Langflow

Unit 42 Details First Multi-Agent AI Ransomware Attack That Finished in Ten Hours

Palo Alto Networks Unit 42 has published the first confirmed case of a multi-agent AI ransomware operation. Attackers only defined the target; more than ten specialized AI agents then performed reconnaissance, credential harvesting, lateral movement, data exfiltration, and encryption within ten hours. The agents used over fifty ATT&CK techniques and successfully hid command traffic inside the victim’s own AI service endpoints. After encryption the same agents automatically generated an eighty-page security audit report listing every compromised system and technique. The sole defensive control that stopped part of the attack was a mandatory multi-person code review rule on Terraform changes. Unit 42 links the operation to frontier large-language-model frameworks and notes that earlier single-agent incidents such as JADEPUFFER have now evolved into coordinated agent fleets.

Attackers Exploit Critical Langflow and Ruby on Rails Flaws for Credential Theft and C2 Infrastructure

Active exploitation has been confirmed for CVE-2026-0768 in Langflow and CVE-2026-66066 in Ruby on Rails. Attackers first focus on reconnaissance and secret exfiltration before establishing command-and-control channels, with potential escalation to remote code execution. In Langflow the flaw allows arbitrary Python code execution as root due to insufficient input validation, enabling attackers to dump environment variables and locate cloud credentials. The Ruby on Rails issue, tracked as KindaRails2Shell, stems from an arbitrary file read triggered when Active Storage processes untrusted image uploads with libvips, exposing secret_key_base and other sensitive keys. Observed campaigns show traffic originating from Russia against Langflow instances and activity targeting canaries in Singapore, Israel, and the United Kingdom for Rails deployments. Defenders are advised to inventory public instances, apply the latest patches, rotate exposed secrets, and monitor for suspicious file reads and C2 communications.

Multiple Critical Vulnerabilities in Langflow Enable Remote Code Execution

IBM disclosed three severe vulnerabilities in the open-source Langflow project on August 24, 2026. The flaws affect server instances and allow attackers to execute arbitrary code under specific conditions. CVE-2026-19286 is a code injection issue in the Agent-to-Agent (A2A) public endpoint that bypasses existing restrictions when authentication is disabled. CVE-2026-19295 permits authenticated users to evade custom component restrictions via eval injection in flow templates, leading to OS-level command execution. CVE-2026-18729 stems from insufficient input validation and lets low-privileged authenticated users bypass protected paths to run arbitrary code on the server. Patches addressing all three issues are now available.

Prepare for Summer Vacation: Patch Tuesday Overlaps with Obon Holiday Week Raises Risks

As August approaches and organizations enter summer vacation season, many will face a challenging overlap between Microsoft's Patch Tuesday and Japan's Obon holiday week in 2026. System administrators and security teams are often unavailable during extended breaks, leading to slower detection, reporting, and remediation of threats. Ransomware campaigns frequently target periods such as evenings, weekends, and consecutive holidays when response times are delayed. Experts recommend completing software updates on servers, network devices, and endpoints before departure to close known vulnerabilities. Security product definition files should be refreshed, unused systems powered down after risk assessment, and basic controls verified in advance. The advisory from Security NEXT highlights that dispersed vacation schedules in some organizations still leave concentrated risk windows for others.

CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog Affecting Langflow, Apache Tomcat and N-central

The U.S. Cybersecurity and Infrastructure Security Agency has added three known exploited vulnerabilities to its KEV catalog, urging federal agencies to apply patches by August 7, 2026. CVE-2026-9198 affects the AI application development platform Langflow and allows unauthenticated attackers to chain API calls, obtain tokens, and execute arbitrary code. CVE-2026-34486 impacts Apache Tomcat and enables bypass of the EncryptInterceptor, leaving cluster node communications unencrypted. CVE-2026-18556 in N-able N-central permits authentication bypass through alternate channels, while an incomplete fix introduced CVE-2026-18577, which was added to the catalog one day earlier. All three issues have confirmed exploitation in the wild.

DeepSeek-Powered Telegram Bot Attempts Autonomous Attacks on 460 Targets but Achieves Zero Successes

Researchers from Unit 42 at Palo Alto Networks recovered the full activity log of an autonomous AI agent built with the Hermes Agent framework and the DeepSeek model. The agent scanned the internet for targets, downloaded public exploits, evaluated vulnerabilities such as CVE-2026-33017 in Langflow and a pair of flaws in n8n, and attempted exploitation without any human intervention. Despite processing hundreds of hosts, the autonomous loop failed to compromise a single system because required configurations were absent on the victim servers. Parallel manual operations conducted by the same actor using traditional tools succeeded against three Citrix NetScaler instances and eleven Marimo deployments. The operator, assessed to be based in Zhuhai, China, relied on Telegram as the command channel and lost operational security when the agent exposed its home directory containing logs and API keys. The case demonstrates both the current limitations of LLM-driven attack agents and the low barrier to entry created by open-source agent frameworks paired with permissive models.

Critical CVSS 10.0 Vulnerabilities in Joomla SP Page Builder and Page Builder CK Enable One-Click Unauthenticated File Upload and Full Site Takeover

U.S. authorities have warned about three actively exploited vulnerabilities added to CISA’s Known Exploited Vulnerabilities catalog, urging immediate patching. The most severe issues, CVE-2026-48908 and CVE-2026-56290, affect Joomla extensions SP Page Builder and Page Builder CK respectively, both scoring 10.0 and allowing unauthenticated attackers to upload and execute arbitrary PHP files for complete site compromise. A third flaw, CVE-2026-55255 (CVSS 9.9), impacts the Langflow AI application platform and permits authenticated attackers to hijack other users’ processes and access sensitive secrets. All three vulnerabilities are already being used in real-world attacks, though CISA has not disclosed attacker identities or victim counts. Federal agencies must remediate under BOD 26-04, while all organizations are advised to check for vulnerable components, apply fixes, and review logs for prior intrusions.