Topic
Security of software that builds, serves and orchestrates AI models, such as Langflow, Ray, LiteLLM and Ollama, including exposed servers and exploitable flaws.
JFrog disclosed an unauthenticated remote code execution flaw in LMCache's multiprocess mode, CVE-2026-105192, rated CVSS 9.8 with no patch. A public proof of concept exists, so any deployment that exposes the cache server to a network needs access limits or the mode turned off.
Reality
Lumen's Black Lotus Labs found a cryptominer on more than 3,400 servers, mostly running vulnerable AI services. Each poem edit moves the hosts to a new control server, so patching and closing public ports are the controls a server owner holds.
Reality
Lumen's Black Lotus Labs says the PoeLLM cryptomining botnet has compromised more than 2,100 servers, many running exposed LiteLLM or Ollama. Each host it takes then mines and scans for the next, so an AI server left open to the internet is attack surface to lock down.
Perspective Coverage
6 publishersReality
Researchers exploited 45 unique zero-days on day two of Pwn2Own Ireland 2026 for $232,500, hacking Samsung's Galaxy S26 three times. Every target ran its latest firmware, so each win is a working code-execution bug in the build owners run today.
Reality
SonicWall's CVSS 10.0 SSRF chains into command execution on remote access appliances, and JFrog Artifactory hands unauthenticated attackers admin under default configuration. Reverse shells and miners are already landing.
Perspective Coverage
4 publishersReality
ZDI's Pwn2Own Ireland 2026 schedule sets 21 exploit attempts in Cork on October 6, the largest a $300,000 remote Pixel 10 entry. The schedule names exact models and time slots, so operators of the targeted products know which results to look for on ZDI's live leaderboard.
Reality
Sysdig says an LLM-driven operator it calls JADEPUFFER ran a database-extortion campaign on its own, entering through unpatched Langflow flaw CVE-2025-3248. It calls the operation the first documented ransomware run end to end by a model.
Reality
Google's threat intelligence group counts 18 exploited flaws a month in 2026, up from 10.5 in 2025, while zero-days rose only from eight to 11. GTIG attributes most of the added attacks to fast weaponization of disclosed n-days, so the exposure sits in the days after a patch ships.
Perspective Coverage
4 publishersReality
Google's Threat Intelligence Group counted 141 flaws exploited in the wild from January to August, while monthly disclosures doubled to 10,740. Patch teams do better sorting by that exploited set than by the total, though attackers now reach some public flaws within days.
Reality
CVE-2025-62593 carries a CVSS 9.4 and a federal remediation deadline of August 20, 2026. The unauthenticated endpoints behind it are a design decision, not an oversight.
Perspective Coverage
4 publishersReality
Unit 42 worked a ransomware intrusion where the operator handed tactical execution to frontier AI agents, and the chain from a public API endpoint to stolen cloud AI keys closed inside a single working day with no zero-day.
Reality
One Dell rollup alone carried 435 CVEs, among them a kernel privilege-escalation bug that had already shipped in two other Dell advisories. That is why a single vendor feed cannot describe a GPU estate.
Reality
Berardino Carnevale of Rambus told Lets Data Science that measured boot protects only the components inside the measurement set, and that attestation evidence settles nothing until a verification service acts on it.
Reality
A single September 2026 KEV batch produced 1,262,273 GitLab matches and nothing at all for Cisco Secure Firewall Management Center, because the console holding one of the two 10.0 bugs is the one passive scanning cannot fingerprint.
Reality
VulnCheck's first-half figures put the median at 80 days, down from 120 in 2025, while the count of CVEs exploited within a month of publication held flat near 200. The tier that breaks is the 90-day one.
Reality
Tencent's Zhuque Lab has put its AI asset scanner on GitHub for nothing. The skill auditor asks a language model whether code looks malicious, and the lab's own benchmark puts the false positive rate anywhere between 1.2 and 18.67 percent.
Reality
X41 D-Sec's proof of concept for CVE-2026-48710 is one unauthenticated GET whose Host header carries /public?bar=. Starlette sits underneath LiteLLM, vLLM and MCP servers, so the work starts with a dependency query.
Reality
Seven entries went into CISA's known-exploited catalog on 2 September. The 5 September fix date covers four of the six products named, and the two AI-stack entries are the ones most teams cannot locate in a dependency graph.
Reality
The Ray, Docker and Redis endpoints hijacked in ShadowRay 2.0 were worked by operators Oligo now ties to TA-NATALSTATUS activity from 2020, which makes the AI-cluster worm a tooling upgrade on an old farm.
Reality
Microsoft Security Research says intruders who reached exposed LiteLLM, RAGFlow and Kestra deployments went for provider keys and database URLs first. It can name a confident initial vector in only one of the three cases.
Reality