"Adversaries appear to be conducting a mix of reconnaissance and credential harvesting activities: Among other things, attacker requests are querying environment variables (LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, AWS_SECRET*), reading /root/.cache/langflow/secret_key, and checking .ssh access and .bash_history size," Caitlin Condon, vice president of threat research at VulnCheck, said.
CVE-2026-0768: arbitrary Python execution against Langflow
VulnCheck has documented active exploitation of CVE-2026-0768, rated 9.8 in CVSS, which stems from a lack of proper validation of user-supplied input and can allow execution of arbitrary Python code as root. The company reported that attackers have taken advantage of this class of flaws across Langflow hosts and that the activity is part of a broader campaign that has exploited as many as 12 vulnerabilities since 2025. VulnCheck observed more than 15,000 successful attempts leveraging related flaws including CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027.
CVE-2026-66066 (KindaRails2Shell): Rails image-processing path to secrets and RCE
CVE-2026-66066, nicknamed KindaRails2Shell and scored 9.5, targets Ruby on Rails applications that use Active Storage with libvips for image processing and accept image uploads from untrusted users. The vulnerability allows an unauthenticated actor to read arbitrary server files, leak Rails process environment variables and secrets — including secret_key_base and the Rails master key — and ultimately achieve remote code execution. VulnCheck explained the vector as a discrepancy between how Active Storage and libvips read input files: "Active Storage always enables the libvips loaders that are unsafe for untrusted content, so any app that renders image-upload variants with the default vips processor can be coerced into loading a malicious upload."
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildObserved attacker behavior, attribution details, and scale
VulnCheck recorded more than 50 detections within a few hours on August 30, 2026; that figure rose to 360 "as of Monday," the company said. Source traffic to the firm's canaries has "primarily originate[d] from Russia" and — in VulnCheck's observations — has hit canaries in the U.K. Patrick Garrity, a security researcher, posted that activity exploiting CVE-2026-66066 "originates from a single IP address in France and establishes command-and-control (C2) to a host in Israel."
The behavioral footprint on VulnCheck canaries includes credential-probing queries for environment variables such as LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, and AWS_SECRET*, attempts to read stored secrets like /root/.cache/langflow/secret_key, and checks for .ssh access and .bash_history size. In previously observed campaigns, unknown actors exploited CVE-2026-5027 to drop a Python credential harvester, proxy agents, and SimpleHelp for remote access; in another instance CVE-2025-3248 was weaponized to enroll hosts in an XMR cryptocurrency miner botnet. Attackers in those cases also disabled auditd, creating forensic blind spots, and used CVE-2026-0769 to drop .sysd before scanning for additional targets.
Impact on Langflow hosts and exposed Rails instances
VulnCheck said the majority of vulnerable Langflow hosts are located in the U.S., Germany, Malaysia, Brazil, and India. As of early August, the company identified more than 7,100 exposed vulnerable instances of Ruby on Rails. The activity observed against canaries shows a mix of reconnaissance, credential harvesting, and post-exploitation tooling consistent with long-term access and lateral movement attempts.
On mitigations, VulnCheck reported testing a patched Rails server (8.1.3.1) and found the patch blocks the libvips file read but does not neutralize a "variation-key Marshal deserialization" — meaning the remote-code-execution gadget still executes on a patched server if a valid signature is present.
What this means for technologists, affected enterprises, and adversaries
- Technologists and security teams: Monitor indicators observed on VulnCheck canaries — queries for LANGFLOW_SUPERUSER and cloud API secrets, reads of /root/.cache/langflow/secret_key, and unusual .ssh/.bash_history access — and review whether applications use Active Storage with the default vips processor and accept untrusted image uploads.
- Affected enterprises and Langflow operators: Note the geographic distribution VulnCheck reported (U.S., Germany, Malaysia, Brazil, India) and that prior intrusions have dropped credential harvesters, proxy tools, SimpleHelp, and cryptomining payloads; these are tangible consequences of successful exploitation in the wild.
- Adversaries and threat actors: The record shows a mixed playbook — reconnaissance and credential harvesting, followed in some cases by remote access tools and cryptomining — and multiple infrastructure points observed in these campaigns, including C2 links described by researchers.
The latest findings from VulnCheck underscore active, multi-vector exploitation against both an AI development platform and a widely used web framework. Attackers are leveraging file-processing differences, weak input validation, and serialized-object behaviors to steal secrets and gain persistent access; the firm’s canary telemetry shows the activity is already distributed across geographies and tooling. How defenders and platform maintainers respond to the specific mechanics of libvips/Active Storage and the remaining Marshal-deserialization risk will determine whether these incidents remain localized or escalate into broader intrusions.
