VulnSocial

CVE-2026-66066Disclosure

CRITICALCVSS 9.5 · CRITICAL

Exploitation observed; activity peaked at 54 mentions and remains active

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

Back to dashboard
9.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-1188

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

  • Active exploitation appears in 31 classified signals
  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 225 mentions across 28 observed days

What's happening

  • Active exploitation reported across 31 signals
  • Exploit tool or code specified in 25 signals
  • PoC mentioned or linked in 52 signals
  • Patch or workaround mentioned in 100 signals
  • Technical details provided in 154 signals
  • Disclosure: 66 classified signals
  • General: 40 classified signals
  • Peaked 26d ago at 54 mentions (2026-07-30); latest day: 1
  • 225 total mentions across 28 days

Deep dive

Activity timeline225 mentions / 28d
014274154Mentions · 2026-07-29: 30Mentions · 2026-07-30: 54Mentions · 2026-07-31: 25Mentions · 2026-08-01: 21Mentions · 2026-08-02: 8Mentions · 2026-08-03: 24Mentions · 2026-08-04: 11Mentions · 2026-08-05: 2Mentions · 2026-08-06: 2Mentions · 2026-08-07: 3Mentions · 2026-08-08: 4Mentions · 2026-08-09: 1Mentions · 2026-08-10: 3Mentions · 2026-08-11: 2Mentions · 2026-08-12: 2Mentions · 2026-08-13: 1Mentions · 2026-08-28: 1Mentions · 2026-08-31: 4Mentions · 2026-09-01: 10Mentions · 2026-09-02: 2Mentions · 2026-09-03: 3Mentions · 2026-09-04: 5Mentions · 2026-09-05: 1Mentions · 2026-09-09: 1Mentions · 2026-09-23: 1Mentions · 2026-09-28: 1Mentions · 2026-10-07: 2Mentions · 2026-10-14: 1PoC Mentioned / Linked · 2026-07-29: 6PoC Mentioned / Linked · 2026-07-30: 12PoC Mentioned / Linked · 2026-07-31: 7PoC Mentioned / Linked · 2026-08-01: 3PoC Mentioned / Linked · 2026-08-02: 2PoC Mentioned / Linked · 2026-08-03: 3PoC Mentioned / Linked · 2026-08-04: 8PoC Mentioned / Linked · 2026-08-05: 1PoC Mentioned / Linked · 2026-08-06: 1PoC Mentioned / Linked · 2026-08-08: 2PoC Mentioned / Linked · 2026-08-10: 1PoC Mentioned / Linked · 2026-08-28: 1PoC Mentioned / Linked · 2026-09-03: 1PoC Mentioned / Linked · 2026-09-04: 3PoC Mentioned / Linked · 2026-09-05: 1Exploit Tool / Code · 2026-07-29: 1Exploit Tool / Code · 2026-07-30: 8Exploit Tool / Code · 2026-07-31: 4Exploit Tool / Code · 2026-08-01: 1Exploit Tool / Code · 2026-08-03: 2Exploit Tool / Code · 2026-08-04: 2Exploit Tool / Code · 2026-08-06: 1Exploit Tool / Code · 2026-08-08: 1Exploit Tool / Code · 2026-08-10: 1Exploit Tool / Code · 2026-08-12: 1Exploit Tool / Code · 2026-09-04: 1Exploit Tool / Code · 2026-09-05: 1Exploit Tool / Code · 2026-10-07: 1Active Exploitation · 2026-07-30: 1Active Exploitation · 2026-08-01: 2Active Exploitation · 2026-08-04: 2Active Exploitation · 2026-08-08: 1Active Exploitation · 2026-08-31: 3Active Exploitation · 2026-09-01: 9Active Exploitation · 2026-09-02: 2Active Exploitation · 2026-09-03: 2Active Exploitation · 2026-09-04: 5Active Exploitation · 2026-09-05: 1Active Exploitation · 2026-09-09: 1Active Exploitation · 2026-10-07: 2Patch / Workaround · 2026-07-29: 15Patch / Workaround · 2026-07-30: 14Patch / Workaround · 2026-07-31: 7Patch / Workaround · 2026-08-01: 12Patch / Workaround · 2026-08-02: 6Patch / Workaround · 2026-08-03: 10Patch / Workaround · 2026-08-04: 5Patch / Workaround · 2026-08-05: 1Patch / Workaround · 2026-08-06: 2Patch / Workaround · 2026-08-07: 2Patch / Workaround · 2026-08-08: 2Patch / Workaround · 2026-08-10: 1Patch / Workaround · 2026-08-11: 1Patch / Workaround · 2026-08-12: 1Patch / Workaround · 2026-08-31: 3Patch / Workaround · 2026-09-01: 7Patch / Workaround · 2026-09-02: 1Patch / Workaround · 2026-09-03: 2Patch / Workaround · 2026-09-04: 5Patch / Workaround · 2026-09-05: 1Patch / Workaround · 2026-09-09: 1Patch / Workaround · 2026-09-23: 1Technical Details · 2026-07-29: 19Technical Details · 2026-07-30: 38Technical Details · 2026-07-31: 15Technical Details · 2026-08-01: 14Technical Details · 2026-08-02: 7Technical Details · 2026-08-03: 11Technical Details · 2026-08-04: 10Technical Details · 2026-08-05: 2Technical Details · 2026-08-06: 2Technical Details · 2026-08-07: 3Technical Details · 2026-08-08: 3Technical Details · 2026-08-09: 1Technical Details · 2026-08-10: 3Technical Details · 2026-08-11: 2Technical Details · 2026-08-12: 1Technical Details · 2026-08-28: 1Technical Details · 2026-08-31: 4Technical Details · 2026-09-01: 7Technical Details · 2026-09-02: 1Technical Details · 2026-09-03: 2Technical Details · 2026-09-04: 5Technical Details · 2026-09-05: 1Technical Details · 2026-09-09: 1Technical Details · 2026-09-23: 107-2907-3108-0208-0408-0608-0808-1008-1208-2809-0109-0309-0509-2310-0710-14
Signal classification6 categories
Disclosure
6629.3%
Patch
5524.4%
General
4017.8%
Active Exploitation
3113.8%
PoC
2611.6%
Exploit
73.1%
Referenced assets121 URLs
By indicator
Classification over time
DateTotalLabels
2026-07-2930
Disclosure10General8Patch11PoC1
2026-07-3054
Active Exploitation1Disclosure23Exploit2General9Patch11PoC8
2026-07-3125
Disclosure6Exploit1General10Patch3PoC5
2026-08-0121
Active Exploitation2Disclosure5Exploit1General3Patch8PoC2
2026-08-028
Disclosure1Patch5PoC2
2026-08-0324
Disclosure7Exploit2General6Patch8PoC1
2026-08-0411
Active Exploitation2Disclosure5PoC4
2026-08-052
Patch1PoC1
2026-08-062
Patch2
2026-08-073
Disclosure2Patch1
2026-08-084
Active Exploitation1Disclosure1Patch1PoC1
2026-08-091
Disclosure1
2026-08-103
Disclosure2PoC1
2026-08-112
Disclosure1Patch1
2026-08-122
Exploit1Patch1
2026-08-131
General1
2026-08-281
Disclosure1
2026-08-314
Active Exploitation3Patch1
2026-09-0110
Active Exploitation9General1
2026-09-022
Active Exploitation2
2026-09-033
Active Exploitation2Disclosure1
2026-09-045
Active Exploitation5
2026-09-051
Active Exploitation1
2026-09-091
Active Exploitation1
2026-09-231
Patch1
2026-09-281
General1
2026-10-072
Active Exploitation2
2026-10-141
General1
Full discourse20 posts
  • André Baptista@0xacb
    Disclosure

