⚡ Global Cyber Intel Digest: July 23, 2026

Coverage window: July 22, 2026, 08:00 — July 23, 2026, 08:00 UTC+8

This edition covers cybersecurity developments first published or materially updated during the reporting window.

Official advisories and original research were prioritised. Where exploitation is based on third-party telemetry, that source is identified explicitly. Claims made by ransomware or extortion operators are clearly separated from facts confirmed by affected organisations.

---

📝 Executive Summary — 10-Second Read

• 🔴 CISA has added Langflow CVE-2026-0770 to its Known Exploited Vulnerabilities catalogue. The flaw exposes an unsafe Python exec() path that can provide an unauthenticated attacker with remote code execution. Langflow versions through 1.7.3 are affected, and no patched release was listed at publication time.

• 🔴 Windmill CVE-2026-29059 is under active exploitation, according to VulnCheck telemetry cited by The Hacker News. A public log-retrieval endpoint accepts an insufficiently sanitised filename, enabling unauthenticated path traversal and arbitrary file reads. Deployments exposing privileged secrets may be chained into remote code execution.

• 🔴 SharePoint CVE-2026-50522 is being actively exploited against on-premises servers, according to third-party telemetry. Attackers are extracting SharePoint and IIS machine keys, meaning patching the vulnerable code alone may not eliminate the continued-access risk created by compromised cryptographic material. The vulnerability had not been added to CISA’s KEV catalogue at the close of the reporting window.

• 🟠 Operational disruption and third-party concentration remain prominent risks. Anubis claims to have stolen approximately 1 TB from Coca-Cola subsidiary Fairlife, while Stadler Rail says attackers used compromised supplier-platform credentials to access technical data.

---

🔍 Major Incidents: Technical Analysis

1. CVE-2026-0770: Langflow Validation Function Enables Remote Python Execution

Status: Added to CISA KEV during the reporting window
ZDI CVSS v3.1: 9.8 — Critical
GitHub CVSS v4.0: 8.9 — High
Analyst operational priority: 🔴 Critical
Direct impact: Unauthenticated remote code execution
Exploitation status: Confirmed through CISA KEV
Affected versions: Langflow 1.7.3 and earlier
Patch status: No patched version listed at publication time

Incident Overview

CISA added CVE-2026-0770 to its Known Exploited Vulnerabilities catalogue after evidence of active exploitation against Langflow, an open-source framework used to build AI applications, agents and LLM-driven workflows.

According to KEVIntel telemetry cited by BleepingComputer, more than 220 exploitation attempts were recorded from 64 source IP addresses before the KEV listing.

The reported activity included:

• System reconnaissance

• Second-stage payload downloads

• Attempts to access environment variables

• Attempts to retrieve AWS credentials

• Access to container or cloud-instance metadata

The risk extends beyond the Langflow application itself.

Langflow deployments frequently connect to:

• LLM providers

• Cloud accounts

• Vector databases

• Internal APIs

• Enterprise data stores

• Webhooks

• Automation systems

• Agent tools capable of modifying downstream platforms

A successful compromise may therefore expose credentials and privileges across multiple connected systems.

Technical Deep-Dive

The flaw exists in Langflow’s code-validation logic.

The vulnerable validate_code() function parses user-supplied Python source code and extracts function definitions. It then compiles and executes those definitions using Python’s built-in exec() function:

code_obj = compile(function_definition, "<string>", "exec")
exec(code_obj, exec_globals)

The problem is not simply that Langflow parses Python code.

It executes attacker-controlled definitions inside a global namespace that exposes Python built-ins and module-loading functionality.

The execution context may provide access to capabilities such as:

• importlib

• Python built-ins

• Operating-system modules

• Process-execution functions

• Network access

• File-system access

The validation routine appears to process function definitions without explicitly calling them.

However, Python evaluates several expressions while a function is being defined, including default argument expressions.

An attacker can therefore place a side-effecting expression inside a function definition.

