CVE-2026-33017 Langflow RCE: isp.sh Dropper Fetching lambsys.elf Cryptominer

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•9

Detects the execution of a bash script dropper ('isp.sh') associated with Langflow RCE exploitation (CVE-2026-33017). The rule triggers when command-line arguments indicate an attempt to download and execute the 'lambsys.elf' Go-based cryptominer from a known malicious IP address (83.142.209.214).