    🚨We reported KindaRails2Shell, a critical RCE in Ruby on Rails via Active Storage. It’s not a one-shot RCE, but the preconditions are kinda common under default configurations. Patch your applications now! https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066

    Post summary

    A new critical Ruby on Rails RCE, KindaRails2Shell (CVE‑2026‑66066), has been reported with a link to detailed research, urging immediate patching—no exploit code or active attacks are mentioned.

    13991039019390.1K
    20.1K followersView on X
  • DHH@dhh
    General

    There's now an agent skill set available for dealing with this CVE. Helps you determine whether you were ever exposed to this issue, and making sure you're properly patched. Great use of AI! https://github.com/rails/rails-forensics-CVE-2026-66066

    Post summary

    A GitHub repository offering a forensic tool to detect exposure to CVE‑2026‑66066 is mentioned, but the post lacks technical, exploit, or patch details.

    1517436316092.6K
    915.9K followersView on X
  • Ruby on Rails@rails
    Patch

    We released new security versions of Rails to address a critical security bug in Active Storage. Please upgrade your applications. See the advisory for more information https://discuss.rubyonrails.org/t/cve-2026-66066-possible-arbitrary-file-read-and-remote-code-execution-in-active-storage-variant-processing/91432

    Post summary

    Rails has released updated versions that fix CVE‑2026‑66066, advising users to upgrade to address the arbitrary file read and remote code execution vulnerability.

    4641323766181.6K
    137.1K followersView on X
  • Ruby on Rails@rails
    General

    We made public the details of the attack for the security vulnerabilities patched yesterday. We also make some tools to help with the forensic investigation. Take a look in this post in our forum https://discuss.rubyonrails.org/t/cve-2026-66066-attack-details-and-tools-to-perform-a-forensic-investigation/91441

    Post summary

    The post announces that the attack details for the CVE have been made public and that forensic tools are available, but it lacks concrete evidence of a PoC, exploit code, active exploitation, or specific patch information.

    64011725215.7K
    137.2K followersView on X
  • H4x0r.DZ 🇰🇵@h4x0r_dz
    PoC

    https://github.com/Zer0SumGam3/CVE-2026-66066-POC

    Post summary

    A GitHub repository is linked that hosts a Proof of Concept for CVE-2026-66066, yet there is no evidence of active exploitation, patch availability, or technical details in the supplied text.

    12501586114.1K
    83.5K followersView on X
  • YONEUCHI, Takashi | GMO Flatt Security@lmt_swallow
    Disclosure

    🚨【重要】Ruby on Rails のリモートコード実行脆弱性（RCE）が公開されています！CVE-2026-66066、通称 KindaRails2Shell です。 外部露出している Rails 製システム、結構数あるはず。かつ比較的広いバージョンが影響範囲内です。WordPress の wp2shell に続き、すぐ確認＆バージョン更新ください。

    Post summary

    The post announces a public Ruby on Rails RCE vulnerability (CVE‑2026‑66066) and urges users to update their systems.

    23501051920.4K
    6.0K followersView on X
  • Takuto Wada@t_wada
    General

    朝4時に起きてやっていたのは CVE-2026-66066 対応 🙄 https://t.co/noHCismPqY

    Post summary

    The tweet indicates the user was addressing CVE-2026-66066, but offers no additional technical details, exploitation status, or mitigation information.

    11711122319.5K
    68.3K followersView on X
  • The Hacker News@TheHackersNews
    Patch

    ‼️ WARNING -- Critical Rails flaw CVE-2026-66066 could let unauthenticated attackers read server files through crafted image uploads. The bug affects apps using Active Storage with Vips. Stolen Rails keys, database credentials, cloud keys, and API tokens could enable RCE. Patch now. Read the full story - https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html

    Post summary

    The post highlights a critical CVE-2026-66066 vulnerability in Rails Active Storage that allows unauthenticated file read and potential RCE, and urges users to apply the available patch.

    22111101843.8K
    2.4M followersView on X
  • mike dalessio@flavorjones
    General

    The Rails security team published attack details and -- more importantly -- tools and agent skills to run a forensic investigation to help you determine if you were exploited. Be careful out there. https://discuss.rubyonrails.org/t/cve-2026-66066-attack-details-and-tools-to-perform-a-forensic-investigation/91441

    Post summary

    The statement refers to CVE-2026-66066 and mentions attack details and forensic tools, but lacks concrete PoC, exploit code, patch info, or in‑the‑wild activity.

    2102725119.2K
    4.3K followersView on X
  • Bipin Jitiya@win3zz
    PoC

    CVE-2026-66066 https://gist.github.com/win3zz/ae02cb1c3be0b79f69b609f559e1f179

    Post summary

    The post shares a GitHub Gist, presumably containing a proof‑of‑concept for CVE‑2026‑66066, with no additional details about exploitation, patching, or impact.

    071722216.2K
    7.9K followersView on X
  • Stephen Fewer@stephenfewer
    Exploit

    Metasploit coverage for the new Ruby on Rails Active Storage via libvips RCE (CVE-2026-66066) from @_CryptoCat 🎯 https://github.com/rapid7/metasploit-framework/pull/21733 #KindaRails2MeterpreterSession4Realz

    Post summary

    Metasploit has added coverage for CVE-2026-66066, a RCE bug in Ruby on Rails’ Active Storage via libvips, with the module available in the referenced pull request, indicating a ready‑to‑use exploit.

    017262145.9K
    10.0K followersView on X
  • Kirill Firsov@k_firsov
    General

    This is huge. We already reproduced it. I like the CVE number CVE-2026-66066, a helluva bug!

