#ActiveStorage
LightNews LightNews
stackflag.bsky.social
CVE-2026-122006 - active storage
The ActiveStorage component in Ruby on Rails versions before 8.1.4.1 runs ImageMagick when a file is attached. Because ImageMagick has no restrictive policy, an…

Too many irrelevant or confusing CVEs? Use stackflag.com

#activestorage #rubyonrails #CVE #infosec
CVE-2026-122006: Rails ActiveStorage lets attackers read secret key via ImageMagick
The ActiveStorage component in Ruby on Rails versions before 8.1.4.1 runs ImageMagick when a file is attached.
stackflag.com
November 4, 2026 at 3:20 PM
thedailytechfeed.com
Severe Rails flaw via ImageMagick lets attackers write server files—patch now. #Rails #ImageMagick #Security #WebSecurity #ActiveStorage #Vulnerability https://thedailytechfeed.com/critical-rails-vulnerability-lets-attackers-write-server-files/
November 4, 2026 at 12:22 PM
thedailytechfeed.com
Rails Active Storage flaw via MiniMagick image uploads can leak secrets—patch ASAP. #RubyOnRails #ActiveStorage #ImageMagick #Cybersecurity #ZeroDay #WebSecurity https://thedailytechfeed.com/critical-rails-flaw-lets-attackers-steal-secrets-via-image-uploads/
November 4, 2026 at 5:05 PM
patchthecve.bsky.social
CVE-2026-122006 CRITICAL (CVSS 9.8)
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can all
Fix: https://patchthecve.com/cve/CVE-2026-122006.html
November 4, 2026 at 2:40 PM
stemshop.bsky.social
🚨 CVE-2026-122006 — CVSS 9.8 CRITICAL

The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can ...

🔎 https://stemshop.top/cve/CVE-2026-122006

#CVE #CyberSecurity #InfoSec
November 4, 2026 at 4:07 PM
chuiho.net
［注意］Rails Active Storage に重大な欠陥　画像のアップロードでファイルを書き込まれうる
Ruby on Rails の activestorage で、ImageMagick（mini_magick）で画像を扱うアプリが、ログインなしのアップロードでサーバーにファイルを書き込まれうる。CVSS 9.8。8.1.4.1・8.0.5.2 で修正。
https://chuiho.net/posts/rails-active-storage-imagemagick-file-write/ #RubyonRails #ActiveStorage
Rails Active Storage に重大な欠陥　画像のアップロードでファイルを書き込まれうる
Ruby on Rails の activestorage で、ImageMagick（mini_magick）で画像を扱うアプリが、ログインなしのアップロードでサーバーにファイルを書き込まれうる。CVSS 9.8。8.1.4.1・8.0.5.2 で修正。
chuiho.net
November 4, 2026 at 3:32 PM
thehackerwire.bsky.social
🔴 CVE-2026-122006 - Critical (9.8)

The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing oc...

https://www.thehackerwire.com/vulnerability/CVE-2026-122006/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack
CVE-2026-122006 - Critical
November 4, 2026 at 3:33 PM
euvd-bot.bsky.social
🚨 EUVD-2026-116914
📊 9.8/10
🏢 rubyonrails

📝 The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116914

#cybersecurity #infosec #cve #euvd
November 4, 2026 at 3:02 PM
gazewires.bsky.social
🔐 Critical Rails Active Storage Flaw Enables Arbitrary Server File Writes

A newly disclosed vulnerability in Ruby on Rails' Active Storage permits an attacker to upload a crafted image and cause the server to…

🔗 Read the full story on GazeWire

#Cybersecurity #ActiveStorage #Imagemagick #GazeWire
🔐 Critical Rails Active Storage Flaw Enables Arbitrary Server File Writes
A newly disclosed vulnerability in Ruby on Rails' Active Storage permits an attacker to upload a crafted image and cause the server to…
gazewire.com
November 4, 2026 at 8:20 PM
securityonline.bsky.social
Rails security update 8.0.5.2 and 8.1.4.1 fixes 21 flaws, including a critical Active Storage file write bug (CVSS 9.8). Rails 8.0 support ends Nov 7.

#RubyOnRails #Rails #ActiveStorage #ImageMagick #RCE #WebSecurity #PatchNow #Vulnerability
Rails 8.0.5.2 and 8.1.4.1 Fix 21 Security Flaws, Including Critical Active Storage File Write Bug
TL;DR The Ruby on Rails team released versions 8.0.5.2 and 8.1.4.1 on November 4, 2026, fixing 21 security issues. This Rails security update covers file read, file write and possible remote code execution in Active Storage. It also fixes a Strong Parameters bypass, IP spoofing, several XSS bugs and multiple denial-of-service flaws. The worst bug is rated critical at CVSS 9.8.
securityonline.info
November 4, 2026 at 9:30 AM
davekimura.bsky.social
Episode #585 - Email Attachment

