Attackers chained two JFrog Artifactory flaws on unupdated servers to gain admin control, while a third flaw was exploited separately.