Critical vulnerabilities in Langflow and Ruby on Rails came under widespread attack within 72 hours of public disclosure, with VulnCheck recording over 360 exploitation attempts by September 1. CVE-2026-0768 allows attackers to execute arbitrary Python code as root on Langflow instances, while CVE-2026-66066 — dubbed KindaRails2Shell — enables file read, credential theft, and remote code execution on Rails applications using libvips for Active Storage.
CVE-2026-0768: Arbitrary Python Code Execution as Root on Langflow
CVE-2026-0768 carries a CVSS score of 9.8 and allows attackers to execute arbitrary Python code as root on vulnerable Langflow instances. VulnCheck observed attackers performing reconnaissance and credential harvesting activities, targeting environment variables and SSH access details.
Exploitation began August 30, with over 50 detections recorded within hours. By September 1, the count had climbed to 360. Traffic originates primarily from Russia, though attribution to a specific threat actor has not been confirmed. VulnCheck observed attackers performing reconnaissance and credential harvesting activities, systematically targeting environment variables that contain database credentials, cloud API keys, and SSH access details.
CVE-2026-66066: KindaRails2Shell File Read and RCE via Malicious Image Uploads
CVE-2026-66066 scores 9.5 and allows attackers to read arbitrary server files, steal Rails secrets, database credentials, cloud storage keys, and API tokens. The flaw enables remote code execution via malicious image uploads processed by libvips.
VulnCheck traced CVE-2026-66066 exploitation to a single French IP establishing command-and-control connections to Israel. Rails version 8.1.3.1 was released as a patch, but VulnCheck notes the fix blocks the libvips file read vulnerability without fully neutralizing the deserialization gadget chain that enables RCE. This incomplete remediation leaves residual risk for organizations that patch but do not implement additional defenses against malicious image handling.
Russian-Origin Langflow Traffic and French-to-Israel Rails C2 Suggest Organized Campaigns
The geographic distribution of exploitation activity points to organized reconnaissance campaigns rather than opportunistic scanning. Traffic targeting Langflow originates primarily from Russia, while Rails exploitation traces to a single French IP that established C2 connections to Israel.
These distinct geographic patterns for the two CVEs suggest separate attacker groups or infrastructure. The single-IP concentration for Rails exploitation could indicate a targeted campaign against specific Rails applications, while the broader Russian-origin traffic for Langflow suggests wider scanning for vulnerable instances.
Credential Harvesting and Incomplete Rails Patch Leave Residual Risk
The rapid exploitation timeline — detections within hours of disclosure — demonstrates the speed at which attackers scan for and weaponize newly disclosed critical vulnerabilities. The concentration of Russian-origin traffic for Langflow exploitation and the French-to-Israel C2 pattern for Rails exploitation suggest organized reconnaissance campaigns rather than opportunistic scanning.
Organizations running Langflow or Rails applications using libvips must patch immediately, but the incomplete nature of the Rails fix means that blocking the file read component does not eliminate the RCE attack surface. Security teams should monitor for anomalous outbound connections, review Active Storage configurations, and validate that patches are applied across all instances exposed to untrusted file uploads.
The 72-hour window from disclosure to 360 exploitation attempts highlights the automation and speed of modern vulnerability exploitation. Attackers scan for newly disclosed CVEs, develop working exploits from vendor advisories and proof-of-concept code, and deploy those exploits at scale within hours. The rapid timeline eliminates the traditional grace period organizations relied on for emergency patching, forcing security teams to treat critical vulnerability disclosures as active incidents requiring immediate response.
VulnCheck’s detection of reconnaissance and credential harvesting activities targeting environment variables and SSH access details indicates attackers are using these vulnerabilities not just for immediate compromise but as entry points for broader infrastructure access. Organizations that delay patching face not only exploitation of the disclosed vulnerability but potential lateral movement and credential theft that compounds the initial breach.
