The Ruby on Rails core team shipped a coordinated triple release on July 29, 2026 — versions 7.2.3.2, 8.0.5.1 and 8.1.3.1 — to fix CVE-2026-66066, a critical Active Storage flaw that lets an unauthenticated attacker read arbitrary files from a Rails application and, under realistic conditions, escalate to remote code execution.
libvips is the attack surface
Active Storage generates thumbnails for uploaded images by handing them to a processing library. When that library is libvips, which is the default in the official Rails Docker images as well as most Debian and Ubuntu setups, an attacker who can upload an image to an internet-facing Rails app can craft a payload that reads files off the server, including the Rails process environment. That means secret_key_base, database credentials, cloud storage keys and any other secrets the process has access to are all in scope. ImageMagick users are not affected. CVE-2026-66066 carries a critical CVSS rating from the Rails maintainers.
KindaRails2Shell and full RCE
Akamai researchers, who recently helped rein in Oracle E-Business Suite exploitation, have dubbed the attack chain KindaRails2Shell and warn that once secret_key_base is compromised, attackers can forge session cookies, sign Global IDs and manipulate serialized data straight into RCE. The flaw was reported to Rails by researchers from Portuguese autonomous ethical-hacking firm Ethiack and GMO Flatt Security. The team originally planned to hold technical details until August 28, but published the full write-up and forensic tooling early after public proof-of-concept exploits appeared.
What defenders need to do this week
Rails 6.x is only affected when Active Storage has been configured outside its defaults, but all other supported branches should upgrade immediately. Maintainers recommend moving to libvips 8.13 or newer and rotating secret_key_base, database passwords, Active Storage credentials and any other secrets the app process could touch. Systems already on libvips 8.13+ can buy time with the VIPS_BLOCK_UNTRUSTED environment variable or a Vips.block_untrusted(true) call. Akamai has released WAF signatures, but Ethiack cautions that attackers using AI tooling should be able to reconstruct the payload straight from the patch diff, joining JetBrains TeamCity and Broadcom VMware as one of the summer's must-patch enterprise flaws.
Reporting based on coverage from BleepingComputer, Rapid7 and Akamai.