Langflow Cryptominer Malware Exploits CVE-2026-33017

A new campaign exploits CVE-2026-33017 to gain unauthenticated RCE on exposed Langflow AI endpoints and deploy a Go-based cryptominer derived from the KORKERDS playbook that disables defenses, persists using an 'init_rmount' file, propagates via stolen SSH keys as a worm, and uses a 39-entry kill list to remove competing malware; organizations are urged to patch Langflow to 1.9.0+, restrict public access, monitor for exploitation, and rotate exposed SSH keys.