--- title: "🛡️ High-Risk Langflow Vulnerability Still Unpatched, Honeypot Logs 1,423 Real Attacks | AI Security Weekly" description: "The most unsettling thing this week is that the high-risk vulnerability in the AI workflow platform Langflow has already been logged by honeypots with over 1,400 real attack attempts, not just theoretical speculation. Meanwhile, Microsoft patched a record-breaking 1,413 vulnerabilities in a single month, and LiteLLM, a popular LLM gateway, was also found to have an authorization flaw; how an Italian bank was scammed out of nearly 100 million euros by an AI-cloned voice, I'll tell you in a moment." canonical_url: "https://blog.markkulab.net/en/ai-security/ai-security-2026-10-16" author: "Mark Ku" author_url: "https://blog.markkulab.net/en/author/mark-ku" site: "Mark Ku's Tech Notes" date_published: "2026-10-16T02:00:00.000Z" category: "AI Security Weekly" tags: ["ai-security", "podcast", "AI 資安", "AI資安", "Langflow", "LiteLLM", "RCE", "深偽詐欺", "PatchTuesday", "API金鑰竊取", "AI監管"] language: "en" license: "CC BY 4.0" license_url: "https://creativecommons.org/licenses/by/4.0/" attribution: "when reusing or quoting, credit the author and link back to the original" --- # 🛡️ High-Risk Langflow Vulnerability Still Unpatched, Honeypot Logs 1,423 Real Attacks | AI Security Weekly ## Opening The most unsettling thing this week is that the high-risk vulnerability in Langflow, the AI workflow platform, has already been logged by honeypots for over 1,400 real attack attempts, not theoretical speculation. Meanwhile, Microsoft patched a record-breaking 1,413 vulnerabilities in a single month, and LiteLLM, a popular LLM gateway, was found to have authorization flaws. And how did an Italian bank get scammed out of nearly 100 million euros by an AI-cloned voice? I'll tell you in a moment. ## This Week's AI Security Focus ### 1. Critical Langflow RCE Vulnerability Under Active Attack - **What happened**: CVE-2026-105740 (CVSS 9.9, a vulnerability severity score out of 10) in the AI workflow platform Langflow allows authenticated users to execute OS commands on the server, a class of flaw commonly known as RCE (remote code execution), affecting all versions prior to 1.9.0. A honeypot set up by security firm Previdian has logged 1,423 attack attempts from 27 different IPs since September 19, peaking at 333 attempts on October 11, with 66 attempts still recorded on October 15. - **Scope of impact**: Any Langflow deployment still running a version before 1.9.0 with its admin interface exposed to the internet is at risk, especially teams connected to internal systems or sensitive data. - **Defense recommendations**: Upgrade to 1.9.0 or later immediately, and check whether the admin interface is unnecessarily exposed to the public internet; bring it behind the internal network or restrict access with an allowlist. - **Source**: The Hacker News () ### 2. Microsoft's October Patch Tuesday Breaks Record with 1,413 Vulnerabilities - **What happened**: Microsoft's October 2026 Patch Tuesday fixed 1,413 vulnerabilities in a single release (1,102 in Windows, 134 in Office, 61 in developer tools, 36 in SharePoint Server), already exceeding the total for all of 2025, with the 2026 cumulative count surpassing 4,000. SecurityWeek reports that this surge is largely driven by AI-assisted vulnerability discovery, including an actively exploited Windows shell zero-day, CVE-2026-96951 (CVSS 8.8), which can bypass execution restrictions on files downloaded from the internet. - **Scope of impact**: All Windows and Office users are affected, and IT teams need to reassess whether their patching cadence can keep up with this volume. - **Defense recommendations**: Prioritize the actively exploited CVE-2026-96951, then triage the rest based on asset exposure and risk level. - **Source**: SecurityWeek () ### 3. Italian Bank Loses 95 Million Euros to AI Voice Impersonation Scam - **What happened**: Fideuram, the private banking arm of Italy's Intesa Sanpaolo, was defrauded of 95 million euros (about $108 million) after scammers used AI-cloned voice combined with messaging apps to impersonate senior executives. So far 53 million euros have been recovered, and Milan prosecutors are investigating a suspect reportedly residing outside Europe. A concurrently released identifAI report estimates that generative AI could push US fraud losses to $40 billion by 2027. - **Scope of impact**: Any corporate process that relies on phone calls or voice messages for executive authorization could be replicated by the same tactics, with finance and treasury departments at the highest risk. - **Defense recommendations**: Large wire transfers or executive-instruction workflows should never rely solely on voice or a single messaging