When exec() creates the function, that expression is evaluated immediately, allowing operating-system commands to run before the function is ever invoked.

At a high level:

Attacker-controlled Python
          ↓
AST parsing accepts a function definition
          ↓
Function definition is compiled
          ↓
exec() evaluates the definition
          ↓
Definition-time expression performs a system action
          ↓
Code executes in the Langflow process context

ZDI states that authentication is not required and that successful exploitation may execute code with root privileges in affected installations.

Why This Matters

Langflow often functions as an AI automation control plane rather than an isolated application.

A compromised instance may expose:

• LLM-provider API keys

• Cloud-access credentials

• Database connection strings

• Vector-database tokens

• Internal documents used for retrieval-augmented generation

• Webhook secrets

• Agent tools with write privileges

• Credentials stored in environment variables

• Container service-account tokens

• Cloud-instance metadata

The practical attack path may become:

Langflow RCE
     ↓
Credential and secret discovery
     ↓
Cloud, database or SaaS access
     ↓
Data theft or workflow manipulation
     ↓
Persistence across connected platforms

Mitigation and Threat Hunting

At publication time, GitHub’s reviewed advisory listed Langflow versions through 1.7.3 as affected and did not identify a patched release.

Organisations should therefore:

1. Identify every Langflow deployment, including:

   • Public cloud instances

   • Kubernetes workloads

   • Developer environments

   • Internal AI laboratories

   • Proof-of-concept systems

   • Shadow IT deployments

2. Remove Langflow management and validation interfaces from direct Internet exposure.

3. Restrict access to trusted administrative networks, VPNs or identity-aware proxies.

4. Block or disable vulnerable code-validation functionality where operationally possible.

5. Consider suspending affected deployments where the vulnerable function cannot be isolated.

6. Search historical traffic for:

   • /api/v1/validate/code

   • Public flow-building endpoints

   • Requests containing Python function definitions

   • Default-argument expressions with side effects

   • Repeated validation errors followed by outbound connections

7. Hunt for:

   • New shell or Python child processes

   • Unexpected package installations

   • Download utilities

   • Second-stage scripts

   • Cloud-instance metadata access

   • Reads of environment variables

   • Credential-file access

   • Cryptocurrency miners

   • Reverse shells

   • New scheduled tasks or persistence mechanisms

8. Review downstream systems for use of credentials accessible from the Langflow runtime.

9. Rotate every secret reachable from the Langflow environment where successful code execution cannot be confidently excluded.

10. Continue monitoring Langflow and GitHub advisory channels for a supported fixed release.

References

CISA — Known Exploited Vulnerabilities Catalogue
www.cisa.gov/known-exploited-vul...

GitHub Advisory Database — GHSA-g22f-v6f7-2hrh
github.com/advisories/GHSA-g22...

Zero Day Initiative — ZDI-26-036
www.zerodayinitiative.com/advisories/ZDI-26-0...

BleepingComputer — CISA Orders Agencies to Address Actively Exploited Langflow RCE
www.bleepingcomputer.com/news/security/cisa-...

---

2. CVE-2026-29059: Windmill Path Traversal Exposes Server Secrets

Status: Active exploitation materially reported during the coverage window
Vendor/CNA severity: 🟡 Medium — CVSS v4.0 6.9
Analyst operational priority: 🟠 High due to reported exploitation
Direct impact: Unauthenticated arbitrary file read
Conditional chained impact: 🔴 Critical where privileged secrets can be extracted and used for code execution
Exploitation status: Active exploitation reported by VulnCheck and cited by The Hacker News
Fixed version: Windmill 1.603.3

Incident Overview

Attackers are exploiting CVE-2026-29059 against Internet-exposed Windmill instances.

Windmill is an open-source developer platform used to turn scripts into APIs, background jobs, workflows and internal applications.

The Hacker News, citing VulnCheck telemetry, reported active exploitation beginning on July 18 and identified approximately 170 potentially vulnerable systems across 24 countries.

The immediate vulnerability is an unauthenticated arbitrary-file-read primitive.

