Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity

Summary

Attackers exploit critical Langflow and Ruby on Rails flaws (CVE-2026-0768, CVE-2026-66066) for code execution and data theft. VulnCheck observed over 360 detections, primarily from Russia, targeting systems in the UK. Exploitation includes credential harvesting and dropping malware for cryptocurrency mining.

Key Takeaways

1. Threat actors are exploiting two critical flaws impacting Langflow and Ruby on Rails.
2. CVE-2026-0768 (CVSS score: 9.8) - A lack of proper validation of a user-supplied input vulnerability that could be exploited to execute arbitrary Python code in the context of the root user.
3. CVE-2026-66066 aka KindaRails2Shell (CVSS score: 9.5) - A vulnerability that could allow an unauthenticated attacker to read arbitrary files from the server, leak Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials, and API tokens, ultimately leading to remote code execution.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article relies on findings from a reputable cybersecurity firm, VulnCheck, and cites specific CVEs and technical details. It presents factual information about vulnerabilities and exploitation attempts, though some claims about attacker origins and motivations are based on limited observations.

Bias assessment: Technical Security Reporting. The article focuses on technical details of cybersecurity threats and vulnerabilities. It reports on findings from a security research firm without adopting a partisan or overly emotional tone. The language is objective and informative, aimed at a technically aware audience.

Note: This article provides detailed technical information on cybersecurity vulnerabilities. While based on expert findings, readers should cross-reference with official advisories for comprehensive security guidance.

Credibility flag: Technical Security Insights

Claimed Facts (5)

• This is a direct statement of fact attributed to a specific source.
• This presents a specific vulnerability with its assigned score and technical description.
• This provides a specific vulnerability with its assigned score and detailed technical impact.
• This is a quantifiable observation reported by VulnCheck.
• This is a specific statistic reported by VulnCheck.

Opinions (5)

• This is an interpretation of the observed exploitation trends, suggesting a motive.
• While attributed to an expert, the use of 'appear to be' and the interpretation of attacker actions lean towards an informed opinion.
• This statement about the origin and target of traffic is presented as an observation but is based on limited data ('canaries') and could be an interpretation.
• This statement explains a technical mechanism and its implication, which is an expert's analysis and opinion on the vulnerability's exploitability.
• This is an expert's finding and analysis of a patched system's remaining vulnerability.

Claims (5)

• While plausible, the exact mechanism of exploiting a 'discrepancy' without further technical detail could be considered a simplified or potentially incomplete explanation of a complex exploit.
• The claim of '15,000 successful attempts' is a large, round number that lacks specific attribution or methodology for verification, making it potentially exaggerated or generalized.
• The term 'unknown threat actors' and the specific tools dropped are presented without further substantiation, making it a claim based on observation that could be incomplete.
• This is a specific claim about attacker actions ('weaponized') and the outcome ('enlist the machine') that, while possible, is presented without direct evidence of the 'weaponization' process.
• The claim of disabling 'auditd' to create a 'forensic blind spot' is a technical detail that, while possible, is presented as a definitive action without direct proof of intent or success in all cases.

Key Sources

• The Hacker News — Cybersecurity News Outlet
• VulnCheck — Cybersecurity Research Firm
• Caitlin Condon — Vice President of Threat Research at VulnCheck
• Patrick Garrity — Security Researcher