A short reading list today: two security stories with direct practitioner impact. The Langflow agent-building framework has two critical flaws that leave servers open to unauthenticated attackers, fixed only in 1.13.0 — anyone running it should update now. And Google’s takedown of a 1.3-million-device Android botnet turned up a vendor backdoor that shipped deliberately inside TV boxes and, importantly, cannot be removed by their owners.