Its practical impact depends on:

• The deployment architecture

• Which files are reachable

• Which secrets are stored locally

• Whether privileged Windmill features are enabled

• Whether the instance is embedded within another platform

Technical Deep-Dive

Windmill exposes an API endpoint for retrieving job log files:

GET /api/w/{workspace}/jobs_u/get_log_file/{filename}

The jobs_u route is publicly accessible and does not require a bearer token.

In vulnerable versions, the application constructs the log-file path using the attacker-controlled filename without sufficiently restricting it to the intended directory.

Conceptually, the vulnerable logic behaves like:

path = log_directory + "/" + user_supplied_filename
return read_file(path)

Because traversal sequences are not removed or constrained, an attacker can request files outside the log directory:

../../../../target-file

The application resolves the resulting path and returns the targeted file.

From Arbitrary File Read to Remote Code Execution

For a standalone Windmill deployment without SUPERADMIN_SECRET configured, the vendor advisory states that the direct impact is arbitrary file read.

The risk becomes substantially higher where the file-read primitive exposes privileged credentials or administrative secrets.

Potential targets include:

• Environment files

• Windmill configuration

• Database credentials

• Container service-account tokens

• Cloud credentials

• SSH private keys

• Workflow secrets

• Webhook tokens

• SUPERADMIN_SECRET

• Docker-socket configuration

Where SUPERADMIN_SECRET is configured, an attacker may extract it and use privileged Windmill APIs to create or execute attacker-controlled jobs.

The vendor notes that this secret is rarely used in standard standalone installations and is not enabled by default.

Nextcloud Flow deployments may face a broader chain because the integration historically embedded Windmill and stored administrative credentials in accessible application data.

The original researcher demonstrated that the file-read primitive could be chained through credential theft into code execution and, under specific deployment conditions, broader Nextcloud compromise.

The discrepancy between the official CVSS score and the researcher’s critical assessment reflects different assumptions:

• Official score: Measures the direct arbitrary-file-read vulnerability.

• Researcher assessment: Measures the complete deployment-specific chain from file read to credential theft and remote code execution.

Mitigation and Threat Hunting

1. Upgrade self-hosted Windmill to version 1.603.3 or later.

2. Upgrade Nextcloud Flow to version 1.3.0 or later, or migrate to the newer decoupled integration model.

3. Remove Windmill API endpoints from direct Internet exposure.

4. Restrict access through:

   • VPNs

   • Identity-aware proxies

   • Administrative networks

   • Explicit IP allow lists

   • Authenticated reverse proxies

5. Search logs for requests to:

/api/w/*/jobs_u/get_log_file/

containing:

• ../

• URL-encoded traversal sequences

• Double-encoded traversal

• Absolute paths

• Requests for environment files

• Requests for database files

• Requests for operating-system configuration

• Requests for SSH keys or cloud credentials

6. Assume secrets may have been stolen from any vulnerable, Internet-accessible deployment.

7. Rotate:

   • SUPERADMIN_SECRET

   • Database passwords

   • Cloud credentials

   • API tokens

   • Webhook secrets

   • SSH keys

   • Kubernetes service-account tokens

   • Nextcloud integration credentials

8. Review Windmill for:

   • Newly created scripts

   • New or modified workflows

   • Unexpected administrative actions

   • Commands launched after suspicious file requests

   • New scheduled jobs

   • Outbound connections from workers

   • Changes to authentication or permission settings

9. Review downstream cloud, CI/CD, database and SaaS logs for activity using credentials previously accessible to Windmill.

10. Where privileged-secret theft cannot be excluded, treat the incident as a possible platform compromise rather than a file-disclosure event alone.

References

Windmill Security Advisory — GHSA-24fr-44f8-fqwg
github.com/windmill-labs/windm...

NVD — CVE-2026-29059
nvd.nist.gov/vuln/detail/CVE-202...

Original Research — Windfall: Nextcloud Flow and Windmill RCE Chain
chocapikk.com/posts/2026/windfall...