channel for identity verification; add an independent secondary confirmation channel. - **Source**: Biometric Update () ### 4. LiteLLM Gateway Found with Authorization and SSRF Flaws - **What happened**: Check Point Research conducted a security assessment of LiteLLM, a widely used LLM (large language model) proxy layer in enterprises, and uncovered CVE-2026-35029 (the `/config/update` endpoint lacks authorization checks) and CVE-2026-59823 (SSRF via the `user_config` parameter, a technique that tricks a server into accessing internal network locations it shouldn't reach), along with two credential exposure and insecure hashing issues tracked under GHSA-69x8-hrgq-fjj8. The tested version was v1.77.7; the fix is available in v1.83.9 and later. - **Scope of impact**: Enterprises using LiteLLM as a multi-model management gateway should check their version, since a breach of this kind of infrastructure effectively exposes control over the entire AI access layer. - **Defense recommendations**: Upgrade to v1.83.9 or later, and re-examine authorization settings on admin endpoints as well as credential storage practices. - **Source**: Check Point Research () ### 5. Censys: Publicly Exposed AI-Related Software Up 63% in Nine Months - **What happened**: Scan data from Censys shows that publicly exposed AI-related software grew from 164,088 IPs in October 2025 to 267,915 by July 2026, a 63% increase over nine months across 44 products. The automation platform n8n accounted for 113,926 hosts, 76.1% of which are still running older versions with high-risk vulnerabilities; the AI agent platform OpenClaw saw its exposed panel count surge to 85,478 within just a few months of launch. - **Scope of impact**: Any team that puts AI automation tools or agent platforms directly on the public internet may be part of these numbers, especially deployments without a habit of continuous upgrades. - **Defense recommendations**: Audit your organization's internet-facing AI-related services, check whether versions are outdated, and move anything that can be brought behind the internal network or access controls off the public internet. - **Source**: Help Net Security () ### 6. Underground Forums Using Stolen AI API Keys for Automated Scanning - **What happened**: Bitsight's threat intelligence team tracked 16 underground forums (February to August 2026) and found a so-called "autonomous penetration testing" platform called MONST3R-AI, which lets buyers paste in stolen OpenAI, Anthropic, and Google API keys and set budget caps, with the scanning costs actually billed to the original key owners. This allows attackers to conduct reconnaissance without running their own models, making them harder to trace. - **Scope of impact**: Any organization that has ever leaked an AI provider API key may currently be footing the bill for someone else's attacks, often without realizing it. - **Defense recommendations**: Treat leaked AI provider keys with the same severity as leaked AWS credentials, verify the provenance of MCP (the protocol that lets AI agents connect to external tools and data sources) servers and agent plugins, require human approval before local coding agents access sensitive directories, and watch for anomalous automated login patterns on Notion, Slack, or GitHub. - **Source**: Help Net Security () ### 7. FTC Issues Civil Investigative Demands to OpenAI and Anthropic - **What happened**: The US Federal Trade Commission (FTC) has issued civil investigative demands (CIDs) exceeding 50 pages each to OpenAI and Anthropic, requesting documentation on security incidents, internal safeguards, marketing materials, and privacy policies, with the investigation focused on possible consumer protection violations. According to Axios, the FTC will subsequently seek testimony from AI executives and plans to issue CIDs to third-party AI organizations as well. - **Scope of impact**: Enterprises using services from either provider may subsequently be asked to produce their vendor's written documentation on incident response and safeguards. - **Defense recommendations**: When evaluating or adopting AI provider services, proactively request written documentation on containment, monitoring, access control, and incident response, rather than waiting until something goes wrong. - **Source**: Axios () ## Closing The one thing to remember this week is that when AI-related infrastructure has a problem, what's at stake is usually the entire access chain, not a single feature. From Langflow to LiteLLM, it's the same lesson. Take ten minutes this week to audit which AI tools in your company still have admin interfaces exposed to the internet. See you next Thursday. --- ## About this article and its author Originally published on [Mark Ku's