An IP that Microsoft tied to an agentic AI campaign was caught exploiting Langflow through CVE-2025-3248 on a VulnCheck decoy. It went for the AI provider and cloud keys Langflow stores, and on the decoy it found a way to decrypt them.
Limits: VulnCheck says network traffic alone can't prove an AI agent ran the Langflow session; the link rests on the shared IP and matching behaviour. The target was a decoy, not a customer system. The Radar entry is single-source; the telemetry is VulnCheck's own.
Any Langflow reachable from the internet: upgrade to 1.3.0 or later to close CVE-2025-3248, put it behind auth and a private network, rotate stored provider keys and then the Langflow secret key, and hunt for bursts of POST /api/v1/validate/code.
hify.ai/radar/en/vulncheck-c…
PHP2Shell (CVE-2026-109618, CVE-2026-109619) is exploited in the wild.
On RHEL 9, php -v can't confirm the fix: the backport keeps version 8.0.30.
Check for package 8.0.30-8.el9_8.1.
Upstream fixes: 8.2.35, 8.3.36, 8.4.27, 8.5.12.
hify.ai/radar/en/php-patches…
React Server Components flaw GHSA-xqc2-xf4c-x3h3: crafted RSC Flight payloads give unauthenticated attackers code execution. It is patched and not confirmed in the wild. Upgrade react-server-dom-webpack, -turbopack and -parcel immediately.
hify.ai/radar/en/critical-re…
Google and partners took down the XCPE botnet: 1.3 million Android TV boxes with the x.cpe backdoor built into factory firmware.
Google says maker Videostrong sold access to criminals. The backdoor survives reboots and can't be removed. Replace the boxes
hify.ai/radar/en/google-disr…
Web3Auth security incident (Consensys): Keplr's co-founder estimates ~20% of Keplr's Google/Apple login accounts are affected, only a fraction exploited. Recovery-phrase and hardware wallets are not affected: exposure follows how the wallet was created.
hify.ai/radar/en/web3auth-se…
Technical University of Munich (TUM) breach: the TUMonline admin credential used in the attack was among central-login passwords stolen at myTUM, an older portal. TUM says MFA accounts were protected. Audit old portals that accept your central password.
hify.ai/radar/en/technical-u…
On SonicWall SonicOS SSL-VPN, a user with valid credentials for another login method can get past SAML-enforced MFA. That is CVE-2026-19868, now in CISA KEV. Patch, then review the accounts that have those credentials first.
hify.ai/radar/en/cisa-confir…
XLab says the CWPdoor backdoor receives commands through forged HTTP requests that stay out of access logs. Running Control Web Panel on Linux? Check the origin and integrity of its web server.
hify.ai/radar/en/hackers-bac…
