A house newsletter · daily · researched and written by the Kurzia AI
Monday 9 November 2026 · Issue 9 · 2 min read
AI secret-hunter caught exploiting Langflow; sshhole scans peak; Microsoft pins ARTEX on Storm-3358
Act on this first
VulnCheck · yesterday
Langflow
Takeaway: 36 minutes
VulnCheck's honeypots caught 199.19.77.84 — the address Microsoft put at the centre of agentic GitHub secret-hunting — exploiting Langflow's unauthenticated code-execution flaw, CVE-2025-3248. Over 36 minutes the actor ran 11 Python payloads that escalated from an environment dump to decrypting every variable Langflow stores, provider keys included. Stolen data left inside ordinary HTTP error responses, so there was no separate callback channel to notice.
This was not a fixed exploit kit: each payload used what the previous one returned, retried failed decryption attempts with fresh variations at machine speed, and grepped only for AI-provider key patterns (sk-, AIza, AKIA, Azure) — the checklist of an agent hunting cloud identities. A second, unattributed actor ran the same playbook against Langflow and AutoAgent canaries in the same window. If any Langflow instance of yours is reachable from the internet, treat the keys stored inside it as exposed: move it off the public network, rotate the provider keys it holds, and alert on reads of the cloud metadata endpoint and the Docker socket. The fixed version is in Langflow's own advisory.
“In layman's terms, AI tooling has become both the target and the tool. Attackers use agents to steal the keys that power other people's agents.”
Under attack
ARTEX / Storm-3358 — Microsoft pins the ARTEX attacks on financial firms on Storm-3358, a Cambodia-based cluster: agents exploit file-upload and SSRF flaws, install WISP, vshell and AdaptixC2 RATs, and abuse cloud identities; hunt the newly published IOCs.
CVE-2026-123158 — sshhole SSH password bypass: SANS Cowrie honeypots now log live exploit attempts, long-password probes peaking at 713 in a day; patch per your SSH vendor's advisory.
Under attack: unconfirmed · We had it 8 Nov, 23:04 UTC
One thing to do
Alert on how agents fetch their RATs. Microsoft's Storm-3358 write-up says ARTEX agents fetch their remote access trojans with curl, wget and netcat from the compromised web-server process, then persist through cron jobs. Add an alert this week for curl or wget executions launched by your web-server user and for cron entries created from PHP applications. Microsoft warns these agents swap IPs and user agents fast, so hunt the behaviour, not the strings. Microsoft Security Blog