Attackers Exploit Critical Langflow and Ruby on Rails Flaws for Credential Theft and C2 Infrastructure

Security researchers have confirmed active exploitation of two critical vulnerabilities: CVE-2026-0768 affecting Langflow and CVE-2026-66066 (nicknamed KindaRails2Shell) in Ruby on Rails. The campaigns follow a clear pattern of initial reconnaissance and secret theft followed by efforts to establish command-and-control infrastructure, raising the risk of eventual remote code execution.

In Langflow, the flaw permits arbitrary Python code execution with root privileges because of inadequate input validation. Observed requests target environment variables such as LANGFLOW_SUPERUSER, patterns matching OPENAI_API keys, and AWS credentials including AWS_ACCESS and AWS_SECRET. Attackers have also attempted to read sensitive paths such as /root/.cache/langflow/secret_key and inspected local artifacts including .ssh directories and the size of .bash_history files.

The Ruby on Rails vulnerability is particularly concerning because it can be chained to achieve remote code execution. CVE-2026-66066 originates from an arbitrary file-read condition that activates when Active Storage processes image uploads using the libvips library. Exploitation requires that the application uses Vips as the variant processor and accepts image uploads from untrusted users. The root cause lies in discrepancies between how Active Storage interprets files and how libvips processes them, potentially leaking secrets used by Rails to protect sessions and encrypt data.

Recoverable secrets include secret_key_base, the Rails master key, database credentials, cloud storage keys, and external service tokens. With these materials an attacker can move from file reads to code execution, pivot across systems, and maintain persistence without valid credentials.

Indicators point to a distributed campaign. Langflow traffic has been linked primarily to Russian origins with confirmed impact on canary instances in the United Kingdom. For Rails, activity has been observed against canaries in Singapore, Israel, and the United Kingdom, with C2 communications directed toward a host in Israel from a single IP located in France.

Recommended defensive actions include identifying publicly exposed Langflow instances and Rails applications that use Active Storage with image uploads. For Rails, the primary mitigation is to update to versions 7.2.3.2, 8.0.5.1, or 8.1.3.1 and review the ruby-vips and libvips chain to block unsafe operations on untrusted content. If patching is delayed, organizations should disable Vips processing or restrict image uploads. Because the focus is on secrets, immediate rotation of secret_key_base, the master key, and any associated cloud, database, or API credentials is advised. Logs should be reviewed for suspicious reads of paths such as /proc/self/environ and config/master.key, while detection rules for C2 traffic should be strengthened.