Critical Ruby on Rails Vulnerability Exploited in the Wild, Putting Thousands at Risk
A severe vulnerability in the popular web framework Ruby on Rails is being actively exploited by hackers, putting thousands of websites and applications at risk. The flaw, tracked as CVE-2026-66066 (CVSS score 9.5), allows attackers to execute arbitrary code on affected servers, steal sensitive data, and even move laterally across networks.
The vulnerability, dubbed KindaRails2Shell, was first disclosed in late July when Ruby on Rails released patches for it. However, security researchers quickly reverse-engineered the bug and released technical information and proof-of-concept (PoC) code targeting it. This has allowed attackers to craft exploits that can bypass even patched systems.
The vulnerability stems from a combination of factors, including the way different libraries and functions handle file reads in Ruby on Rails applications. Specifically, when an attacker crafts a malicious file with specific magic bytes, they can trick the libvips library into selecting the MATLAB loader, which then hands off the file to HDF5. This allows attackers to read arbitrary files from the server, including sensitive data like credential databases and storage keys.
The impact of this vulnerability is significant. An unauthenticated attacker could exploit it to forge sessions, access additional systems, and execute arbitrary code remotely. In fact, VulnCheck has reported that threat actors started exploiting CVE-2026-66066 just last week, roughly one month after patches were released. Furthermore, VulnCheck’s tests on a patched server revealed that the fix does not neutralize the RCE gadget, making it still possible for attackers to execute code even on patched systems.
The scale of the problem is substantial, with around 7,000 exposed Ruby on Rails instances vulnerable to KindaRails2Shell identified by VulnCheck. These instances are scattered across various industries and geographies, highlighting the need for urgent action to patch affected systems.
The fact that this vulnerability has been exploited in the wild so soon after patches were released is a stark reminder of the importance of timely patching and vigilance in the face of emerging threats. As we’ve seen time and again, even with patches available, attackers can still find ways to exploit vulnerabilities if they’re not taken seriously.
So what can you do? If you’re running a Ruby on Rails application that relies on libvips for Active Storage image processing and allows image uploads from untrusted users, it’s essential to apply the latest patches as soon as possible. Additionally, consider implementing additional security measures, such as monitoring for suspicious activity and conducting regular vulnerability scans. By taking proactive steps, you can minimize your exposure to this critical vulnerability and protect your assets from potential harm.
Source: SecurityWeek — 2026-08-31