Vulnerability Overview
Exploitation Activity
Exploitation Intelligence
On July 29, 2026, the Ruby on Rails security team published CVE-2026-66066, a critical arbitrary file read and remote code execution (RCE) vulnerability in Active Storage. Discovered by the Ethiack research team, this flaw affects default configurations of Rails 6.x, 7.x, and 8.x that utilize the vi...
Threat actors are actively exploiting CVE-2026-66066, a critical Ruby on Rails vulnerability known as KindaRails2Shell, which allows unauthenticated attackers to read arbitrary files from servers, potentially leading to remote code execution (RCE). Disclosed on July 30, 2026, this flaw affects numer...
A critical vulnerability in Ruby on Rails (tracked as GHSA-f3w6-w445-fwh9) was disclosed, allowing unauthenticated attackers to write arbitrary files on servers using ImageMagick for file uploads. This flaw affects versions 8.0.5.2 and 8.1.4.1, which were released on November 4, 2026, to patch the i...
