Hackers Exploit Critical Langflow and Ruby on Rails Flaws in Active RCE Attacks

Active exploitation campaigns are targeting an unauthenticated RCE in Langflow (CVE-2026-0768) and a Ruby on Rails Active Storage file read-to-RCE (CVE-2026-66066). Observed activity includes reconnaissance for environment variables and files holding OpenAI and AWS credentials, credential harvesting attempts, and establishment of C2 communications; detections were seen across Canary sensors in multiple countries, prompting urgent mitigation and credential rotation recommendations.