Reported by 3 outlets

Timeline

1. original reporting

   Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs

   securityweek.com · 43d ago · August 31st, 2026

2. update from gbhackers.com

   Hackers Exploit Critical Langflow and Ruby on Rails Flaws in Active RCE Attacks

   gbhackers.com · 42d ago · September 1st, 2026

   Threat actors are actively exploiting two newly disclosed remote code execution vulnerabilities affecting Langflow and Ruby on Rails. These campaigns focus on cloud credential theft, host reconnaissance, and the establishment of command-and-control (C2) functions. VulnCheck researchers have reported exploitation targeting CVE-2026-0768 in Langflow, a low-code platform for building AI-powered applications and automated workflows. This vulnerability […] The post Hackers Exploit Critical Langflow and Ruby on Rails Flaws in Active RCE Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from cyberpress.org

   Hackers Exploit Critical Langflow and Ruby on Rails Flaws in Active RCE Attacks

   cyberpress.org · 42d ago · September 1st, 2026

   The campaigns target internet-exposed installations of the low-code AI application platform and the widely deployed web framework, underscoring how rapidly attackers are operationalizing newly disclosed flaws. The first issue, CVE-2026-0768, is an unauthenticated remote code execution vulnerability in Langflow’s custom-component editor. Critical Langflow and Ruby on Rails Flaws The flaw lies in the code-validation path, where insufficient validation of a user-supplied parameter before it is used to execute Python can allow an attacker to run code in the context of the root user. Caitlin Condon said its Canaries began recording first-time exploitation only hours earlier, despite no known public proof-of-concept exploit for the vulnerability. Researchers recorded more than 50 detections during the morning of the activity. The observed requests combined discovery and credential-harvesting behavior. Payloads queried environment variables potentially holding privileged Langflow, OpenAI API, and AWS access-key material; attempted to read Langflow’s cached secret key ; and checked SSH accessibility and the size of Bash history files. Traffic predominantly originated in Russia and, at the time of reporting, had exclusively reached Canary systems in the United Kingdom. CVE-2026-0768 was disclosed through Trend Micro’s Zero Day Initiative in January and was ad