Attackers are attacking IBM Langflow and Apache Tomcat servers

Attackers have targeted IBM Langflow and Apache Tomcat servers, prompting urgent security updates from both vendors. According to reports from German cybersecurity outlet heise online, administrators of these systems must immediately deploy patched versions to defend against ongoing attacks. The vulnerabilities were identified through coordinated efforts by security researchers and government agencies. The attacks on IBM Langflow and Apache Tomcat came after warnings from U.S. authorities and independent security teams. The Cybersecurity & Infrastructure Security Agency (CISA) issued a notice highlighting potential risks, while Palo Alto Networks' Unit 42 team documented several incidents involving Apache Tomcat. These findings underscore the growing threat landscape targeting widely used software infrastructure. The impact of the attacks remains unclear, though detailed assessments suggest multiple attempts were made against Apache Tomcat servers. Researchers noted nine separate intrusion attempts, indicating a sustained effort by malicious actors. Meanwhile, IBM’s internal warning highlights a critical vulnerability in its Langflow tool, designated CVE-2026-9198. This flaw allows attackers to exploit default configurations and intercept a superuser token, granting them elevated privileges. With these credentials, intruders can access a function designed to analyze Python code. However, this function executes the code during analysis, enabling the execution of malicious payloads. As a result, affected systems face complete compromise. IBM has released version 1.10.1 of Langflow Open Source Software (OSS) with mitigations in place to address the issue. Apache Tomcat's vulnerability, labeled CVE-2026-34486 as high severity, poses a risk in clustered environments. Attackers can bypass the EncryptInterceptor mechanism, which normally ensures secure communication between cluster nodes. By doing so, they can eavesdrop on data traffic or even alter it, compromising confidentiality and integrity. Apache Tomcat developers have confirmed that patches are available for versions 9.0.117, 10.1.54, and 11.0.21, addressing the identified flaws. Administrators are advised to apply these updates promptly to prevent exploitation. Both IBM and Apache Tomcat have taken steps to mitigate the risks, but the situation underscores the importance of timely patch management. The attacks highlight how critical infrastructure components remain vulnerable despite known weaknesses, emphasizing the need for continuous vigilance and proactive security measures.