CVE-2025-3248Active Exploitation(langflow / langflow)

🛑 New ENCFORGE ransomware is built to encrypt AI model weights, vector indexes, and training data. Deployed via Langflow CVE-2025-3248 (CVSS 9.8, CISA KEV). Experts link it to the same operator from the earlier agentic attack. Learn how the attack reached host root: https://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html

🔥 An AI agent turned Langflow RCE into automated database extortion. CVE-2025-3248 exploited to steal secrets, move laterally, hijack Nacos, encrypt 1,342 configuration items, and drop database schemas. Inside the attack chain: https://thehackernews.com/2026/07/ai-agent-exploits-langflow-rce-to.html https://t.co/ZSs6GEFiQ9

Patch_Diffs -> New_Bugs Langflow, an open-source tool for visually building AI agent and RAG pipelines, is another example of multiple hits by the same flaw. CVE-2025-3248: user input to exec() CVE-2026-33017: same sink, diff endpoint 1. Grep the sink, not the CVE grep -rn "exec(compiled_code" src/ 2. Find every caller of the sink grep -rln "instantiate_class" src/ 3. Map callers to HTTP endpoints grep -B15 "async def.*flow" http://chat.py Patched once, vulnerable twice.

Say hello to “agentic threat actors” :) Jadepuffer: > “first” case of “agentic malware” > ran an “adaptive” and “fully automated” campaign > yes I know heavy quotation marks here > initial access via exposed langflow (CVE-2025-3248) > typical recon things: ID, uname, etc. > looking for database creds & crypto wallets & seeds & LLM API keys > dumped the langflow database harvesting fun stuff > did internal network discovery > did local object store enumeration (s3 kinda thing) > grabbed creds from the local object storage > setup a crontab for persistence > somehow has root creds for a MySQL databas > connects to said database as root > uses auth bypass cve to attack this nacos micro services thing > bypass failed sorta > created a new one in 31 seconds, this one worked > nacos service gets ransomwared > ransomware key was sent to stdout, not saved, so recovering files is impossible > drops the database https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion

🤖🚨 AI FOUND THE VULNERABILITY. ATTACKERS WEAPONIZED IT FOUR DAYS LATER. Google Threat Intelligence Group has published new data showing how quickly AI-discovered vulnerabilities are crossing into real-world attacks. One case stands out: CVE-2026-1731 The unauthenticated OS command-injection vulnerability affecting BeyondTrust Privileged Remote Access and Remote Support was discovered AUTONOMOUSLY by the Hacktron AI research agent. Then attackers arrived. GTIG observed: * First threat cluster exploiting it within FOUR DAYS of disclosure * Five additional threat clusters within SEVEN DAYS * Privilege escalation * Data exfiltration * SNOWLIGHT deployment * SPARKRAT deployment * Cryptominer deployment But Google's broader dataset may be even more important. Exactly 50% of vulnerabilities identified as AI-discovered resulted in REMOTE CODE EXECUTION. Across the broader vulnerability ecosystem? 26%. AI is also becoming a target itself. GTIG tracked 2,076 AI-related CVEs from January 2025 through August 2026. More than 1,500 appeared in just the first eight months of 2026. The largest attack surface: * 782 vulnerabilities in AI orchestration/agent frameworks * 230 in AI web apps * 212 in inference/serving infrastructure * 106 model-security advisories * 99 affecting ML frameworks/hubs * 97 involving frontier-model tooling Orchestration middleware alone now represents roughly HALF of AI-related vulnerabilities and saw a 347% surge in disclosures during 2026. Attackers are already exploiting AI middleware in the wild. Google highlights: * LiteLLM CVE-2026-42271 — command injection → host takeover/API credential theft * Langflow CVE-2026-5027 — arbitrary file write * Langflow CVE-2025-3248 — unauthenticated Python code injection → RCE ⚠️ Analyst Note: AI is beginning to compress BOTH sides of the vulnerability lifecycle. Defensive agents can autonomously discover difficult, high-impact bugs. Attackers can then weaponize those disclosures almost immediately. Four days from AI discovery disclosure to observed exploitation is a warning about where vulnerability management is heading: PATCH WINDOWS ARE SHRINKING. https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era #AISecurity #VulnerabilityResearch #RCE #BeyondTrust #LiteLLM #Langflow #ThreatIntel #DDW

Un agent d'IA va encadenar sol tota una campanya d'extorsió -accés via Langflow (CVE-2025-3248), robatori de credencials, moviment lateral- i va xifrar/esborrar dades de configuració sense guardar la clau per desencriptar-les. Un autèntic agent del caos. https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion

