Threat Intelligence Brief
Curated summary with source attribution
Source: bleepingcomputer.com
Threat Risk: High
Victim: Ruby on Rails applications using Active Storage with libvips
Incident: A critical vulnerability (CVE-2026-66066) enables arbitrary file read and potential RCE via crafted image uploads.
Impact: Full system compromise and exposure of sensitive application credentials.
Attacker: Unidentified threat actors
Analysis: The vulnerability arises from how Active Storage processes images using libvips, enabling attackers to read arbitrary files from the server. By accessing the ‘secret_key_base’, threat actors can forge session cookies and escalate the attack to remote code execution. The availability of public proof-of-concept exploits significantly increases the likelihood of widespread targeting.
Recommendations: Update Rails and libvips to the latest patched versions immediately.; Rotate the ‘secret_key_base’ and all associated database and cloud credentials.; Set the VIPS_BLOCK_UNTRUSTED environment variable to mitigate risk on supported systems.
Source: Bleeping Computer
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source
Latest Developments
Update — 2026-08-02 14:37 UTC
Discovery of a critical RCE vulnerability (CVE-2026-66066) in Ruby on Rails. Potential full server compromise and unauthorized code execution across an estimated 500,000 websites. The KindaRails2Shell vulnerability (CVE-2026-66066) leverages a flaw in the Ruby on Rails image processing component. Attackers can trigger remote code execution simply by uploading a malicious image file, such as a profile photo. Because the fix requires updating both the framework and a separate third-party library, many systems may remain exposed despite initial patching.
Corroborating source: cybersecurity-insiders.com
Update — 2026-09-01 07:57 UTC
Active exploitation of CVE-2026-0768 and CVE-2026-66066 for RCE and credential theft. Full system compromise, leakage of cloud secrets, and deployment of cryptocurrency miners. Threat actors are leveraging critical vulnerabilities in Langflow and Ruby on Rails to achieve remote code execution. Observed activity includes querying sensitive environment variables for AWS and OpenAI, as well as deploying cryptominers and remote access tools. This trend indicates a strategic pivot toward exploiting AI development infrastructure to gain access to high-value cloud environments.
Corroborating source: thehackernews.com