    Post summary

    The text merely references CVE-2026-66066 with no additional context, technical details, or evidence of exploitation.

    330562610.6K
    6.4K followersView on X
  • Yusuke Nakajima@nakajimeeee
    PoC

    本物か未検証だけど、POC公開されてる https://github.com/Zer0SumGam3/CVE-2026-66066-POC

    Post summary

    A PoC for CVE-2026-66066 has been published, though its validity remains unverified.

    06049209.5K
    3.1K followersView on X
  • ThreatWire@ThreatWire_
    Disclosure

    🚨 CVE-2026-66066: A critical Ruby on Rails flaw lets unauthenticated attackers read server files via crafted image uploads. Apps using Active Storage with Vips are affected. Stolen Rails keys, DB credentials, cloud keys, and API tokens could lead to RCE. #RubyOnRails #RCE #CVE https://t.co/ijTY158jH5

    Post summary

    The tweet announces a critical Ruby on Rails vulnerability (CVE‑2026‑66066) that lets unauthenticated attackers read arbitrary server files through crafted image uploads, potentially leading to remote code execution.

    01413753.5K
    1.5K followersView on X
  • 7h3h4ckv157@7h3h4ckv157
    Disclosure

    KindaRails2Shell - Critical RCE in Rails via Active Storage (CVE-2026-66066) By: André Baptista Resource: https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066 https://t.co/rACOSNEnkT

    Post summary

    The post discloses a critical remote‑code‑execution flaw in Rails’ Active Storage (CVE‑2026‑66066) and provides a research link, but does not mention active exploitation, patches, or a functional exploit.

    19034122.9K
    56.9K followersView on X
  • Nicolas Krassas@Dinosn
    General

    Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066) https://www.rapid7.com/blog/post/ra-kindarails2shell-technical-analysis-cve-2026-66066

    Post summary

    Short description pointing to a Rapid7 blog post about CVE-2026-66066, with no explicit details or indicators of exploitation, mitigation, or PoC.

    110029145.4K
    162.1K followersView on X
  • Clandestine@akaclandestine
    PoC

    GitHub - Zer0SumGam3/CVE-2026-66066-POC: PoC for CVE-2026-66066 in Ruby on Rails · GitHub https://github.com/Zer0SumGam3/CVE-2026-66066-POC

    Post summary

    The content references a GitHub repository containing a Proof of Concept for CVE‑2026‑66066 in Ruby on Rails, indicating the vulnerability has been demonstrated, but it provides no evidence of active exploitation or a patch.

    07032124.0K
    64.8K followersView on X
  • JPCERTコーディネーションセンター@jpcert
    General

    Ruby on RailsのActive Storageにおけるリモートコード実行につながる脆弱性（CVE-2026-66066）に関する注意喚起を更新。開発者がフォレンジック調査用のツールとガイドを公開しました。本脆弱性を悪用する攻撃の侵害調査に本ツールを活用してください。^MH https://www.jpcert.or.jp/at/2026/at260021.html

    Post summary

    The notice updates about CVE‑2026‑66066, identifies it as an RCE vulnerability, and offers forensic tools and guides to investigate incidents, but does not mention patches, active exploitation, or PoC details.

    01612195.5K
    34.4K followersView on X
  • elhacker.NET@elhackernet
    Disclosure

    Fallo crítico en Rails permite leer archivos y ejecutar código remotamente Se ha detectado una vulnerabilidad crítica de seguridad en Ruby on Rails Active Storage (CVE-2026-66066) https://blog.elhacker.net/2026/07/fallo-critico-en-rails-permite-leer.html

    Post summary

    A critical vulnerability (CVE-2026-66066) in Ruby on Rails Active Storage that permits reading files and remote code execution has been identified and reported.

    0902864.7K
    142.0K followersView on X
  • JPCERTコーディネーションセンター@jpcert
    Exploit

    Ruby on RailsのActive Storageにおけるリモートコード実行につながる脆弱性（CVE-2026-66066）に関する注意喚起を公開。本脆弱性に関するエクスプロイトコードが公開されていることを確認しています。対象製品を利用している場合、対策や軽減策などを実施してください。^MH https://www.jpcert.or.jp/at/2026/at260021.html

    Post summary

    JPCERT alerts that CVE-2026-66066 allows remote code execution via Active Storage and that exploit code has been published, urging users to apply mitigations.

    21212015.3K
    34.3K followersView on X

Explore more

Back to dashboard