The Hacker News — Hackers Exploit Windmill Flaw to Read Server Files
thehackernews.com/2026/07/hackers-exp...

---

3. CVE-2026-50522: SharePoint RCE Used to Extract IIS Machine Keys

Status: Active exploitation materially reported during the coverage window
Microsoft CVSS v3.1: 9.8 — Critical
ZDI advisories: CVSS 8.1 — High attack complexity
Analyst operational priority: 🔴 Critical
Direct impact: Remote code execution
Observed post-exploitation activity: SharePoint and IIS machine-key theft
Residual risk: Forged application artefacts, impersonation and continued access after patching
Exploitation status: Active exploitation reported by watchTowr and Defused; not listed in CISA KEV at the close of the reporting window
Affected environment: On-premises SharePoint Server

Incident Overview

CVE-2026-50522 affects supported on-premises Microsoft SharePoint Server editions.

Attackers began exploiting the vulnerability shortly after functional proof-of-concept code became public.

Researchers observed successful requests designed to extract SharePoint and IIS machine keys, which may allow an attacker to generate application data that the server treats as cryptographically valid.

This creates an important incident-response distinction:

• The vulnerability provides the initial code-execution path.

• The stolen machine keys create a separate residual trust risk.

• Installing the patch does not automatically invalidate cryptographic material already obtained by an attacker.

At the close of the reporting window, active exploitation was supported by third-party telemetry, but CVE-2026-50522 had not been added to CISA’s Known Exploited Vulnerabilities catalogue.

Authentication and Scoring Discrepancy

Microsoft’s current CVE description and CVSS vector classify the vulnerability as requiring no privileges:

AV:N / AC:L / PR:N / UI:N

However, an earlier Microsoft advisory excerpt quoted by several publications described exploitation by an attacker authenticated as at least a Site Owner.

Defused reported that captured exploitation requests contained no authentication material.

The official CVE description now refers to an unauthorised attacker, but defenders should remain aware of the historical inconsistency when reviewing earlier reporting and detection assumptions.

There is also a difference between Microsoft’s CVSS assessment and the technical analysis published by Zero Day Initiative:

• Microsoft CNA: CVSS v3.1 9.8, low attack complexity

• ZDI advisories: CVSS 8.1, high attack complexity

ZDI published two advisories mapped to CVE-2026-50522:

1. An unsafe deserialisation issue involving SessionSecurityTokenHandler

2. Insufficient verification of a session-token cryptographic signature

The public exploitation chain appears to combine forged token handling with an unsafe deserialisation primitive.

Technical Deep-Dive

The public proof of concept targets SharePoint’s WS-Federation sign-in processing endpoint:

/_trust/default.aspx

At a high level, the exploit chain works as follows:

1. The attacker constructs a forged WS-Federation sign-in response.

2. A malicious .NET BinaryFormatter object graph is embedded inside a forged SecurityContextToken.

3. The token is delivered to SharePoint’s trust endpoint.

4. The token reaches a vulnerable session or token-processing component.

5. SharePoint deserialises attacker-controlled object data.

6. Methods or callbacks within the object graph execute during reconstruction.

7. The resulting gadget chain executes attacker-controlled code in the SharePoint server context.

Deserialisation converts stored or transmitted data back into application objects.

A safe deserialiser should restrict:

• Which object types may be created

• Which properties may be supplied

• Which callbacks may execute

• Which data sources are trusted

• Whether token signatures and authentication properties are valid

The application is not merely reading attacker-provided values.

It is rebuilding complex .NET objects, and certain object graphs can trigger method calls during reconstruction, turning data parsing into code execution.

Why Machine-Key Theft Changes the Response

IIS and SharePoint machine keys are used to protect or validate:

• Application state

• Authentication-related artefacts

• Signed data

• Encrypted tokens

• Other trust-sensitive application values

Once stolen, an attacker may be able to create artefacts that appear cryptographically valid to the application.

