IBM patches critical Langflow OSS flaws with CVSS 9.8 scores, no auth required

·2 views

IBM released fixes for twelve vulnerabilities across IBM MQ, IBM MQ Appliance, and Langflow OSS, with Dutch cybersecurity agency NCSC summarising them in advisory NCSC-2026-0392 on 23 September 2026. Three Langflow OSS flaws — CVE-2026-79724, CVE-2026-85025, and CVE-2026-81204 — scored 9.8 on the CVSS v3 scale and can be exploited without any authentication, enabling arbitrary code or OS command execution. Because Langflow services typically hold credentials for model providers, datastores, and third-party APIs, successful exploitation could expose those secrets to attackers. A ZoomEye scan conducted on the same date identified over 18,500 fingerprinted Langflow instances publicly reachable online. Teams are advised to upgrade to IBM's fixed builds immediately, restrict network access during rollout, and rotate any provider keys stored within the platform after patching.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AI Agent Builds Browser Game, Hits Distribution Wall With Just One Outside Player

An autonomous AI agent operating with its own budget and goals spent four days attempting to get a stranger to play its self-built browser game, GUARDIAN: Galactic Battlefront. The agent faced repeated platform rejections — blocked on Hacker News due to low karma, locked out of Reddit over IP restrictions, and unable to upload files to game portals like itch.io. A community bounty offering 5,000 tokens for any agent earning $20 from an outside human expired with zero successful claims. Ultimately, a single unknown user followed a link, played to wave five, and left a three-word comment before the boss defeated them. The agent is now publicly asking developers where browser-based games can realistically reach new players without an existing audience.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Building a Mini Kubernetes Teaches You How the Real System Works

A new tutorial on DEV Community walks developers through building a small container orchestrator from scratch to understand how Kubernetes actually works under the hood. The guide explains core Kubernetes components — including the API server, etcd, scheduler, controller manager, and worker nodes — before using them as a blueprint for a local learning system. Readers follow a job from deployment through scheduling, container startup, and failure recovery via reconciliation loops. The article targets developers who can run containers and build web APIs but have never implemented a control plane. It also clarifies common misconceptions, such as the fact that Kubernetes does not automatically scale workloads and that a successful API request only signals accepted intent, not completed work.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Mitty library lets web workers access DOM objects via proxy RPC

A developer working on browser-based projects like Fake Linux Terminal and Hacking Cafe needed a way to give web workers access to DOM objects, which are normally inaccessible from isolated worker contexts. To solve this, they built Mitty, an open-source npm library that creates a transport-agnostic proxy RPC system. Mitty leaves real objects such as DOM nodes or jQuery instances on the main thread and exposes lightweight proxies to the worker, replaying entire method chains in a single message when awaited. The library works across web workers, service workers, browser tabs via BroadcastChannel, and even between Node.js servers and browser clients. Any object implementing a simple postMessage and addEventListener interface can serve as a communication channel with Mitty.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

FreshDeploy: Open-Source Tool to Verify Web Deployments After Release

A developer has built FreshDeploy, an open-source tool designed to verify web deployments after they go live. The tool checks deployed files, detects any changes, and offers an optional monitoring widget. FreshDeploy is currently in beta, and the creator is actively seeking feedback and suggestions from the community. The tool is available to try via npm and the source code is hosted on GitHub.

0 comments Read more at DEV Community