Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity
Summary: VulnCheck recorded more than 50 detections of CVE-2026-66066 exploitation within a few hours on August 30, 2026, rising to 360 by Monday, with requests querying environment variables such as LANGFLOW_SUPERUSER and AWS_ACCESS*, reading /root/.cache/langflow/secret_key, and checking .ssh access and .bash_history size. VulnCheck said source traffic primarily originates from Russia and has hit only canaries in the U.K., while researcher Patrick Garrity reported separate activity from a single IP in France establishing command-and-control to a host in Israel, and VulnCheck found a patched 8.1.3.1 Rails server still executes the RCE gadget via variation-key Marshal deserialization given a valid signature.
What's compelling: VulnCheck counted more than 7,100 exposed vulnerable Ruby on Rails instances as of early August, and its test of a patched 8.1.3.1 server showed the fix blocks the libvips file read but leaves the deserialization path intact - so patching alone may not close the hole.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2025-3248CVE-2026-0769CVE-2026-5027CVE-2026-66066
- Related
- CVE-2025-3248: Langflow Missing Authentication Vulnerability Known Exploited Vulnerabilities · May 05, 2025