Urgent.News

What's breaking now, across thousands of outlets.

Saturday, 26 September 2026 Reading Room

Tech

What the September 2026 IBM advisory means for teams running Langflow OSS in production

What the September 2026 IBM advisory means for teams running Langflow OSS in production Vulnerability overview IBM shipped fixes for twelve vulnerabilities affecting IBM MQ, IBM MQ Appliance and Langflow OSS. The Dutch NCSC summarised them in advisory NCSC-2026-0392 on 23 September 2026. Langflow OSS accounts for several entries, three of which, CVE-2026-79724, CVE-2026-85025 and CVE-2026-81204,…

dev.to ·

The IBM advisory from September 2026 addresses twelve vulnerabilities across IBM MQ, IBM MQ Appliance, and Langflow OSS. Langflow OSS is notably impacted by three critical vulnerabilities (CVE-2026-79724, CVE-2026-85025, and CVE-2026-81204) that can be exploited without authentication, allowing for code injection and operating system command execution.

These unauthenticated issues pose a significant risk in production environments, as they could lead to credential exposure. Langflow services typically authenticate to various external services like model providers, datastores, and third-party APIs. An attacker gaining control over the Langflow service could potentially access these credentials, enabling unauthorized access to other systems.

According to the advisory, there are currently 18,550 instances of Langflow OSS in use globally, identified through a ZoomEye search. However, this number includes potential matches rather than confirmed vulnerable systems.

To mitigate the risk, users of Langflow OSS are advised to upgrade to the latest fixed builds provided by IBM. Critical steps include verifying the upgraded version and restricting access to the service post-upgrade. Additionally, hosts running Langflow should be isolated from sensitive secret storage, and any keys used by flows for provider authentication should be rotated after the patch to prevent potential exploitation of outdated credentials.

Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at dev.to →

More in Tech

Prices round up, discounts round down, and one package decides both

Munchable Premium is £10 a month. The price list has 24 currencies in it, and the rule the whole thing is built around is that the number you read is the number your card is charged.

  • Munchable Premium charges fixed prices in local currency
  • Prices rounded up via two-step process with conversion fee buffer
  • Discounts rounded down using mid-market rate

·dev.to

Deferred Deep Links in React Native: Complete Integration Guide

If you've shipped a React Native app, you've probably wired up universal links / app links already. Existing users tap a link, the OS hands it to your app, Linking.addEventListener fires, you push the…

  • Deferred deep linking preserves link context when app is not installed
  • Integration guide uses LinkTrail SDK for React Native apps
  • Handle both installed and first-time installs the same in router

·dev.to

Como proteger sua aplicação frontend contra ataques CSRF

Sabe o que é e como se proteger de ataques CSRF (Cross-Site Request Forgery) ? CSRF é um tipo de ataque no qual um usuário autenticado é induzido a executar uma ação que não pretendia realizar em uma…

  • CSRF tokens prevent unauthorized actions by authenticating users
  • Server generates unique, unpredictable CSRF tokens for user sessions
  • Frontend sends CSRF token in requests, backend validates before processing

·dev.to

Kram: A Tiny macOS Tool for Taming Chaotic Folders

I Built Kram: A File Organizer That Knows What Not to Touch My Downloads folder had become a crime scene. Hundreds of files. Random screenshots. ZIP archives. PDFs. DMGs. Old projects.

  • Kram is a macOS file organization tool
  • Categorizes files by type into sensible folders
  • CLI-first tool with future features in development

·dev.to

More from Saturday 26 September →