Langflow CVE-2026-33017 isp.sh dropper and lambsys deployment via web app parent

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•5

Detects suspicious activity originating from web application processes (python, uvicorn, gunicorn) involving the download and execution of a payload (isp.sh), followed by the deployment and execution of a binary (lambsys) within hidden directories in /var/tmp/. This rule flags indicators of compromise such as curl/wget calls to suspicious IPs, creation of hidden directories, and execution of binary files in temporary storage locations.