Chinese hacker used DeepSeek to launch autonomous cyberattacks on vulnerable servers
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-68613 | Authenticated RCE in n8n Workflow Automation Expression Evaluation | 8.8 | 99% | KEVPoC ×2 | KEV |
| CVE-2026-21858 | Unauthenticated RCE in n8n Workflow Automation (Ni8mare) | 10.0 | 78% | PoC ×2 | |
| CVE-2026-3055 | Out-of-Bounds Read in Citrix NetScaler ADC and Gateway When Used as SAML IDP | 9.3 | 91% | KEVPoC | KEV |
| CVE-2026-33017 | Unauthenticated RCE in Langflow AI Workflow Builder | 9.3 | 96% | KEVPoC ×6 | KEV |
From the original article
3 min read at helpnetsecurity.com
A Chinese threat actor operating under the aliases “knaithe” and “KnYuan” used multiple LLMs to automate cyberattacks against internet-facing systems with limited human intervention. Researchers at Palo Alto Networks’ Unit 42 uncovered the operation after the threat actor’s AI agent misconfigured a file server, inadvertently exposing the entire infrastructure.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.