Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity
Threat actors are actively exploiting two critical vulnerabilities – CVE-2026-0768 and CVE-2026-66066 – within Langflow and Ruby on Rails to conduct reconnaissance, credential harvesting, and remote code execution. The attacks, originating primarily from Russia and France, are targeting vulnerable instances across the U.S., U.K., and other countries, leveraging image uploads and exploiting a lack of proper input validation.
Threat actors are aggressively exploiting two critical vulnerabilities within Langflow and Ruby on Rails, according to VulnCheck. The vulnerabilities, CVE-2026-0768 (CVSS score: 9.8) and CVE-2026-66066 (aka KindaRails2Shell, CVSS score: 9.5), are being used to conduct reconnaissance and credential harvesting activities. VulnCheck reported over 50 detections within a few hours on August 30, 2026, with the number rising to 360 as of Monday.
Attackers are leveraging image uploads to exploit CVE-2026-0768, which involves a lack of proper validation of user-supplied input, leading to arbitrary Python code execution in the context of the root user. Simultaneously, CVE-2026-66066 allows unauthenticated attackers to read arbitrary files and leak sensitive information, including Rails process environment details, secret keys (like `secret_key_base`), database passwords, cloud storage credentials, and API tokens, ultimately enabling remote code execution. Successful exploitation requires affected applications to use libvips for Active Storage image processing and accept image uploads from untrusted users.
VulnCheck observed that threat actor traffic originates primarily from Russia and has thus far targeted Canaries in the U.K. Active Storage always enables the libvips loaders that are unsafe for untrusted content, so any app that renders image-upload variants with the default vips processor can be coerced into loading a malicious upload. Notably, a patched 8.1.3.1 server, while blocking the libvips file read, still allows RCE through variation-key Marshal deserialization.
In one case, threat actors exploited CVE-2026-5027 to drop a Python credential harvester, proxy agents, and SimpleHelp for remote access, while another utilized CVE-2025-3248 to enlist machines into an XMR cryptocurrency miner botnet. They then disabled auditd, resulting in a forensic blind spot, and exploited CVE-2026-0769 to drop .sysd, pivoting to scan for other targets to expand their cryptomining operation. The findings highlight increased threat actor interest in AI development platforms, which can provide access to sensitive credentials, cloud environments, and other connected systems.
Active exploitation of CVE-2026-66066 has been detected targeting canaries in Singapore, Israel, and the U.K., with traffic originating from a single IP address in France and establishing command-and-control (C2) to a host in Israel. As of early August, more than 7,100 vulnerable instances of Ruby on Rails were identified by VulnCheck.