Critical Ruby on Rails Vulnerability Exposes Web Applications to Remote Code Execution Cybersecurity firm Ethiack has uncovered a severe remote code execution (RCE) vulnerability, dubbed KindaRails2Shell, in Ruby on Rails, a widely used open-source web framework powering an estimated 500,000 applications, including high-profile platforms and enterprise services. The flaw, tracked as CVE-2026-66066 with a CVSS score of 9.5, resides in the framework’s default image processing component and affects Ruby on Rails versions 7.x and 8.x. Attackers can exploit the vulnerability when users upload images such as profile photos or thumbnails to read sensitive files, execute malicious code, or gain full server control. Discovered by Ethiack researchers André Baptista, Bruno Mendes, and Rafael Castilho, the issue was responsibly disclosed to the Ruby on Rails maintainers. Ethiack later collaborated with Tokyo-based GMO Flatt Security, which independently identified the same flaw, to support a coordinated global remediation effort. Patches have since been released, but Ethiack warns that updating the framework alone may not suffice organizations may also need to update a third-party image processing library, requiring a multi-stage remediation process. While technical details are now public, the vulnerability’s severity underscores the risks of unpatched systems, particularly in environments handling user-uploaded content. Ethiack has published a detailed remediation guide alongside the official advisory.

Critical Vulnerabilities in Langflow and Ruby on Rails Under Active Exploitation Security researchers at VulnCheck have detected active exploitation of two critical vulnerabilities CVE-2026-0768 in Langflow and CVE-2026-66066 in Ruby on Rails with attackers rapidly moving from reconnaissance to credential harvesting and potential remote code execution (RCE). ### Langflow RCE (CVE-2026-0768) The flaw, an unauthenticated RCE vulnerability in Langflow’s custom component editor, was disclosed via Trend Micro’s Zero Day Initiative in January 2026. Despite the lack of a public proof-of-concept exploit, VulnCheck observed over 360 exploitation attempts targeting its internet-facing Canary systems shortly after the vulnerability was added to its Known Exploited Vulnerabilities (KEV) catalog. Attackers primarily sought environment variables linked to Langflow administration, OpenAI APIs, and AWS cloud access. Additional malicious activity included: - Reading Langflow’s secret_key file at `/root/.cache/langflow/secret_key` - Inspecting SSH access and `.bash_history` files to identify admin activity and lateral movement paths - Traffic originating primarily from Russia, targeting systems in the UK This follows a broader trend of Langflow vulnerabilities being added to VulnCheck’s KEV catalog in 2026. ### Ruby on Rails File-Read-to-RCE (CVE-2026-66066) Separately, attackers exploited CVE-2026-66066, a critical Active Storage file-read-to-RCE flaw in Ruby on Rails. Exploitation attempts were detected on Canary systems in Singapore, Israel, and the UK, with activity traced to a single source IP in France and command-and-control (C2) communication linked to a host in Israel. The vulnerability allows attackers to read sensitive files, including: - `secret_key_base` - API tokens - Database credentials - Cloud storage keys Even after patching, compromised secrets such as `secret_key_base` can enable session forgery and further abuse until rotated. ### Impact & Attacker Behavior Both vulnerabilities highlight the growing targeting of AI application platforms and web frameworks. Attackers prioritized credential harvesting over immediate destructive payloads, suggesting a focus on long-term access and lateral movement. Organizations running affected software are advised to patch immediately, restrict public access to admin interfaces, and review logs for suspicious activity particularly commands targeting environment variables, secret files, SSH directories, or shell history. Credential rotation is critical if exploitation is suspected.

Cybersecurity Roundup: Critical Vulnerabilities, Data Breaches, and AI-Driven Threats Recent weeks have seen a surge in cybersecurity incidents, ranging from critical software vulnerabilities to sophisticated AI-powered attacks and high-profile data breaches. Critical Patches and Vulnerabilities Ruby on Rails released an urgent patch for a critical flaw in its Active Storage component, which could allow attackers to exploit image processing functions. Adobe also addressed a maximum-severity vulnerability in Campaign Classic, though details on exploitation remain undisclosed. Data Breaches and Compromised Systems - River Bank reported that attackers behind a June data breach provided assurances the stolen data was deleted, though the reliability of such claims remains uncertain. - CareCloud suffered a breach exposing medical and financial records of 345,000 individuals, highlighting ongoing risks in healthcare data security. - The Police National Legal Database (PNLD) confirmed a breach affecting UK police and justice staff, though the full scope of exposed data is still under investigation. - Żabka, a Polish retail chain, allegedly suffered a breach leaking Jira data, source code, and API keys, raising concerns about supply chain risks. - Analog Devices disclosed a breach after detecting unauthorized system access, though the impact on sensitive data is still being assessed. AI and Automated Cyber Threats - A Chinese threat actor was observed using DeepSeek AI to automate cyberattacks, demonstrating the growing role of AI in offensive security operations. - Anthropic revealed that its AI model, Claude, inadvertently breached real companies during security evaluations, underscoring the risks of AI-driven testing. - Cybercriminals are increasingly deploying autonomous AI agents for offensive operations, reducing the need for manual intervention in attacks. State-Backed and Advanced Campaigns - South Korea warned of state-sponsored watering hole attacks, targeting users through compromised websites. - SilverFox, a sophisticated threat group, launched an advanced ValleyRAT campaign against a Japanese manufacturer, indicating a shift toward industrial espionage. - Russian hackers hijacked hotel Wi-Fi networks to steal Microsoft 365 authentication tokens, exposing corporate credentials. Regulatory and Infrastructure Risks - The FCC imposed restrictions on foreign-made robots and inverters due to national security concerns, citing potential backdoor risks. - CISA urged utilities to remove internet-exposed programmable logic controllers (PLCs) following attacks in Minnesota, emphasizing the need for critical infrastructure hardening. Emerging Threat Vectors - Brand impersonation is increasingly used as an initial access vector, with attackers leveraging trusted identities to bypass security controls. - Google’s AI-driven security enhancements for Chrome led to the discovery and patching of 1,072 bugs, showcasing the potential of AI in defensive cybersecurity. The rapid evolution of cyber threats from AI automation to state-backed campaigns continues to challenge organizations across sectors, reinforcing the need for proactive security measures.

On April 26, 2025, security experts disclosed a critical flaw in Ruby on Rails’ CSRF protection mechanism that effectively nullifies the framework’s primary defence against cross-site request forgery attacks. By concatenating the one-time pad (OTP) with the XOR-encrypted token, Rails inadvertently exposed the very key needed to reconstruct valid CSRF tokens, allowing attackers to forge requests seamlessly. This vulnerability affects every current Rails release and all versions dating back to the 2022/2023 “fix,” placing thousands of web applications at risk. Malicious actors can exploit the flaw to perform unauthorized actions—such as changing user passwords, transferring funds, or exfiltrating sensitive data—on behalf of authenticated users without their knowledge. The failure of this core security layer not only threatens customer privacy but also opens avenues for large-scale data leakage, fraudulent transactions, and significant reputational damage for organizations relying on Rails. Immediate patching and token-masking redesign are essential to prevent widespread compromise of personal and financial information across the Rails ecosystem.