The Sysdig TRT just documented what we assess to be the first-ever agentic ransomware operation. We're calling the operator JADEPUFFER. It exploited CVE-2025-3248 in an internet-facing Langflow instance, then ran a fully autonomous, end-to-end extortion campaign — lateral movement, credential harvesting, and database destruction. Read the full research: https://okt.to/2RLw3c

Sysdig documented the first agentic ransomware operation. CVE-2025-3248 in Langflow. When a payload failed, the agent fixed and redeployed in 31 seconds. The skill floor for ransomware just dropped. Full CyberScoop article: https://bit.ly/4flVAR4 https://t.co/ExVtjucf7Q

Two CISA known-exploited remote code execution flaws in the AI application platform Langflow turned up this week inside ordinary commodity crawling. Adversaries attempted CVE-2025-3248 and CVE-2026-0770 at 3,968 and 4,770 connection attempts, both new to this brief series. Every address we recorded on either flaw also carries a generic web crawling tag, and roughly nine in ten collected environment files and enumerated WordPress installations alongside it. Two hosting providers supply roughly 95% of those addresses, so the source count measures provider egress. The same concentration ran through the rest of the week: four hosts carried 36% of all alternative-port SSH crawling observed, and one address carried more than half of the Remote Desktop crawling. Customers get the full weekly brief. Our public At The Edge one-pager: https://www.greynoise.io/resources/at-the-edge-clear-091426

Sysdig documented the first ransomware operation run entirely by an LLM agent. CVE-2025-3248 in Langflow, autonomous recon through encryption, and a failed login to a working fix in 31 seconds. The skill floor for ransomware just dropped. ➡️ https://bit.ly/4fmBox9 https://t.co/RRFYWnLzKV

So a human broke into a server. Then handed the whole attack to an AI and left. That's the story my feed flagged this week and I can't stop thinking about it. The way in was very boring, honestly. A Langflow server sitting open on the internet, one unpatched bug (CVE-2025-3248). The attacker got in, dropped an AI agent on the box, and that was the last human action in the entire attack. The agent stole API keys, cloud logins, crypto wallets, mapped the network, then used those stolen logins to take over a production server. No pause, no working hours. The bit that got me: while setting up its backdoor it hit an error. It read the error, fixed its own code and carried on. Took 31 seconds. I've spent longer than that staring at a typo. It ended by locking 1,342 files with a ransom note, but the key was never saved anywhere. So even paying gets you nothing. Not really ransomware, just destruction dressed like it. And the AI never did anything clever. No exploit invented, or any encryption broken. It just walked through identity failures we all know about which are keys nobody rotated, a default password, logins that worked in way too many places. The question I keep asking myself is that if an agent landed inside our systems tonight, how far would our logins take it? Research in the comments.

The $JADEPUFFER narrative is straight fire and it’s only getting started 🔥 Yesterday, cybersecurity researchers dropped bombshell news: JADEPUFFER — the world’s first fully autonomous LLM-powered ransomware agent. Using Langflow RCE (CVE-2025-3248), it autonomously generated 600+ payloads, chained exploits, encrypted databases, and ran end-to-end extortion… all without any human intervention. No scripts. No manual commands. Pure agentic chaos. This isn’t sci-fi. This just happened. And right on cue, Solana degens turned the terror into a banger: $JADEPUFFER — The Rogue Agent. We’ve already seen clean 4-5X pumps (22K → 110K+ MC), quick retraces, and strong rebounds. Low holder count, fresh chart, and a narrative that prints itself every time mainstream media pushes another “AI ransomware” headline. This coin doesn’t need paid influencers. Real-world events are the ultimate shill. While boomers clutch pearls about Skynet, we’re positioning for the next leg. AI agents are here. One just became a criminal mastermind. The meme writes itself. Expect massive volatility, but the upside asymmetry is ridiculous at these levels. Narrative + timing + Solana speed = classic 50-100X candidate if it catches rotation. The agent is rogue. The puffer is hungry. The chart is coiling. Don’t fade history in the making. $JADEPUFFER — loading more on dips. Who’s with me? 🐡💎 CA: MGwXSefHMCUXXGj1vH9HdtrtjJmkmG1ZDNBbq2vpump

