Threat actors are actively exploiting two critical vulnerabilities in Langflow and Ruby on Rails, as reported by VulnCheck. CVE-2026-0768 (CVSS 9.8) affects Langflow and allows attackers to execute arbitrary Python code as root due to improper input validation. CVE-2026-66066 affects Ruby on Rails. The exploitation activity includes credential-probing and command-and-control (C2) operations. Both vulnerabilities are rated critical and are being leveraged in active attack campaigns. Organizations using these platforms are urged to apply patches immediately. The findings highlight the ongoing risk of unpatched web application frameworks being weaponized by threat actors.
Two critical vulnerabilities are being actively exploited: CVE-2026-0768 (CVSS 9.8) in Langflow allows arbitrary Python code execution as root due to improper input validation. CVE-2026-66066 (CVSS 9.5, aka KindaRails2Shell) in Ruby on Rails allows unauthenticated attackers to read arbitrary files, leak environment secrets (secret_key_base, Rails master key, database passwords, cloud credentials, API tokens), and achieve RCE. The Rails flaw exploits a discrepancy between Active Storage and libvips in how they process image uploads - Active Storage enables unsafe libvips loaders by default, allowing crafted image uploads to trigger malicious behavior. Notably, the patched version 8.1.3.1 blocks the libvips file read but does NOT neutralize the variation-key Marshal deserialization gadget, meaning RCE is still possible on patched servers with a valid signature. Attackers are querying environment variables (LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, AWS_SECRET*), reading /root/.cache/langflow/secret_key, and checking .ssh access and .bash_history. VulnCheck recorded 360+ detections as of early September 2026. Across related Langflow CVEs, 15,000+ successful exploitation attempts have been recorded since 2025. Threat actors have been observed dropping Python credential harvesters, proxy agents, and SimpleHelp for remote access, deploying XMR cryptocurrency miner botnets, disabling auditd to create forensic blind spots, dropping .sysd malware, and pivoting to scan for additional targets. CVE-2026-66066 exploitation establishes C2 from a French IP to a host in Israel, targeting canaries in Singapore, Israel, and the UK.
1. Patch Langflow immediately to address CVE-2026-0768, CVE-2026-0769, CVE-2026-5027, and CVE-2025-3248. 2. Patch Ruby on Rails to the latest available version beyond 8.1.3.1, and note that 8.1.3.1 does not fully remediate CVE-2026-66066 - the Marshal deserialization RCE gadget remains exploitable with a valid signature; await a more complete fix. 3. Disable or restrict image upload functionality in Rails apps using libvips Active Storage until a full patch is available. 4. Audit exposed environment variables and rotate all secrets including secret_key_base, Rails master key, database passwords, cloud storage credentials (AWS_ACCESS_KEY, AWS_SECRET_KEY), and API tokens. 5. Monitor for unauthorized access to /root/.cache/langflow/secret_key, .ssh directories, and .bash_history. 6. Check for presence of .sysd files, unauthorized SimpleHelp installations, Python credential harvesters, proxy agents, and XMR mining processes. 7. Verify auditd is running; a disabled auditd may indicate compromise. 8. Restrict public internet exposure of Langflow and Rails instances; place behind authentication and firewall rules. 9. Monitor network traffic for C2 communication, especially unexpected outbound connections. 10. Investigate hosts for signs of lateral movement and cryptomining activity. 11. Review VulnCheck intelligence at https://docs.vulncheck.com/initial-access/2026-08-07 for further detection guidance.
Malware dropper: .sysd (dropped via CVE-2026-0769), Tools: SimpleHelp (remote access), Python credential harvester, proxy agents, XMR cryptocurrency miner, Queried environment variables: LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, AWS_SECRET*, Accessed file: /root/.cache/langflow/secret_key, Accessed paths: .ssh directory, .bash_history, C2 host located in Israel, Attacker source IP located in France (CVE-2026-66066 activity), Source traffic from Russia targeting UK-based canaries (Langflow activity), Disabled auditd service (forensic evasion indicator)
