Threat · curated 5 Aug 2026
Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data
First reported · updated · 2 reports thehackernews.com
Coverage timeline
Why it matters
The Open VSX evil-twin campaign shows how AI coding agents and automated provisioning that install extensions and packages by name can be silently redirected to squatted, data-stealing counterparts, turning developer and CI environments into exfiltration targets.
Manifold Security identified 77 counterfeit "evil twin" extensions uploaded to the Open VSX registry between July 26 and August 1, 2026, each impersonating a real extension's name and namespace at version 0.0.1 and beaconing to a newly registered domain; 19 carried a full reconnaissance payload exfiltrating git remote host/org, commit email domain, workspace path, branch, HEAD commit, and CI project identifiers (effectively private repo paths on build runners). The packages were removed from Open VSX by August 3, though the contacted infrastructure remained live. The research ties the risk to automated name resolution by AI coding agents, devcontainer configs, and provisioning scripts that install by name across registries, citing Anthropic's July 30 slopsquatting disclosure where a model-invented package name was executed by fifteen real systems.
Summary
On August 5, 2026, CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild: a Langflow code injection flaw (CVE-2026-9198), an Apache Tomcat EncryptInterceptor bypass (CVE-2026-34486), and an N-able N-central authentication bypass (CVE-2026-18556).[0][9]
An incomplete fix for the N-central authentication bypass prompted a fresh patch tracked as CVE-2026-18577, which had already been placed in the KEV catalog days earlier; the latest additions signal both N-central vulnerabilities are being exploited by threat actors. FCEB agencies were given until August 7, 2026, to remediate.[0]
There are no public details on how the Langflow flaw is being exploited, but Langflow has been repeatedly weaponized in recent months. Exploitation of the Tomcat flaw has been attributed by Unit 42 to an AI-enabled autonomous campaign by a Chinese-speaking actor using DeepSeek via the Hermes Agent framework to target internet-exposed devices.[0][14]
Disclosure timeline
| Date | Event |
|---|---|
| April 2026 | Apache Tomcat EncryptInterceptor bypass (CVE-2026-34486) fixed in versions 11.0.21, 10.1.54, and 9.0.117.[0] |
| July 2026 | Langflow code injection RCE (CVE-2026-9198) fixed in version 1.10.1.[0] |
| August 4, 2026 (Monday) | CVE-2026-18577 (N-able N-central) placed in the KEV catalog.[0][9] |
| August 5, 2026 | CISA added CVE-2026-9198, CVE-2026-34486, and CVE-2026-18556 to the KEV catalog citing active exploitation.[0] |
| August 7, 2026 | Remediation deadline for Federal Civilian Executive Branch agencies.[0] |
Actor profile
knaithe / KnYuan
A Chinese-speaking threat actor based in Zhuhai, China, credited by Palo Alto Networks Unit 42 with an AI-enabled autonomous hacking campaign that leveraged DeepSeek via the Hermes Agent framework as an offensive operator against internet-exposed devices. The actor attempted to exploit over 460 targets using both autonomous and manual techniques, exploiting CVE-2026-34486 (Apache Tomcat) and conducting manual operations against Citrix NetScaler (CVE-2026-3055), Marimo (CVE-2026-39987), and IKE VPN (CVE-2026-33824). When an initial autonomous attempt against a Langflow flaw (CVE-2026-33017) failed due to restrictive target configuration, the AI agent autonomously researched other higher-value vulnerabilities, including flaws in n8n.[0][14]
How it works
CVE-2026-9198 is a code injection vulnerability in Langflow that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments (CVSS 9.8).[0]
CVE-2026-34486 is a missing encryption of sensitive data vulnerability in Apache Tomcat that allows a bypass of EncryptInterceptor, the cluster component that adds pre-shared key encryption to messages sent between cluster nodes (CVSS 7.5).[0]
CVE-2026-18556 is an authentication bypass vulnerability in N-able N-central (CVSS 8.2); its incomplete fix was superseded by CVE-2026-18577 (CVSS 8.2).[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Langflow | Default deployments vulnerable to CVE-2026-9198 | Fixed in July 2026 with version 1.10.1[0] |
| Apache Tomcat | Cluster deployments using EncryptInterceptor (CVE-2026-34486) | Fixed in April 2026 with versions 11.0.21, 10.1.54, and 9.0.117[0] |
| N-able N-central | Authentication bypass CVE-2026-18556; incomplete fix superseded by CVE-2026-18577 | N-able issued a fresh patch (CVE-2026-18577) after incomplete fix[0] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| cve | CVE-2026-9198 | Langflow unauthenticated RCE added to CISA KEV; actively exploited.[0] |
| cve | CVE-2026-34486 | Apache Tomcat EncryptInterceptor bypass added to CISA KEV; exploitation attributed to the knaithe/KnYuan actor.[0][14] |
| cve | CVE-2026-18556 | N-able N-central authentication bypass added to CISA KEV.[0] |
| cve | CVE-2026-18577 | N-able N-central authentication bypass (fresh patch after incomplete fix), placed in KEV; being exploited by threat actors.[0] |
| other | knaithe | Alias of the Chinese-speaking threat actor behind the AI-enabled autonomous campaign exploiting CVE-2026-34486.[0][14] |
| other | KnYuan | Alternate alias of the same Chinese-speaking threat actor.[0][14] |
Key takeaways
- Three actively exploited vulnerabilities in Langflow, Apache Tomcat, and N-able N-central were added to CISA's KEV catalog with a rapid FCEB remediation deadline of August 7, 2026.[0][9]
- An incomplete initial fix for the N-central authentication bypass (CVE-2026-18556) required a follow-up patch (CVE-2026-18577), and both are being exploited.[0]
- Exploitation of the Tomcat flaw was tied to an AI-driven autonomous campaign using DeepSeek via the Hermes Agent framework, illustrating attacker use of AI to accelerate target selection and scope-narrowing.[0][14]
Defensive actions
- Apply vendor patches for all three KEV vulnerabilities: Langflow 1.10.1, Apache Tomcat 11.0.21/10.1.54/9.0.117, and the N-able N-central fixes for CVE-2026-18556 and CVE-2026-18577.: CISA cites active in-the-wild exploitation, and FCEB agencies were required to remediate by August 7, 2026.[0]
- Prioritize remediation and monitoring of internet-exposed Tomcat clusters, Citrix NetScaler, Marimo, and IKE VPN endpoints.: Unit 42 attributes exploitation of CVE-2026-34486 and manual operations against these products to a Chinese-speaking actor targeting internet-exposed devices across over 460 targets.[0][14]