This produces two separate security problems:

1. The vulnerable code path, which is addressed by installing the security update.

2. The compromised trust material, which remains usable until it is rotated.

Therefore:

Patch installed ≠ prior compromise removed

The correct response sequence is:

1. Patch the vulnerable SharePoint farm.

2. Hunt for exploitation and persistence.

3. Remove confirmed intrusion artefacts.

4. Rotate machine keys and other exposed secrets using supported procedures.

5. Revoke affected sessions and credentials.

6. Monitor for continued use of forged or previously issued artefacts.

CISA’s broader guidance for recent SharePoint exploitation campaigns recommends assessing compromise and removing intrusion artefacts before replacing IIS machine keys.

Affected Products

The official CVE record lists affected builds of:

• Microsoft SharePoint Enterprise Server 2016

• Microsoft SharePoint Server 2019

• Microsoft SharePoint Server Subscription Edition

SharePoint Online is not included in the affected on-premises product set described by the CVE record.

Mitigation and Threat Hunting

1. Install Microsoft’s July 2026 SharePoint security updates immediately.

2. Confirm that every applicable server in the farm has been updated, including:

   • Application servers

   • Web front ends

   • Search servers

   • Disaster-recovery systems

   • Test and staging environments

3. Complete the required SharePoint configuration-upgrade process, including the appropriate PSConfig or supported farm-upgrade workflow.

4. Verify the resulting farm build rather than relying solely on Windows Update history.

5. Remove unpatched SharePoint servers from direct Internet exposure.

6. Ensure Antimalware Scan Interface integration is enabled for each SharePoint web application where supported.

7. Hunt for:

   • Requests to /_trust/default.aspx

   • Suspicious WS-Federation responses

   • Unexpected token-processing activity

   • Unexpected w3wp.exe child processes

   • PowerShell or cmd.exe launched by IIS workers

   • Newly written .aspx files

   • Web shells

   • Unknown assemblies

   • New scheduled tasks or services

   • Unusual outbound connections from SharePoint servers

   • Access to files or configuration containing machine keys

8. Review historical SharePoint and IIS telemetry covering the period before patch installation.

9. Remove confirmed intrusion artefacts before rotating machine keys.

10. Rotate:

• IIS and SharePoint machine keys

• SharePoint application secrets

• Service-account credentials

• Credentials accessible from compromised application pools

• Tokens and sessions issued using exposed cryptographic material

11. Treat any previously exposed and unpatched server as potentially compromised until historical investigation provides reasonable assurance otherwise.

References

Microsoft Security Response Center — CVE-2026-50522
msrc.microsoft.com/update-guide/vulner...

NVD — CVE-2026-50522
nvd.nist.gov/vuln/detail/CVE-202...

Zero Day Initiative — ZDI-26-412: Deserialisation of Untrusted Data
www.zerodayinitiative.com/advisories/ZDI-26-4...

Zero Day Initiative — ZDI-26-413: Improper Verification of Cryptographic Signature
www.zerodayinitiative.com/advisories/ZDI-26-4...

CERT-EU — Critical Vulnerability in Microsoft SharePoint
cert.europa.eu/publications/securi...

SecurityWeek — Fourth SharePoint Vulnerability Exploited in Recent Attack Wave
www.securityweek.com/fourth-sharepoint-v...

BleepingComputer — Critical SharePoint RCE Exploited to Steal Machine Keys
www.bleepingcomputer.com/news/security/criti...

---

🛠️ Vulnerability and Patch Watch

Oracle July 2026 Critical Patch Update: 1,449 New Security Fixes

Status: New vendor release during the reporting window

Oracle’s July 2026 Critical Patch Update contains 1,449 new security patches across product families including:

• Oracle Database

• E-Business Suite

• WebLogic Server

• Fusion Middleware

• Java

• MySQL

• PeopleSoft

• Identity products

• Communications platforms

• Hospitality and industry-specific applications

The scale of the update makes simple CVSS-only prioritisation impractical.

Oracle also warns that attackers continue to exploit older vulnerabilities for which security patches already exist, particularly where customers have delayed applying updates.

