AI Platforms Under Siege as Critical Flaws Exploited

New research from threat intelligence firm VulnCheck reveals that attackers are actively exploiting two critical vulnerabilities in Langflow and Ruby on Rails, using them for reconnaissance, credential harvesting, and command-and-control (C2) activity. The campaign has drawn attention for its speed and scope, with detections surging within hours of the initial observation.

The Two Flaws in Focus

The first vulnerability, CVE-2026-0768, has a CVSS score of 9.8. It stems from inadequate validation of user-supplied input, allowing an attacker to execute arbitrary Python code with root privileges. This flaw targets Langflow, an AI development platform.

The second vulnerability, CVE-2026-66066, nicknamed KindaRails2Shell, carries a CVSS score of 9.5. It impacts Ruby on Rails applications that use the libvips image processing library for Active Storage. An unauthenticated attacker can exploit a discrepancy between how Active Storage and libvips read input files by uploading a crafted image. This can lead to reading arbitrary files from the server, leaking Rails process environment variables, secrets like secret_key_base, the Rails master key, database passwords, cloud storage credentials, and API tokens, ultimately enabling remote code execution.

Successful exploitation of CVE-2026-66066 requires that affected applications use libvips for Active Storage image processing and accept image uploads from untrusted users.

Exploitation Surge on August 30

VulnCheck reported more than 50 detections within a few hours on August 30, 2026, a figure that has since risen to 360 as of Monday. This rapid escalation indicates active, automated exploitation attempts.

Credential Harvesting and Reconnaissance

The attackers are conducting a mix of reconnaissance and credential harvesting activities. According to Caitlin Condon, vice president of threat research at VulnCheck:

"Adversaries appear to be conducting a mix of reconnaissance and credential harvesting activities: Among other things, attacker requests are querying environment variables (LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, AWS_SECRET*), reading /root/.cache/langflow/secret_key, and checking .ssh access and .bash_history size."

Source traffic primarily originates from Russia and has thus far exclusively hit Canaries in the U.K.

Rise of AI Platform Targeting

The exploitation comes as threat actors have exploited as many as 12 vulnerabilities since 2025, with more than 15,000 successful attempts leveraging CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027. The majority of the vulnerable Langflow hosts are located in the U.S., Germany, Malaysia, Brazil, and India.

This trend underscores increased threat actor interest in AI development platforms, which can provide access to sensitive credentials, cloud environments, and other connected systems.

Observed Attack Chains

In one case against its canary systems, unknown threat actors exploited CVE-2026-5027 to drop a Python credential harvester, proxy agents, and SimpleHelp for remote access. In another, attackers weaponized CVE-2025-3248 to enlist the machine into an XMR cryptocurrency miner botnet.

VulnCheck described the sequence: "They then disabled auditd, resulting in a forensic blind spot, and exploited CVE-2026-0769 to drop .sysd. From there, the attacker pivoted to scan for other targets, likely to expand their cryptomining operation, and moved on to another host."

Active Exploitation of Rails Flaw

The threat intelligence company has also detected active exploitation of CVE-2026-66066 targeting its canaries in Singapore, Israel, and the U.K. In a post shared on LinkedIn, security researcher Patrick Garrity said the activity originates from a single IP address in France and establishes command-and-control (C2) to a host in Israel.

VulnCheck highlighted the inherent risk: "Active Storage always enables the libvips loaders that are unsafe for untrusted content, so any app that renders image-upload variants with the default vips processor can be coerced into loading a malicious upload."

Notably, the firm tested a patched 8.1.3.1 server and found that while the fix blocks the libvips file read, it does not neutralize the variation-key Marshal deserialization: the RCE gadget still executes on a patched server given a valid signature.

Scope of Exposure

As of early August, more than 7,100 exposed vulnerable instances of Ruby on Rails were identified by VulnCheck. The sheer number of internet-facing servers running the affected software highlights the potential scale of this threat.

Why It Matters

These attacks illustrate how AI development platforms, often trusted with sensitive credentials and cloud access, are becoming prime targets for cybercriminals. The combination of credential harvesting and cryptomining suggests attackers are seeking both direct financial gain and longer-term access. For organizations using Langflow or Ruby on Rails with Active Storage and libvips, the urgency to patch is high. But the persistence of the Rails RCE even on patched servers indicates that patching alone may not be sufficient; security teams may need to review their configurations and monitor for unusual activity. The active exploitation across multiple regions underscores that these threats are not theoretical—they are happening now.