{"uuid": "07308c1c-92a1-4708-95f6-cb508859d2dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://t.me/pphm_HackerNews/2944", "content": "\ud83d\udd34 Critical Ruby on Rails Vulnerability in Attackers\u2019 Crosshairs\n\nHackers are exploiting a critical-severity Ruby on Rails vulnerability that leads to remote code execution (RCE), VulnCheck warns.\n\nTracked as CVE-2026-66066 (CVSS score of 9.5) and referred to as KindaRails2Shell, the flaw is described as an arbitrary file read leading to secret exposure, RCE, and lateral movement.\n\nThe security defect was disclosed in late July, when Ruby on Rails rolled out patches for it, urging the immediate patching of all Rails applications that rely on libvips for Active Storage image processing and allow image uploads from untrusted users.", "creation_timestamp": "2026-08-31T22:00:05.003030Z"}