Topic
Exploitable flaws in AI and ML orchestration components, specifically Langflow unauthenticated RCE before 1.9.0 and a Ray dashboard logs API path traversal.
Sysdig says an LLM-driven operator it calls JADEPUFFER ran a database-extortion campaign on its own, entering through unpatched Langflow flaw CVE-2025-3248. It calls the operation the first documented ransomware run end to end by a model.
Reality
Google's threat intelligence group counts 18 exploited flaws a month in 2026, up from 10.5 in 2025, while zero-days rose only from eight to 11. GTIG attributes most of the added attacks to fast weaponization of disclosed n-days, so the exposure sits in the days after a patch ships.
Perspective Coverage
4 publishersReality
Google's Threat Intelligence Group counted 141 flaws exploited in the wild from January to August, while monthly disclosures doubled to 10,740. Patch teams do better sorting by that exploited set than by the total, though attackers now reach some public flaws within days.
Reality
CVE-2025-62593 carries a CVSS 9.4 and a federal remediation deadline of August 20, 2026. The unauthenticated endpoints behind it are a design decision, not an oversight.
Perspective Coverage
4 publishersReality
Unit 42 worked a ransomware intrusion where the operator handed tactical execution to frontier AI agents, and the chain from a public API endpoint to stolen cloud AI keys closed inside a single working day with no zero-day.
Reality
One Dell rollup alone carried 435 CVEs, among them a kernel privilege-escalation bug that had already shipped in two other Dell advisories. That is why a single vendor feed cannot describe a GPU estate.
Reality
SonicWall's CVSS 10.0 SSRF chains into command execution on remote access appliances, and JFrog Artifactory hands unauthenticated attackers admin under default configuration. Reverse shells and miners are already landing.
Perspective Coverage
13 publishersReality
Berardino Carnevale of Rambus told Lets Data Science that measured boot protects only the components inside the measurement set, and that attestation evidence settles nothing until a verification service acts on it.
Reality
A single September 2026 KEV batch produced 1,262,273 GitLab matches and nothing at all for Cisco Secure Firewall Management Center, because the console holding one of the two 10.0 bugs is the one passive scanning cannot fingerprint.
Reality
VulnCheck's first-half figures put the median at 80 days, down from 120 in 2025, while the count of CVEs exploited within a month of publication held flat near 200. The tier that breaks is the 90-day one.
Reality
Tencent's Zhuque Lab has put its AI asset scanner on GitHub for nothing. The skill auditor asks a language model whether code looks malicious, and the lab's own benchmark puts the false positive rate anywhere between 1.2 and 18.67 percent.
Reality
X41 D-Sec's proof of concept for CVE-2026-48710 is one unauthenticated GET whose Host header carries /public?bar=. Starlette sits underneath LiteLLM, vLLM and MCP servers, so the work starts with a dependency query.
Reality
Seven entries went into CISA's known-exploited catalog on 2 September. The 5 September fix date covers four of the six products named, and the two AI-stack entries are the ones most teams cannot locate in a dependency graph.
Reality
The Ray, Docker and Redis endpoints hijacked in ShadowRay 2.0 were worked by operators Oligo now ties to TA-NATALSTATUS activity from 2020, which makes the AI-cluster worm a tooling upgrade on an old farm.
Reality
Microsoft Security Research says intruders who reached exposed LiteLLM, RAGFlow and Kestra deployments went for provider keys and database URLs first. It can name a confident initial vector in only one of the three cases.
Reality
Ninety days of Wiz honeypot telemetry shows tooling written for LiteLLM's internals, including a config test endpoint that spawns whatever command it is handed and a miner whose output comes home inside the MCP protocol.
Reality
Three Microsoft investigations into AI middleware ended in stolen keys, persistence and compute abuse. The remediation list is ordinary infrastructure hygiene, applied to plumbing nobody inventoried.
Reality
Ray never authenticated its job endpoints, and the User-Agent check meant to keep browsers out is spoofable in Firefox and Safari. DNS rebinding does the rest.
Reality
CVE-2025-62593 is a code-injection flaw in Ray that CISA says is already being exploited, and its own entry says the bug can be reached through a browser. The fix is version 2.52.0.
Reality
Rapid7's latest wrap-up ships working exploit code for seven separately documented flaws, including an unauthenticated Joomla web shell and a Linux kernel LPE. Reprioritize this week, not next cycle.
Reality