Today’s digest spans three different layers of the same problem: a pair of open-source flaws being actively harvested for cloud credentials, a medical device manufacturer whose on-prem recovery is stretching into a second week, and a preview of how much faster the exploit-discovery side of this equation is about to move. Here’s what’s new since yesterday’s digest.
Vulnerability watch: Attackers chain critical Langflow and Ruby on Rails flaws to harvest cloud and AI credentials
VulnCheck reported that threat actors are actively exploiting two unrelated but similarly severe flaws: CVE-2026-0768 in Langflow, the open-source platform for building AI agents (CVSS 9.8), and CVE-2026-66066 — dubbed “KindaRails2Shell” — in Ruby on Rails (CVSS 9.5). The Langflow bug sits in the code validator behind the platform’s custom component editor, where a lack of input validation on a user-supplied parameter lets an unauthenticated caller execute arbitrary Python as root; it affects all releases through 1.4.2, with a fix available in 1.11.6. The Rails flaw allows unauthenticated arbitrary file reads that expose secret_key_base, the Rails master key, database passwords, cloud storage credentials, and API tokens — enough to escalate to remote code execution. On the Langflow side, VulnCheck’s honeypots recorded attackers querying environment variables for LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, and AWS_SECRET*, reading cached secret keys, and checking SSH access and shell history — reconnaissance aimed squarely at harvesting AI and cloud credentials, not just gaining a foothold. Attack traffic originated primarily from Russia and targeted canary systems in the UK; VulnCheck logged roughly 360 exploitation attempts. The Hacker News · BleepingComputer
If your team has a Langflow instance anywhere in your environment — even a prototype spun up for an internal AI project — confirm it’s on 1.11.6 or later today, and treat any OpenAI or AWS keys that were reachable from that host’s environment as compromised: rotate them rather than waiting for confirmation of exfiltration. The same applies to any Rails application still unpatched against CVE-2026-66066. Both bugs share a pattern worth generalizing: newer AI tooling and long-lived web frameworks alike are only as safe as the secrets sitting in their process environment, and attackers are now automating the search for exactly that.
Breach watch: Boston Scientific’s cyberattack recovery drags into a second week, disrupting new cardiac monitor activations
Boston Scientific’s cyberattack — first detected August 25 and disclosed publicly the next day — is still not resolved more than a week later. In its latest update, the medical device maker said it has found no indication of unauthorized activity in its environment since August 25 and that the incident remains confined to certain on-premises systems, with cloud-based systems and applications unaffected. The company is working with CrowdStrike and other third-party specialists on investigation and recovery, and is “expeditiously working towards partial restoration” of product shipping this week, though it has not given a timeline for full restoration. Manufacturing, order processing, and shipping have all been disrupted, and staff at the company’s Cork, Ireland plant were sent home during the outage. On the clinical side, Boston Scientific said existing implantable cardiac rhythm management devices are unaffected, but the incident has disrupted new remote activations for some cardiac monitors. No attribution has been confirmed. SecurityWeek · MedTech Dive
A week-plus of manufacturing and shipping downtime — even with no confirmed data theft and cloud systems reportedly untouched — is a reminder that “contained to on-prem” is not the same as “low impact” when on-prem systems are wired into physical production and, in this case, device activation workflows. If any of your own critical operational systems still sit outside your cloud security tooling’s visibility, this is a good prompt to confirm you’d actually see lateral movement toward them before it became a week-long outage.
AI security watch: OpenAI says its Astra model is the first to cross its own “critical” cyber capability threshold
OpenAI disclosed that its upcoming Astra model is the first it has built that crosses the “Critical” cybersecurity capability threshold defined in its own Preparedness Framework — meaning it can identify and develop functional zero-day exploits against hardened real-world systems, or plan and execute end-to-end cyberattack strategies against a hardened target, without step-by-step human guidance. In testing, Astra scored 100% on ExploitBench, a benchmark for turning known vulnerabilities into working exploits, and in expert-led assessments against a hardened browser and operating system it discovered previously unknown vulnerabilities on its own, chained them into a full browser-compromise sandbox escape with host code execution, and separately combined multiple OS flaws into a local privilege-escalation path from an unprivileged user to root. OpenAI says it will still release Astra “soon” but plans to limit access to its cybersecurity-specific capabilities. CNBC · Axios
Whatever access controls one vendor puts around one model, this is a preview of where the whole category is headed: the time between a vulnerability existing and a working exploit existing is compressing, on both the offensive and defensive sides. It’s another argument for treating patch SLAs as a race you’re already behind in, not a quarterly housekeeping task — and it’s exactly the trend that makes stories like today’s Langflow and Rails exploitation less of an edge case and more of a preview.
Final thought
Three stories, one thread: attackers moved on two newly disclosed flaws before most teams had time to patch, a manufacturer is still recovering more than a week after an intrusion reached its production floor, and the tools for finding the next set of flaws just got dramatically faster on both sides of the fight. None of that is solved by any single control — it’s solved by shortening the gap between disclosure and remediation, and by having the visibility to catch lateral movement before it becomes a week of downtime. If you want a second set of eyes on either, see our how-to guides or book a discovery call.