KINDARAILS2SHELL: CVE-2026-66066, CRITICAL ARBITRARY FILE READ AND POSSIBLE REMOTE CODE EXECUTION IN RUBY ON RAILS

Summary from the TLDR InfoSec newsletter

CVE-2026-66066 (CVSSv4 9.5) lets an unauthenticated attacker abuse unfuzzed libvips operations during Active Storage image processing to read files accessible to the Rails process, potentially exposing secrets that enable RCE. Only the default Vips variant processor is affected, not Magick. Fixed in Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1 alongside libvips 8.13+ and ruby-vips 2.2.1+, with no in-the-wild exploitation reported as of July 30. Rapid7 urges rotating secret_key_base and other exposed credentials, patching outside normal cycles, and applying Vips.block_untrusted(true) as an interim workaround where upgrading isn't immediately possible.