Tech Notes](https://blog.markkulab.net/en/ai-security/ai-security-2026-10-16) License: [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) — when reusing or quoting, credit the author and link back to the original ### About the author **[Mark Ku](https://blog.markkulab.net/en/author/mark-ku)** — Software engineer - 10+ years as a software engineer - Built North-American e-commerce and AI SaaS subscription billing ### Free tools built by the author All of these are free to use: - [Free PDF Sign Tool](https://blog.markkulab.net/en/tools/pdf-sign): Online PDF sign tool — draw, type, or upload a signature, then drag, resize, and download. Everything runs in your browser; nothing is uploaded. - [VS Code Refactory](https://blog.markkulab.net/en/tools/refactory): Refactory is a VS Code refactoring extension: 34 actions plus a 37-rule code-smell inspection layer with a Code Health dashboard, across 18 languages, backed by 534 tests. It learns your repo's conventions: where interfaces live, where DI is registered, whether 'use client' belongs. It ranks files by git churn × complexity so you know what to fix first, and hands any smell to the Claude Code already on your machine. Free to use, and your source never leaves your computer. - [DB-Kit Database Manager](https://blog.markkulab.net/en/tools/db-kit): DB-Kit is a lightweight, cross-platform database manager built with Tauri + Rust + React. Manage MySQL, MariaDB, PostgreSQL, SQL Server, Oracle, SQLite, MongoDB, Redis, Kafka, Elasticsearch and RabbitMQ from one consistent interface: passwords encrypted in the OS keychain, SSH tunnels, full CRUD, a visual query builder, stacked multi-statement result sets, cross-connection data transfer, schema & data compare with sync SQL and schema snapshots, Excel / CSV import & export, visualized execution plans, ER diagrams, scheduled backups, SQL stress testing with p50–p99 latency percentiles, a 15-rule SQL review engine, Review & Run (AI review plus per-statement backups and an auto-generated rollback script), Kafka message browsing with monitoring & alerts, an SSH terminal with SFTP / FTP, Docker / Kubernetes, remote desktop (RDP / VNC / RustDesk), file / folder compare, stored procedure integration tests, six UI languages, a built-in AI assistant (a local CLI or any Anthropic / OpenAI-compatible API; natural-language SQL, AI review and tuning advice) and the dbk CLI. Free and open source (MIT), with installers for Windows, macOS and Linux. - [VS Code Super Mermaid](https://blog.markkulab.net/en/tools/super-mermaid): Super Mermaid is a VS Code extension for beautiful Mermaid diagrams out of the box: auto-colored live preview, mouse pan & zoom, high-res PNG / SVG export, 21 templates and multiple themes. Free and open source (MIT). - [React Super Mermaid](https://blog.markkulab.net/en/tools/react-super-mermaid): react-super-mermaid is an open-source React component library: render beautiful Mermaid diagrams with a single , with built-in colorful / sketch themes, pan & zoom, in-diagram search, and high-res SVG / PNG export. Lightweight, SSR-safe, fully typed. Free and open source (MIT). - [Jira / Confluence Super Mermaid](https://blog.markkulab.net/en/tools/jira-super-mermaid): An Atlassian Forge app: write Mermaid syntax directly inside a Jira issue or a Confluence page and get flowcharts, sequence diagrams, state machines and Gantt charts. 11 diagram types, SVG / PNG export, light and dark themes, full CJK support. Runs on Atlassian: your diagrams live in your own site and the app calls no third-party service. Free, coming soon to the Atlassian Marketplace. - [Mermaid Live Preview](https://blog.markkulab.net/en/tools/mermaid-preview): Write Mermaid in your browser, see it render instantly, and share the whole diagram as a single link. No sign-up, nothing uploaded to a server, and mermaid.live share links work as-is. - [React Intl Phone Number](https://blog.markkulab.net/en/tools/react-intl-phone-number): react-intl-phone-number is an open-source React component: framework-agnostic and antd-free, with E.164 in/out, a searchable flag / country-code dropdown, configurable validation levels (strict / mobile-strict / loose), themeable CSS, and i18n — phone logic powered by google-libphonenumber. Lightweight and fully typed. Free and open source (MIT). - [Uptime Kuma Cluster](https://blog.markkulab.net/en/tools/uptime-kuma-cluster): Turn single-node Uptime Kuma into a highly available cluster: OpenResty + Lua smart load balancing, shared MariaDB state, health checks and automatic failover, plus cluster-management REST APIs. One Docker Compose command to start. Free and open source (MIT). - [AI Podcast Cut](https://blog.markkulab.net/en/tools/ai-podcast-cut): Drop in a recording and it removes fillers and