Chinese Hacker Uses DeepSeek AI to Orchestrate Vulnerability Exploits
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-68613 | Authenticated RCE in n8n Workflow Automation Expression Evaluation | 8.8 | 99% | KEVPoC ×2 | KEV |
| CVE-2026-0300 | Unauthenticated Out-of-bounds Write RCE in Palo Alto Networks PAN-OS | 9.3 | 42% | KEV | KEV |
| CVE-2026-21858 | Unauthenticated RCE in n8n Workflow Automation (Ni8mare) | 10.0 | 78% | PoC ×2 | |
| CVE-2026-3055 | Out-of-Bounds Read in Citrix NetScaler ADC and Gateway When Used as SAML IDP | 9.3 | 91% | KEVPoC | KEV |
| CVE-2026-33017 | Unauthenticated RCE in Langflow AI Workflow Builder | 9.3 | 96% | KEVPoC ×6 | KEV |
| CVE-2026-33824 | Unauthenticated Double-Free RCE in Microsoft Windows IKE Extension | 9.8 | 77% | KEV | KEV |
| CVE-2026-34486 | EncryptInterceptor Bypass Exposes Cluster Traffic in Apache Tomcat | 7.5 | 99% | KEV | KEV |
| CVE-2026-39987 | Unauthenticated Remote Code Execution in Marimo Python Notebook | 9.3 | 100% | KEVPoC ×8 | KEV |
From the original article
2 min read at infosecurity-magazine.com
A Chinese threat actor has used large language models (LLMs) from Chinese and Western companies to compromise internet-exposed digital infrastructure in Asia. In particular, they leveraged one of DeepSeek’s AI models , Hermes Agent, an open-source agentic AI framework, to orchestrate the attack via Telegram.
By Kevin Poireault · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.