A Langflow login could run host commands. CVE-2026-105740, rated 9.9, let non-admin users store Model Context Protocol (MCP) stdio commands and environment settings. Listing servers could run persistent commands with Langflow's privileges. At 00:34 CEST on 16 October, Previdian showed 1,654 attempts from 28 IPs across 16 countries on one sensor, including 297 on 15 October. These are attempts, not victims. Two fixes The first advisory lists 1.8.3 affected, 1.9.0 patched; the CNA's before-1.9.0 scope concerns stored REST configurations. The linked CVE-2026-105697 covered flow and tweak configurations still executable in 1.9.0–1.10.2. Fixed floors are langflow 1.10.3, langflow-base 0.10.3 and lfx 1.10.3. Development-only LANGFLOW_AUTO_LOGIN=true can issue credentialless tokens on exposed instances; otherwise the broader flaw requires authentication. The telemetry does not identify the access route. Later validation covers API, flow and tweak configurations before process creation, without a shell. Upgrade affected deployments; meanwhile, disable automatic login and limit access to trusted users. Some custom-code controls need 1.11.1+. Check version-specific package, interpreter and Docker hardening guidance. Keep the dates attached to their events The REST repair merged on 27 March 2026, and the broader repair on 14 July. The advisories appeared on 10 and 28 September. The first CVE record followed on 5 October. These are different milestones, not one disclosure date. Previdian records activity from 19 September to 15 October. These figures do not prove production execution, data theft or one campaign. Do not merge differently scoped dashboard windows. Work through a deployment review The NCSC's incident-management guidance calls for defined…