Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs

Hackers are exploiting a critical-severity Ruby on Rails vulnerability that leads to remote code execution (RCE), VulnCheck warns.

Tracked as CVE-2026-66066 (CVSS score of 9.5) and referred to as KindaRails2Shell , the flaw is described as an arbitrary file read leading to secret exposure, RCE, and lateral movement.

The security defect was disclosed in late July, when Ruby on Rails rolled out patches for it, urging the immediate patching of all Rails applications that rely on libvips for Active Storage image processing and allow image uploads from untrusted users.

Shortly after, security researchers reverse-engineered the bug and released technical information and proof-of-concept (PoC) code targeting it, and Rails published forensic tools to help detect exploitation attempts.

Rails explained that KindaRails2Shell was rooted in the different methods used by different libraries and functions to read arbitrary files.

While Rails may rely on the client-supplied content type to interpret a blob as an image, libvips looks at the magic bytes to determine the file type.

This allows an attacker to craft a file and declare it as MATLAB Level 5, leading to libvips selecting the MATLAB loader. The file is then routed to libmatio, which identifies MAT 7.3 in a header field and hands it to HDF5.

“HDF5’s External File List lets a dataset’s bytes live in another file named by path and offset, so rendering the ‘image’ reads an attacker-chosen file off the server and returns its contents as pixels. The same confusion, twice, at two layers that cannot see each other’s fields,” Rails notes.

An unauthenticated attacker could target anything that the Rails process can read, including the credential database and storage keys. Armed with the compromised secrets, the attacker could then forge sessions, access additional systems, and execute arbitrary code remotely.

According to VulnCheck, threat actors started exploiting CVE-2026-66066 last week, roughly one month after patches were released.

Furthermore, VulnCheck says that its tests on a patched 8.1.3.1 server revealed that, “while the fix blocks the libvips file read, it does not neutralize the variation-key Marshal deserialization: the RCE gadget still executes on a patched server given a valid signature.”

In early August, VulnCheck identified around 7,000 exposed Ruby on Rails instances vulnerable to KindaRails2Shell.

Related: More Details Emerge on Exploited PaperCut Vulnerabilities

Related: OpenAI Agents Exploited Linux Kernel Flaw on Company’s Own Systems

Related: Recent Citrix NetScaler Vulnerability Exploited in the Wild

Related: Adobe and Nvidia Patch Dozens of Vulnerabilities

Ionut Arghire is an international correspondent for SecurityWeek.

More from Ionut Arghire

Berlin Won’t Pay Extortion Group Claiming Data Theft

Critical Isolated-vm Vulnerability Leads to RCE on Host

Rust Supply Chain Attack Linked to North Korean Hackers

Microsoft Patches Exploited Entra ID Vulnerability

CISA Urges Immediate Patching of Exploited TrueConf Vulnerabilities

Threat Actor Hacks 14,000 IP Cameras in Ukraine and Russia

Atlassian, Splunk Patch Dozens of Critical, High-Severity Vulnerabilities

MLflow Vulnerability Exploited for Cloud Credential Theft

Nightmare Eclipse Drops ‘HardBreacher’ Kaspersky Product Exploit

ServiceNow Patches 3 Critical Code Injection Vulnerabilities

McKesson Confirms Data Breach as Attacker Deadline Looms

What the Hugging Face Incident Teaches Security Leaders AI Agent Access

Anthropic Warns Claude Users of Infostealer Malware Infections

Boston Scientific Still Recovering From Cyberattack

Extortion Group Claims Manchester Airports Group Data Breach

Judge Says Pentagon’s Measures Against Anthropic Were ‘Illegal and Baseless’

Flipboard Whatsapp Whatsapp Email