Hackers Launch Mass Attacks on Critical Langflow and Ruby on Rails Vulnerabilities

VulnCheck has reported active exploitation of two critical vulnerabilities affecting Langflow, a platform for building AI applications, and the Ruby on Rails web framework.

Two flaws

The first — CVE-2026-0768 (CVSS 9.8) — stems from insufficient validation of user input and allows arbitrary Python code to be executed in the context of the root user.

The second — CVE-2026-66066, dubbed KindaRails2Shell (CVSS 9.5) — gives an unauthenticated attacker the ability to read arbitrary files on the server and extract Rails secrets: the secret_key_base, the master key, database passwords, cloud storage credentials and API tokens. Ultimately this leads to remote code execution. The exploit hinges on a discrepancy between how Active Storage and the libvips library read uploaded files: it is enough to upload a specially crafted image. Vulnerable applications are those that use libvips to process images in Active Storage and accept uploads from untrusted users.

An explosive surge in attacks

On August 30, 2026, VulnCheck logged more than 50 hits on its “canary” traps within a few hours, and by Monday that number had grown to 360. According to the company's VP of threat research, Caitlin Condon, the attackers are conducting reconnaissance and harvesting credentials: they query environment variables (LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, AWS_SECRET*), read /root/.cache/langflow/secret_key, check SSH access and the size of .bash_history. The bulk of the traffic originates in Russia and so far has struck exclusively British traps.

Interest in Langflow is nothing new: since 2025 attackers have leveraged as many as 12 vulnerabilities, with over 15,000 successful attempts recorded. In one case the intruders dropped a Python credential harvester, proxy agents and SimpleHelp for remote access onto the system; in another, they turned the machine into a botnet node for mining Monero, first disabling auditd to create a forensic “blind spot.”

The patch doesn't fully save you

Attacks against CVE-2026-66066 have been observed against traps in Singapore, Israel and the United Kingdom. According to researcher Patrick Garrity, the activity comes from a single IP in France, with the command server hosted in Israel. An alarming detail: VulnCheck examined a patched server running version 8.1.3.1 and found that the patch blocks file reads via libvips but does not eliminate Marshal deserialization through the variation key — the RCE gadget still fires when a valid signature is present.

As of early August, more than 7,100 vulnerable Ruby on Rails instances had been identified online. The case once again underscores attackers' growing interest in AI development platforms: they open the door to sensitive secrets, cloud environments and connected systems.

Source: The Hacker News