A vulnerability in Ruby on Rails' libvips image processing library (CVE-2026-66066) has been actively exploited since early March 2024. VulnCheck recorded more than 360 exploitation attempts within the first few days of disclosure. This vulnerability allows remote code execution through crafted image uploads, and over 7,100 exposed Rails instances remain vulnerable.
A second critical flaw in Langflow (CVE-2026-0768, CVSS 9.8) is also being exploited for credential probing and command-and-control infrastructure. Both vulnerabilities enable arbitrary code execution through components developers trust implicitly.
What Happened
Attackers found two pathways to remote code execution in widely used frameworks. In Rails applications using libvips for image processing, they can upload specially crafted image files that trigger command injection. In Langflow, an AI workflow platform, they can exploit an authentication bypass to execute arbitrary Python code through the platform's API.
VulnCheck's threat intelligence team observed both vulnerabilities being weaponized within 48 hours of public disclosure. The Rails exploitation attempts focused on credential harvesting and establishing persistent backdoors. The Langflow attacks targeted API endpoints to deploy command-and-control beacons.
Timeline
March 3, 2024: CVE-2026-66066 disclosed for libvips in Ruby on Rails
March 4-5, 2024: First exploitation attempts detected by VulnCheck
March 7, 2024: 360+ distinct exploitation attempts recorded
March 8, 2024: VulnCheck identifies 7,100+ vulnerable Rails instances exposed to the internet
March 10, 2024: CVE-2026-0768 exploitation in Langflow begins, targeting credential stores
Ongoing: Both vulnerabilities remain actively exploited
Which Controls Failed
Dependency security assessment: Neither vulnerability was caught during initial library integration. Rails applications pulled in libvips without evaluating its attack surface. Langflow's authentication layer wasn't tested against bypass scenarios.
Exposure management: 7,100 vulnerable Rails instances shouldn't be discoverable from the internet. This indicates missing network segmentation and inadequate exposure monitoring.
Patch velocity: The gap between disclosure and remediation created a window attackers exploited aggressively. Organizations lacked the process to identify affected systems and deploy patches within 24-48 hours.
Runtime protection: No web application firewall rules, no runtime application self-protection, no anomaly detection on image upload endpoints. Attackers had clear paths from external requests to code execution.
What Standards Require
PCI DSS v4.0.1 Requirement 6.3.2 mandates that all system components and software are protected from known vulnerabilities by installing applicable security patches within one month of release. For critical vulnerabilities, you need to address them "as soon as possible." A CVSS 9.8 vulnerability with active exploitation doesn't get a month.
Requirement 6.3.3 requires an inventory of bespoke and custom software, and third-party software components. If you can't identify which applications use libvips, you can't patch them. The 7,100 exposed instances suggest many organizations lack this inventory.
OWASP ASVS v4.0.3 Section 14.2 covers dependency management. Requirement 14.2.1: "Verify that all components are up to date, preferably using a dependency checker during build or compile time." Both vulnerabilities existed in dependencies, not application code. Your build pipeline should flag vulnerable versions before deployment.
ISO/IEC 27001:2022 Control 8.8 (Management of technical vulnerabilities) requires you to obtain timely information about technical vulnerabilities, evaluate exposure, and take appropriate measures. The control explicitly states you should prioritize based on risk. A remotely exploitable RCE vulnerability in an internet-facing application is maximum priority.
NIST 800-53 Rev 5 SI-2 (Flaw Remediation) requires you to identify, report, and correct system flaws, test software updates, and install security-relevant updates within defined time periods. The control enhancement SI-2(2) requires automated patch management tools. Manual patching doesn't scale when you have hundreds of application instances.
Lessons and Action Items
Build a dependency bill of materials: You can't patch what you can't see. Generate an SBOM for every application using tools like Syft or the native capabilities in your build system. Store these in a searchable database. When CVE-2026-66066 drops, you need to answer "which apps use libvips?" in under an hour.
Set patch SLAs based on CVSS + exploitation: Your policy probably says "critical patches within 30 days." Rewrite it. CVSS 9.0+ with public exploits gets 48 hours. CVSS 7.0-8.9 with active exploitation gets one week. Everything else follows your standard cycle. Document the exceptions process for production changes.
Monitor for vulnerable versions in production: Deploy tools like Wiz, Snyk, or Prisma Cloud that continuously scan running containers and VMs for vulnerable packages. Don't wait for the next scan cycle. When a critical CVE hits, you need real-time visibility into exposure.
Segment and firewall image processing: Image upload endpoints are high-risk. Put them behind a WAF with rules for suspicious file types and sizes. Better yet, process uploads in isolated containers that can't reach your database or internal services. If an attacker gets RCE in your image processor, they shouldn't get your customer data.
Test authentication boundaries: The Langflow vulnerability was an auth bypass. Your penetration tests should include authentication boundary testing for every API endpoint. Use tools like Burp Suite or ZAP to verify that authentication can't be circumvented through parameter manipulation, header injection, or path traversal.
Integrate threat intelligence into your workflow: VulnCheck caught these exploits within 48 hours. Subscribe to threat intelligence feeds and route alerts to your security operations channel. When a vendor reports active exploitation, that's your signal to move from "scheduled maintenance" to "emergency patch."
The 7,100 vulnerable Rails instances represent organizations that either don't know they're exposed or lack the process to patch quickly. Don't be in that group. Map your dependencies, set aggressive SLAs for critical vulnerabilities, and test your ability to patch production systems under time pressure. The next critical RCE won't wait for your change control board meeting.
