RufRoot CVE-2026-59726: Ruflo MCP Bridge RCE via terminal_execute Spawning Shell

Ethan Andrews@eandrews

•updated Jul 29, 2026•14•0•27

Detects potential exploitation of CVE-2026-59726 (RufRoot) against the Ruflo MCP bridge service. The rule identifies when the 'node' or 'ruflo' processes spawn shell interpreters (sh, bash) with command-line arguments typical of initial reconnaissance (id, hostname, whoami, uname) or arbitrary command execution, indicative of an unauthenticated remote code execution attempt.