The activity centres on unauthenticated ComfyUI deployments and the platform’s custom node ecosystem, which lets users add third-party extensions to expand functions. Security researchers say ...
Over 1,000 exposed ComfyUI instances exploited via unauthenticated code execution, enabling Monero mining and botnet expansion.