VulnCheck researcher Patrick Garrity said a canary system caught an attacker exploiting the bug on October 30, 2026. Two built-in Node-RED nodes make it, in his words, "trivial to weaponize": an inject node that fires a message on a schedule or at startup, and an exec node that runs shell commands. "Wire one to the other and the flow executes a command as soon as it is deployed, with no further interaction," he wrote in a Monday advisory.

The observed activity came from a single IP address in Microsoft's AS8075 network, geolocating to Brazil, which sent the complete exploit, flow and dropper in one request. The malware's filename, bot-linux-amd64, suggests it targets Linux on AMD64 processors, but the researchers did not retrieve the binary, so what it does once running remains unknown. Between October 30 and November 1, the same address hit the Node-RED flaw 16 times and logged 125 hits against eight different CVEs across VulnCheck's canary network, including a seven-year-old Apache Solr flaw. Garrity read the mix of old and new bugs across unrelated products as "opportunistic mass scanning rather than a targeted attack."

One hit delivered a different payload pointing to a separate server, leading Garrity to suggest a scan-and-infect arrangement in which hosts that find and exploit vulnerable instances pull the implant from a dedicated download server. The bug has been added to VulnCheck's Known Exploited Vulnerabilities catalog but, as of press time, had not appeared in the US Cybersecurity and Infrastructure Security Agency's equivalent list.