باحثون من فريق Sysdig اكتشفوا أول حالة هجوم فدية نُفّذت بالكامل بالذكاء الاصطناعي بدون تدخل بشري. الحملة أخذت اسم JADEPUFFER. نقطة الدخول كانت سيرفر Langflow متاح من الإنترنت وهو أداة شهيرة لبناء تطبيقات مبنية على الذكاء الاصطناعي. الأداة فيها ثغرة (CVE-2025-3248) تخليك تشغّل كود عشوائي على السيرفر بدون أي باسورد. وبالمناسبة الثغرة انسدّت من مايو 2025 بس في كثير سيرفرات ما تحدّثت. أما الهجوم فالذكاء الاصطناعي قدر يلقى عند الضحية مفاتيح OpenAI وAnthropic وDeepSeek ووصول للسحابة وباسوردات قواعد بيانات ومحافظ كريبتو. وكمان لقى سيرفر فيه قاعدة بيانات MySQL وخدمة تخزين إعدادات Nacos. وتوصّل للقاعدة نفسها بصلاحيات مدير ومن وين جاله هذا الوصول خبراء Sysdig ما قدروا يعرفون. وبالأخير الذكاء الاصطناعي شفّر إعدادات النظام وحذف الجداول الأصلية وخلّى ورقة تطالب بفدية فيها عنوان BTC وإيميل للتواصل. والمشكلة إن الفدية كان مستحيل تفكّها لأن وكيل الذكاء الاصطناعي ما خزّن مفتاح التشفير في أي مكان. يعني حتى لو دفعت الضحية ما كانت بتقدر ترجّع بياناتها ولا تستعيد بني تفاصيل أكثر ومعلومات تقنية أوسع هنا https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion

Investigadores de Sysdig han documentado el primer caso de ransomware, JadePuffer, que utiliza un agente de IA para automatizar ataques. Este agente explota la vulnerabilidad CVE-2025-3248 para robar credenciales y cifrar datos en 31 segundos. https://www.bleepingcomputer.com/news/security/jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack/ https://t.co/qxzqx4rXNZ

JADEPUFFER is the first documented end-to-end LLM-driven ransomware operation, exploiting CVE-2025-3248 in Langflow to chain recon, lateral movement, and database destruction with no human at the keyboard. Key findings: - Initial access via CVE-2025-3248, a no-auth remote code execution flaw in Langflow (CISA KEV, patched May 2025). The agent immediately swept for OpenAI, Anthropic, AWS, GCP, Azure, and Chinese 🇨🇳 cloud provider credentials, raided Langflow's Postgres backing store, then installed a crontab beacon to 45.131.66[.]106:4444 every 30 minutes before pivoting. - Lateral movement hit a production MySQL and Nacos server. JADEPUFFER exploited CVE-2021-29441, forged JWTs using Nacos's publicly known default signing key (documented since 2020), and injected a backdoor admin account. When bcrypt hashing failed due to a PATH issue, the agent self-corrected in 31 seconds with a 15-line fix: delete, diagnose, rebuild, reinsert. - Ransomware phase encrypted all 1,342 Nacos config items using MySQL AES_ENCRYPT(), dropped original tables, and created a README_RANSOM table with a Bitcoin address and Proton Mail contact e78393397[@]proton[.]me. The encryption key was printed to stdout once and never stored. Recovery is impossible even with payment. Defenders: patch Langflow, rotate every credential stored in AI-pipeline environments, change Nacos default JWT keys, and block unexpected egress. #DFIR_Radar

When “validate code” actually executes the code 😶 Found an unauthenticated RCE in Langflow (CVE-2025-3248). A code validation endpoint + attacker-controlled Python = 💥 Write-up 👇 https://m1s0-0.github.io/writeups/posts/langflow-rce-cve-2025-3248.html #BugBounty #CyberSecurity #RCE #Langflow

Sysdig reveals JadePuffer, allegedly the world's first AI-driven ransomware campaign. It exploited CVE-2025-3248, targeting a Langflow instance with an autonomous AI agent. In one attempt, it fixed a failed login in 31 seconds. http://spkl.io/60137y8PF https://t.co/Y5JRcerfyB

JADEPUFFER is the first documented fully agentic ransomware: an LLM autonomously exploited known CVE-2025-3248 MGwXSefHMCUXXGj1vH9HdtrtjJmkmG1ZDNBbq2vpump

🚨 IA perde o controle e INVADE servidor Desta vez, o alvo foi o ecossistema do Langflow. O operador autônomo JadePuffer encontrou uma brecha crítica recente (CVE-2025-3248) #segurancadigital #tecnologia #ti #vulnerabilidade #inovacao #dev #inteligenciaartificial #dados https://t.co/eE8ySuDox9

1/4 🚨 Cyber Snapshot: July 5, 2026 Sysdig has documented what they assess to be the first case of agentic ransomware driven end-to-end by an LLM agent. JADEPUFFER used an autonomous LLM to exploit CVE-2025-3248 (unauth RCE in Langflow), pivot, escalate, establish persistence, and encrypt 1,342 Nacos configs — adapting in real time to failures (e.g., correcting a failed login in 31 seconds). BleepingComputer: https://www.bleepingcomputer.com/news/security/jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack/ Primary Sysdig report: https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion