The probe strings look like they were written by someone with the software open. LANGFLOW_SUPERUSER is the application's own admin credential, and /root/.cache/langflow/secret_key signs its tokens. OPENAI_API*, AWS_ACCESS* and AWS_SECRET* are the keys that get an attacker off the host and into a cloud tenant, while the checks on .ssh access and .bash_history size are triage for where to go next [6]. All of it lands as root, because CVE-2026-0768 executes attacker-supplied Python in the root context [2].
The arithmetic on the growth: 360 divided by 50 is 7.2, and that is a ceiling rather than a rate, because VulnCheck's early figure was stated as more than 50 [5][17]. The start of the window is dated to August 30, 2026. The endpoint is given only as "Monday" [5]. The 360 is also not broken out by CVE in VulnCheck's account, though the strings quoted alongside it are Langflow-specific [5][6].
The Rails half of the week is where the patch math gets awkward. CVE-2026-66066, CVSS 9.5, lets an unauthenticated attacker read arbitrary files and leak the Rails process environment, including secret_key_base, the master key, database passwords and cloud storage credentials [3]. Exploitation needs a crafted image upload and an app that uses libvips for Active Storage processing and accepts uploads from untrusted users [4]. VulnCheck says Active Storage always enables the libvips loaders that are unsafe for untrusted content [14]. It then tested a patched 8.1.3.1 server and found the fix blocks the libvips file read but does not neutralize the variation-key Marshal deserialization, so the RCE gadget still executes given a valid signature [15]. If the pre-patch read already yielded the signing key, the upgrade closes the door the attacker used to get the key, not the door the key opens.
The Langflow activity sits inside a longer pattern. VulnCheck counts 12 vulnerabilities exploited since 2025, with more than 15,000 successful attempts across CVE-2026-0769, CVE-2025-3248 and CVE-2026-5027 [8]. On its canaries, one crew used CVE-2026-5027 to drop a Python credential harvester, proxy agents and SimpleHelp for remote access [10]. Another used CVE-2025-3248 for an XMR miner, disabled auditd to create a forensic blind spot, exploited CVE-2026-0769 to drop .sysd, then scanned outward and moved on [11]. That is commodity operators cycling an exploit set, not a single actor's private bug.
Attribution, kept separate. VulnCheck says the Langflow source traffic comes primarily from Russia and has so far hit only its UK canaries [7]. For the Rails exploitation against canaries in Singapore, Israel and the UK [12], researcher Patrick Garrity said in a LinkedIn post that the traffic comes from a single IP address in France with command and control to a host in Israel [13]. One publisher, one post, one IP.
Most vulnerable Langflow hosts are in the US, Germany, Malaysia, Brazil and India [9]. An internet-reachable instance holding model and cloud keys is an application server with credentials in its environment, and the detection curve says it is being scanned like one [6][19].
