Two unrelated open-source projects, one AI workflow builder and one of the world’s most widely deployed web frameworks, are being probed by the same attack infrastructure in the same weekend. If either sits anywhere in your stack, this is worth ten minutes of your attention today.
Langflow: root code execution with no login required
CVE-2026-0768 lives in the code validator inside Langflow’s custom component editor. A user-supplied string that should be validated before being used in Python code execution isn’t, so an unauthenticated attacker can run arbitrary code as root on any Langflow instance up to and including version 1.4.2. It carries a CVSS score of 9.8. Langflow was reported through Trend Micro’s Zero Day Initiative back in July 2025 and disclosed as a zero-day in January 2026, which means organisations have had months to patch, and some clearly still haven’t.
Rails: an image upload that reads your secrets
CVE-2026-66066, nicknamed KindaRails2Shell, is a different class of bug entirely. It abuses a parser confusion across Active Storage, libvips, libmatio and HDF5: a file crafted with a MATLAB 5.0 header wrapped in an HDF5 container gets processed as an image variant, and that confusion lets an unauthenticated attacker read arbitrary files off the server. Pull the right file and you get secret_key_base, the Rails master key, database passwords and cloud storage credentials, which is more than enough to escalate to remote code execution. It scores 9.5 on CVSS v4 and affects Active Storage before 7.2.3.2, the 8.0 line before 8.0.5.1, and 8.1 before 8.1.3.1. Rails shipped fixes for all three branches on July 29, 2026. Apps using the ImageMagick processor instead of vips are not affected.
What VulnCheck actually saw
VulnCheck’s telemetry shows this isn’t theoretical. Its honeypots in the United Kingdom logged at least 50 exploitation attempts against Langflow over a single weekend, with the total climbing past 360 as researchers kept watching. The requests weren’t random noise, they queried specific environment variables including LANGFLOW_SUPERUSER, OPENAI_API* and AWS_ACCESS*/AWS_SECRET*, read /root/.cache/langflow/secret_key directly, and checked for SSH access and .bash_history size, textbook reconnaissance for a follow-on foothold. Command-and-control infrastructure tied to the campaign has already been observed standing up outside the initial target region, and UK-based honeypots being a primary observation point means European exposure here isn’t hypothetical.
What to do now
If you run Langflow, get to a version past 1.4.2 today, not this sprint, given that public exploitation is already under way. If you run Rails with Active Storage and the vips processor, confirm you’re on 7.2.3.2, 8.0.5.1 or 8.1.3.1 or later, and rotate secret_key_base and any credentials that touched an exposed instance regardless of patch status, since a file-read bug doesn’t announce itself in your logs the way an RCE attempt does. Either way, don’t assume “we patched eventually” means “we weren’t already read.”
If you need help auditing which AI tooling and application frameworks in your environment are exposed right now, contact Excello Digital. We help European teams find these gaps before attackers do the finding for them.