Iranian state-sponsored hackers affiliated with the Ministry of Intelligence and Security (MOIS) have been using a previously undocumented modular command-and-control (C2) framework…
Security firm Sysdig has identified what it believes is the first ransomware attack fully orchestrated by an AI agent, dubbed JADEPUFFER. The…
An AI-agent-driven operator first documented by Sysdig. Deployed ENCFORGE ransomware against Langflow servers, using Docker socket for host breakout. Previously used throwaway…
The first known case of agentic ransomware, codenamed JADEPUFFER, where a human operator deployed an artificial agent to handle the entire extortion…
Threat actors are actively exploiting CVE-2026-33017, a critical unauthenticated remote code execution vulnerability in Langflow (CVSS 9.3), to deploy a Monero cryptocurrency…
Langflow versions before 1.3.0 expose the /api/v1/validate/code endpoint without authentication, allowing remote attackers to execute arbitrary Python code. CVSS score 9.8. Added…
Flodrix is a botnet malware that was distributed via exploitation of CVE-2025-3248 in Langflow in June 2025, demonstrating the ongoing targeting of…
A high-severity path traversal vulnerability in Langflow, designated CVE-2026-5027 (CVSS 8.8), is being actively exploited in the wild. Discovered by Tenable, the…
A critical RCE vulnerability in Langflow (CVSS 9.8) that was exploited by the AI-driven threat actor but failed due to restrictive configurations.
Langflow is an open-source AI application development platform that has been targeted by multiple RCE vulnerabilities.