Path traversal flaw in AI dev platform Langflow exploited in attacks

Multiple active security incidents and high-impact vulnerability disclosures: attackers are actively exploiting a high-severity path traversal in Langflow (CVE-2026-5027) to write arbitrary files on exposed AI-dev servers. Other notable events include the brief public leak of the Miasma credential‑stealer source, GitHub/npm mitigations for supply‑chain attacks, ShinyHunters data thefts targeting Oracle PeopleSoft, expansion of the China-linked JDY botnet with U.S. military targeting, and a ServiceNow incident exposing customer data via an unauthenticated API. Microsoft patched an Exchange XSS