Recommended Prioritisation

Organisations should first identify vulnerabilities that are:

• Remotely reachable

• Exploitable without authentication

• Present in Internet-facing products

• Located in WebLogic, HTTP, integration or middleware layers

• Connected to identity, ERP, financial or HR data

• Applicable to products with previously observed exploitation

• Present in unsupported or forgotten systems

Recommended Approach

1. Map the advisory against an accurate product and version inventory.

2. Prioritise:

   • Internet-facing systems

   • Pre-authentication vulnerabilities

   • High-impact identity and middleware products

   • ERP and financial platforms

   • Unsupported product versions

3. Identify forgotten Oracle middleware, including:

   • Disaster-recovery systems

   • Reporting servers

   • Development environments

   • Test systems

   • Legacy integrations

4. Apply network restrictions, segmentation or virtual patching where immediate maintenance is impossible.

5. Confirm whether Oracle Cloud or managed-service teams have applied relevant fixes to customer environments.

6. Validate successful patching rather than relying only on change-management completion records.

Reference

Oracle — Critical Patch Update Advisory, July 2026
www.oracle.com/security-alerts/cpu...

---

🔐 Ransomware and Third-Party Risk Watch

Fairlife: Anubis Claims 1 TB of Stolen Data

Status: Materially amplified during the reporting window; Coca-Cola disclosed the underlying incident on July 16, while Anubis claimed responsibility on July 21
Confirmed impact: Unauthorised access to Fairlife systems and temporary suspension of United States production
Attacker claim: Approximately 1 TB of stolen data
Confirmation status: The claimed volume has not been independently confirmed by Coca-Cola or Fairlife

Incident Overview

Coca-Cola previously confirmed unauthorised access to portions of Fairlife’s systems, including production-related infrastructure, in connection with a ransomware incident.

The company temporarily suspended production at Fairlife’s United States facilities while investigating and restoring affected systems.

Coca-Cola stated that:

• Canadian production remained operational

• Product quality and safety were not affected

• The investigation remained ongoing

• The full scope and impact had not yet been determined

During the reporting window, the Anubis ransomware group claimed responsibility and said it had stolen approximately 1 TB of data.

The claimed data volume remains an attacker statement and has not been independently confirmed by Coca-Cola or Fairlife.

Defensive Takeaway

Suppliers, customers and partners should prepare for follow-on phishing or fraud using potentially stolen:

• Contracts

• Invoices

• Logistics information

• Production details

• Employee identities

• Supplier relationships

• Operational communications

Shared credentials, API keys and accounts connected to Fairlife-facing systems should be reviewed and rotated where appropriate.

Organisations should also monitor for:

• New phishing domains impersonating Fairlife or Coca-Cola

• Fraudulent payment instructions

• Supplier-account takeover

• Unexpected document-sharing invitations

• Credential reuse across partner platforms

References

The Coca-Cola Company — Form 8-K, July 16, 2026
investors.coca-colacompany.com/filings-reports/all...

Reuters — Anubis Claims Responsibility for Fairlife Attack
www.reuters.com/legal/government/ga...

---

Stadler Rail: Compromised Supplier Credentials Expose Technical Data

Status: Carry-over; company disclosure published July 21 and further circulated during the reporting window
Attack vector: Compromised credentials for a supplier data-exchange platform
Affected data: Supplier-related technical information
Core-network impact: Stadler says its internal IT environment and production systems were not compromised
Extortion demand: Approximately CHF 10 million

Incident Overview

Stadler Rail said attackers obtained compromised login credentials for a data-exchange platform shared with a supplier and used them to access technical information.

The attackers reportedly demanded approximately CHF 10 million.

Stadler stated that:

• It would not pay the ransom

• Its internal IT systems were not compromised

• Production continued normally

• No sensitive personal data was stolen

• Information concerning rail vehicles already in operation was unaffected

The incident demonstrates that a supplier-collaboration platform can contain information valuable enough for extortion even when the manufacturer’s core enterprise or production network is not directly compromised.

