Security researchers at VulnCheck report attackers are actively exploiting two unrelated but equally severe flaws within days of each other: a code-execution bug in Langflow, an open-source tool many teams use to build AI automation pipelines, and a file-read bug in Ruby on Rails, one of the most widely used web application frameworks. The Langflow flaw (CVE-2026-0768, CVSS 9.8) lets an attacker run code as the server's root user without logging in first. The Rails flaw, nicknamed "KindaRails2Shell" (CVE-2026-66066, CVSS 9.5), lets an attacker read files off the server by uploading a crafted image, exposing the secret keys, database passwords, and API tokens a Rails app relies on to trust its own users — often enough on its own to reach full remote code execution.
VulnCheck logged over 50 exploitation attempts within hours of one campaign starting on 30 August, rising past 360 by the following Monday, with attackers probing infected servers for AI-provider API keys, cloud credentials, and SSH history rather than just testing whether the bug works. Vulnerable Langflow servers have been found worldwide, including in Malaysia. Patches exist for both flaws, but Rails' fix has a catch: even a fully updated 8.1.3.1 server can still be tricked into running the same malicious code path given a validly signed request — the patch closes the file-read step, not the deeper flaw underneath it.
What this means for your business
If your business runs a customer-facing web app, there is a decent chance it is built on Rails or a framework like it — and "we already patched" is not automatically the end of the story here, since the underlying flaw survives the update. Ask your developer or hosting provider two direct questions this week: which framework version is actually running in production, and has the specific Rails Active Storage advisory been checked against it, not just a general "we're up to date." If your team uses Langflow, or any AI workflow or agent-builder tool, to wire together internal automations, treat any API keys or credentials stored inside it as potentially exposed and rotate them, then make sure the admin interface sits behind a VPN or IP allowlist rather than a public URL. More broadly, this is a reminder that patching alone does not always close every door a serious flaw opens — a proper fix review after any "critical" advisory should ask what the patch did not cover, not just whether it was applied.