hacker-news Aug 5, 2026 · Crawled Aug 5, 2026

CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited

3 IoCs 3 CVEs

AI Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation. These include a critical remote code execution flaw in Langflow (CVE-2026-9198), a sensitive data encryption bypass in Apache Tomcat (CVE-2026-34486), and an authentication bypass in N-able N-central (CVE-2026-18556 and CVE-2026-18577). Exploitation of CVE-2026-34486 has been linked to a Chinese-speaking threat actor using the aliases knaithe and KnYuan, who leveraged AI-powered offensive tools like DeepSeek via the Hermes Agent framework to autonomously target internet-exposed systems. The actor combined autonomous reconnaissance with manual exploitation of known vulnerabilities in Citrix NetScaler, Marimo, and IKE VPN, among others, targeting over 460 organizations.

AI-extracted · verify before operational use

Extracted Entities 3 found

CVE CVE-2026-9198 → CVE CVE-2026-34486 → CVE CVE-2026-39987 →

Indicators of Compromise 3 extracted

Type	Value	Detail
GitHub User	knaithe	Details →
GitHub User	KnYuan	Details →
GitHub Repo	Hermes Agent	Details →

MITRE ATT&CK TTPs 16 techniques

T1059 Command and Scripting Interpreter · Execution T1078 Valid Accounts · Defense Evasion T1190 Exploit Public-Facing Application · Initial Access T1210 Exploitation of Remote Services · Lateral Movement T1484 Domain or Tenant Policy Modification · Defense Evasion T1059.001 PowerShell · Execution T1071.001 Web Protocols · Command And Control T1090 Proxy · Command And Control T1133 External Remote Services · Persistence T1566 Phishing · Initial Access T1588.001 Malware · Resource Development T1021 Remote Services · Lateral Movement T1078.001 Default Accounts · Defense Evasion T1220 XSL Script Processing · Defense Evasion T1485 Data Destruction · Impact T1659 Content Injection · Initial Access