Defensive Takeaway

Organisations should review:

• Supplier portals

• Managed file-transfer systems

• Engineering data rooms

• Product-lifecycle-management platforms

• Shared SFTP accounts

• External-user identities

• Long-lived supplier credentials

• Download and archive activity

• Bulk access to technical documents

Access should be limited according to:

• Project

• Supplier

• Device

• Expiry date

• Data classification

• Geographic or network context

Possession of a valid supplier credential should not provide broad or indefinite access to technical repositories.

Reference

SWI swissinfo / Keystone-SDA — Cyberattackers Demand CHF 10 Million from Stadler
www.swissinfo.ch/eng/various/stadler...

---

🛡️ Today’s Defensive Action Items

P0 — Act Immediately

• Identify every Internet-facing Langflow deployment.

• Restrict or suspend vulnerable Langflow validation functionality.

• Isolate Langflow instances where code execution cannot be ruled out.

• Upgrade Windmill to 1.603.3 or later.

• Patch all Internet-facing on-premises SharePoint servers.

• Complete the SharePoint farm configuration-upgrade process.

• Hunt SharePoint systems before rotating IIS and SharePoint machine keys.

• Remove confirmed intrusion artefacts before trust-material rotation.

P1 — Rotate High-Value Secrets

Assume secrets may have been exposed wherever vulnerable AI, workflow or collaboration platforms were reachable.

Prioritise:

• Cloud-access keys

• Database passwords

• LLM-provider API keys

• Workflow and webhook secrets

• Kubernetes service-account tokens

• SSH private keys

• Windmill administrative secrets

• SharePoint machine keys

• Service-account credentials

• Tokens and sessions issued using compromised trust material

P2 — Hunt for Exploitation

Search for:

• Requests to Langflow code-validation endpoints

• Python or shell processes spawned by Langflow

• Cloud-metadata access from AI or workflow containers

• Windmill log-file requests containing traversal characters

• Newly created Windmill jobs or scripts

• IIS worker processes spawning command interpreters

• Newly created SharePoint web shells

• Unusual outbound traffic from workflow and collaboration platforms

• Access to machine-key or credential-storage locations

• Downstream use of secrets previously available to affected platforms

Platform-Governance Priority

• Do not expose AI builders or workflow engines directly to the Internet.

• Replace long-lived credentials with workload identity and short-lived tokens.

• Apply least privilege to automation and integration accounts.

• Add AI and workflow platforms to EDR, SIEM, attack-surface management and incident-response inventories.

• Treat supplier data platforms as sensitive enterprise repositories.

• Require phishing-resistant authentication for external supplier access.

• Scope supplier permissions by project, data type and expiry date.

• Monitor non-human identities and service accounts with access to business-critical systems.

---

📌 Final Assessment

Today’s incidents share one defining pattern:

The systems designed to automate trusted work are becoming high-value attack control planes.

• Langflow can turn code validation into unauthenticated remote execution.

• Windmill can turn a log-file endpoint into credential theft and, under specific conditions, remote code execution.

• SharePoint can turn token processing and unsafe deserialisation into code execution and compromised application trust.

• Supplier platforms can expose valuable engineering and operational information without a direct breach of the core enterprise network.

• Ransomware incidents can create operational disruption and downstream partner risk before the full data impact is understood.

These incidents also demonstrate that remediation cannot stop at the vulnerable software component.

A compromised platform may already have exposed:

• Cryptographic keys

• Cloud credentials

• Database passwords

• Automation privileges

• Active sessions

• Downstream integrations

• Internal data

• Supplier relationships

The defensive lesson is clear:

Patch the vulnerability—but also rotate the trust, credentials and automation privileges the vulnerable platform may already have exposed.

#CyberSecurity #ThreatIntelligence #CISO #SOC #Langflow #Windmill #SharePoint #AIsecurity #Ransomware #SupplyChainSecurity #IdentitySecurity #VulnerabilityManagement