stutters, levels loudness segment by segment, and sends a second agent to review every cut. Cut points snap to word boundaries and zero crossings, every splice gets a fade, and sentence-end breaths are preserved. Desktop app for Windows, macOS and Linux. MIT licensed; the Windows installer bundles ffmpeg. - [AI Video Cut](https://blog.markkulab.net/en/tools/ai-video-cut): Pick something in your video: type it (face, license plate, phone screen, logo), click points or drag a box, or let Claude Code / Codex pick it. AI Video Cut tracks it frame by frame, then mosaics or blurs it, recolors it, pins stickers and text to it, swaps a screen or poster for your own image or video, or removes it using background that other frames actually captured. Plus sequence editing, local captions and an AI assistant. Free, open-source (MIT) Windows desktop app (macOS / Linux experimental) that runs locally, nothing uploaded. - [open-pos restaurant POS](https://blog.markkulab.net/en/tools/open-pos): One computer and one receipt printer is enough to open the shop. Your data lives on your own disk, no subscription, no lock-in, MIT licensed. Money is integer New Taiwan dollars with tax split by the statutory formula, so sales + tax always equals the total. Printing goes straight over ESC/POS on TCP 9100, with no vendor driver. Tauri + Rust + SQLite desktop app, v1.0 in development. - [.NET e-commerce API template](https://blog.markkulab.net/en/tools/dotnet-ecommerce-api): An e-commerce backend API template built on .NET 10: Controller → Service → Repository layering, Autofac convention-based registration, SqlSugar for MySQL / MariaDB and SQL Server, Redis cache and message queue, Hangfire jobs, JWT auth, and an extensible payment provider module (ECPay, Newebpay). Apache 2.0. - [Open Token Monitor team AI usage](https://blog.markkulab.net/en/tools/open-token-monitor): Collect token usage and equivalent cost from every employee's AI coding tools into a hub you host yourself: PostgreSQL, org roster, dashboards compared by company and department, and a reports API. Electron and Rust/Tauri clients upload every 30 minutes. MIT licensed, one Docker command. ### Daily podcasts - [Mark's Tech Insights — Daily AI News](https://blog.markkulab.net/en/category/tech-news): Daily curated AI and tech trends. Catch the latest developments via audio summaries — covering AI applications, software architecture, DevOps, and engineering practice. — RSS: https://blog.markkulab.net/feed.xml - [AI股市蝦聊](https://blog.markkulab.net/en/category/ai-stock-chat): Every trading day, an AI-analyzed take on the Taiwan stock market, delivered as a two-host conversation covering the session and the next-day outlook. — RSS: https://blog.markkulab.net/ai-stock-chat/feed.xml - [開源好物週報](https://blog.markkulab.net/en/category/open-source-weekly): A weekly two-host pick of free open-source tools surfaced from real Hacker News, GitHub, and Reddit buzz — what pain they solve and the fastest way to get started. — RSS: https://blog.markkulab.net/open-source-weekly/feed.xml - [AI 運動週報](https://blog.markkulab.net/en/category/sports-weekly): Two hosts talk NBA, MLB and world sport three times a week — scores, records and the stories behind them, from a Taiwanese fan perspective. — RSS: https://blog.markkulab.net/sports-weekly/feed.xml - [AI 國際新聞快報](https://blog.markkulab.net/en/category/world-news): A daily two-host briefing that makes sense of the past 24 hours in world news — geopolitics, the global economy, conflict and security, disasters and climate — from a Taiwanese perspective, neutral and fully sourced. — RSS: https://blog.markkulab.net/world-news/feed.xml - [地端 AI 實驗室](https://blog.markkulab.net/en/category/local-ai-lab): Twice a week, a two-host look at open-weight models and LoRAs you can actually run on your own machine: what they are for, whether your GPU can handle them, and how they compare — sourced from official model cards. — RSS: https://blog.markkulab.net/local-ai-lab/feed.xml - [AI 行銷週報](https://blog.markkulab.net/en/category/ai-marketing): Every Tuesday, two hosts break down the week in AI for marketing, advertising, SEO/GEO and content marketing: practical, never sponsored, every story sourced. — RSS: https://blog.markkulab.net/ai-marketing/feed.xml - [AI 資安週報](https://blog.markkulab.net/en/category/ai-security): Every Thursday, two hosts cover the week where AI meets cybersecurity: LLM and AI agent vulnerabilities, prompt injection, model supply-chain risks and AI-powered attacks, from a defense-first angle with every story sourced. — RSS: https://blog.markkulab.net/ai-security/feed.xml ### Newsletter [Subscribe to the newsletter](https://blog.markkulab.net/en/subscribe) — Be the first to know about new posts. No spam, unsubscribe anytime.