Overview
- The Censys State of the Internet report released this week and reported by multiple outlets found a roughly 63% increase in internet‑facing AI infrastructure over nine months, lifting public counts to the high‑hundreds of thousands of systems or IP addresses.
- Censys identified n8n as the most widely exposed product with about 114,000 internet‑facing deployments and roughly 77,000 running versions linked to at least one recently disclosed critical vulnerability.
- Langflow grew about 169% in the period and has been tied to 18 CVEs, 14 with CVSS scores above 8.0, and four of its flaws are listed in CISA’s Known Exploited Vulnerabilities catalog.
- LiteLLM nearly doubled in deployments and is associated with an actively exploited pre‑authentication SQL injection tracked as CVE‑2026‑42208, a flaw attackers can use without valid credentials.
- Security teams are urged to inventory AI orchestration and inference components, triage exposed services by exploitability, patch or mitigate high‑risk versions, harden management interfaces, and tighten identity controls because attackers are shortening discovery‑to‑weaponization timelines.