.

A Three-Minute Self-Check

  • Is your CPU being eaten? uptime for load, ps aux --sort=-%cpu | head for the culprit. Sustained full load with no matching traffic is the classic symptom; diagnosing 100% CPU usage on a VPS walks the full path.
  • Any strange outbound connections? ss -tnp state established, paying attention to anything heading for common mining-pool ports like 3333, 5555, 7777 and 14444, plus domains you don't recognise.
  • Check persistence: crontab -l, ls -la /etc/cron.*, systemctl list-timers, ls -la ~/.config/systemd/user/. A miner rarely runs as one lonely process; it will try to survive a reboot.
  • Check your exposure: ss -tlnp lists every listening port. For each one starting with 0.0.0.0:, ask out loud whether it genuinely needs to be reachable from the internet.

How to Deploy This Class of Software Properly

  • Bind to loopback by default. Admin UIs and internal APIs go on 127.0.0.1; reach them over an SSH tunnel (ssh -L 8080:127.0.0.1:8080 user@host) or WireGuard, rather than opening a public port and putting a weak password on it.
  • If it must be public, put a reverse proxy in front, add real authentication (not the app's built-in default admin), restrict by IP, and set the firewall to deny inbound by default — VPS security hardening with ufw and SSH key login has the exact commands.
  • Upgrade to the fixed releases, and give every self-hosted component an owner who reads its security advisories. Three minutes to install, then three years of nobody watching, is the shared script behind these incidents.

If You've Already Been Hit

Don't stop at "kill the process, delete the file". An entry point good enough to drop a miner is good enough to drop other things, and persistence is rarely in one place only. Follow how to investigate and re-secure a compromised VPS: collect evidence before cleaning, rotate every credential, and rebuild if you can. SharkCloud's Japan, Singapore, Hong Kong and US nodes are independent instances, and standing up a clean machine and migrating data back is usually both faster and more trustworthy than performing surgery on a box you no longer control.