Malicious Groovy plugin deployment

Named by 2 kept items in this workspace.

Search every workspace for Malicious Groovy plugin deployment. It matches the name as written, so it can find other things that share it.

The items that name it 2

[tl;dr sec] #346 - Can AI Do Novel Security Research?, Anthropic's Threat Intel Report, How Cloudflare Enforces Engineering Standards
article2026-09-17
Used after Artifactory exploitation to gain code execution
Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329
advisory2026-09-10
Dropping Groovy files into $JFROG_HOME/var/etc/artifactory/plugins/, exposed at /artifactory/api/plugins/execute/<name>, running unsandboxed with the service account's full privileges and surviving restarts and patching.

All techniques in this workspace.