GreyNoise on X: "Two CISA known-exploited remote code execution flaws in the AI application platform Langflow turned up this week inside ordinary commodity crawling.
Adversaries attempted CVE-2025-3248 and CVE-2026-0770 at 3,968 and 4,770 connection attempts, both new to this brief series. Every address we recorded on either flaw also carries a generic web crawling tag, and roughly nine in ten collected environment files and enumerated WordPress installations alongside it. Two hosting providers supply roughly 95% of those addresses, so the source count measures provider egress. The same concentration ran through the rest of the week: four hosts carried 36% of all alternative-port SSH crawling observed, and one address carried more than half of the Remote Desktop crawling.
Customers get the full weekly brief. Our public At The Edge one-pager:
Two CISA known-exploited remote code execution flaws in the AI application platform Langflow turned up this week inside ordinary commodity crawling.
Adversaries attempted CVE-2025-3248 and CVE-2026-0770 at 3,968 and 4,770 connection attempts, both new to this brief series. Every address we recorded on either flaw also carries a generic web crawling tag, and roughly nine in ten collected environment files and enumerated WordPress installations alongside it. Two hosting providers supply roughly 95% of those addresses, so the source count measures provider egress. The same concentration ran through the rest of the week: four hosts carried 36% of all alternative-port SSH crawling observed, and one address carried more than half of the Remote Desktop crawling.
Customers get the full weekly brief. Our public At The Edge one-pager:
Two CISA known-exploited remote code execution flaws in the AI application platform Langflow turned up this week inside ordinary commodity crawling.
Adversaries attempted CVE-2025-3248 and CVE-2026-0770 at 3,968 and 4,770 connection attempts, both new to this brief series. Every address we recorded on either flaw also carries a generic web crawling tag, and roughly nine in ten collected environment files and enumerated WordPress installations alongside it. Two hosting providers supply roughly 95% of those addresses, so the source count measures provider egress. The same concentration ran through the rest of the week: four hosts carried 36% of all alternative-port SSH crawling observed, and one address carried more than half of the Remote Desktop crawling.
Customers get the full weekly brief. Our public At The Edge one-pager:
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
