Threat Intelligence Brief
Curated summary with source attribution
Source: bleepingcomputer.com
Threat Risk: High
Victim: Ruby on Rails applications using Active Storage with libvips
Incident: A critical vulnerability (CVE-2026-66066) enables arbitrary file read and potential RCE via crafted image uploads.
Impact: Full system compromise and exposure of sensitive application credentials.
Attacker: Unidentified threat actors
Analysis: The vulnerability arises from how Active Storage processes images using libvips, enabling attackers to read arbitrary files from the server. By accessing the ‘secret_key_base’, threat actors can forge session cookies and escalate the attack to remote code execution. The availability of public proof-of-concept exploits significantly increases the likelihood of widespread targeting.
Recommendations: Update Rails and libvips to the latest patched versions immediately.; Rotate the ‘secret_key_base’ and all associated database and cloud credentials.; Set the VIPS_BLOCK_UNTRUSTED environment variable to mitigate risk on supported systems.
Source: Bleeping Computer
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source
Latest Developments
Update — 2026-08-02 14:37 UTC
Discovery of a critical RCE vulnerability (CVE-2026-66066) in Ruby on Rails. Potential full server compromise and unauthorized code execution across an estimated 500,000 websites. The KindaRails2Shell vulnerability (CVE-2026-66066) leverages a flaw in the Ruby on Rails image processing component. Attackers can trigger remote code execution simply by uploading a malicious image file, such as a profile photo. Because the fix requires updating both the framework and a separate third-party library, many systems may remain exposed despite initial patching.
Corroborating source: cybersecurity-insiders.com