#ruby #rubyonrails #programming #code

www.driftingruby.com/episodes/ema...
Episode 585 - Email Attachment | Drifting Ruby
In this episode, we'll look at the difference between linking and attaching images to an email from an ActiveStorage attribute.
www.driftingruby.com
October 19, 2026 at 12:20 AM
julianrubisch.at
Here's the post, with a Rails helper for ActiveStorage at the end:

audioproxy.dev/blog/wavefor...
Waveform data for peaks.js and wavesurfer, without a second pipeline
Feeding peaks.js and wavesurfer from a URL instead of a stored .dat file: one cached format, drawn from the processed audio your listeners hear.
audioproxy.dev
October 19, 2026 at 2:31 PM
five-oclick-tech.bsky.social
Rails RCE patched, exploits were fast

A severe RCE in Rails 8+ ActiveStorage was patched July 29, 2026, but a government site was hit hours after patching.
Rails RCE patched, exploits were fast
September 6, 2026 at 7:03 PM
levelbrook.bsky.social
CVE-2026-66066 is being probed in the wild. Active Storage + libvips, CVSS 9.5, arbitrary file read.

Triage:
• bundle list | grep -E "activestorage|ruby-vips"
• patched: 7.2.3.2 / 8.0.5.1 / 8.1.3.1
• can’t deploy today? Vips.block_untrusted(true) in an initializer

#RubyOnRails #Rails
September 6, 2026 at 3:47 PM
levelbrook.bsky.social
Three checks that prove you closed CVE-2026-66066, not just bumped the gem:

vips --version -> needs 8.13+
bundle list | grep activestorage
bin/rails runner 'puts :ok'

The third matters. Patched Active Storage refuses to boot on old libvips rather than run unsecurable.

#RubyOnRails #Rails
September 6, 2026 at 3:54 PM
cyberveille-ch.bsky.social
📢 CVE-2026-66066 : exploitation d'une RCE ActiveStorage (Rails) quelques heures après le patch

Cet article est un post-mortem détaillé d'un incident de sécurité impliquant la CVE-2026-66066 (alias KindaRails2Shell), une…

🟡 vérification factuelle moyenne
#ActiveStorage #RCE #Cyberveille
CVE-2026-66066 : exploitation d'une RCE ActiveStorage (Rails) quelques heures après le patch
Cet article est un post-mortem détaillé d'un incident de sécurité impliquant la CVE-2026-66066 (alias KindaRails2Shell), une vulnérabilité de type exécution de code à distance (RCE) avec un score CVSS 9.5/10 affectant le composant ActiveStorage de Ruby on Rails 8 et versions ultérieures. 21 juillet 2026 : Découverte initiale par des chercheurs légitimes (Ethiack, dont André Baptista alias 0xacb).
cyberveille.ch
September 5, 2026 at 1:00 PM
hn-frontpage-bot.bsky.social
Rietta successfully mitigated a critical Ruby on Rails ActiveStorage vulnerability (CVE-2026-66066) by deploying emergency patches before exploitation attempts began. Their experience highlights that public code fixes often trigger rapid attacks, rendering embargoed disclosures ineffective.
Government Rails Site Hit Hours After CVE Patch (102)
Rietta patched a government client running a Ruby on Rails website within hours of a 9.5 CVSS ActiveStorage CVE. Exploit attempts began before business hours resumed.
news.ycombinator.com
September 5, 2026 at 1:29 PM
hn100.atproto.rocks
Government Rails Site Hit Hours After CVE Patch
https://rietta.com/blog/ruby-on-rails-cve-exploited-hours-after-patch/

https://news.ycombinator.com/item?id=49568828
Government Rails Site Hit Hours After CVE Patch
Rietta patched a government client running a Ruby on Rails website within hours of a 9.5 CVSS ActiveStorage CVE. Exploit attempts began before business hours resumed.
rietta.com
September 5, 2026 at 12:45 PM
tiff.bunny.blue.ap.brid.gy
huh maybe mastodon's delayed migration from paperclip to activestorage saved us from CVE-2026-66066
September 4, 2026 at 9:04 PM
hnfeed.bsky.social
Government Rails Site Hit Hours After CVE Patch
https://rietta.com/blog/ruby-on-rails-cve-exploited-hours-after-patch/
[comments] [77 points]
Government Rails Site Hit Hours After CVE Patch
Rietta patched a government client running a Ruby on Rails website within hours of a 9.5 CVSS ActiveStorage CVE. Exploit attempts began before business hours resumed.
rietta.com
September 5, 2026 at 3:03 AM
hackernewsbot.bsky.social
Government Rails Site Hit Hours After CVE Patch | Discussion
Government Rails Site Hit Hours After CVE Patch
Rietta patched a government client running a Ruby on Rails website within hours of a 9.5 CVSS ActiveStorage CVE. Exploit attempts began before business hours resumed.
rietta.com
September 4, 2026 at 8:00 PM
kriptabiz.bsky.social
Уязвимость ActiveStorage в Ruby on Rails: Как государственный сайт подвергся атаке через несколько часов после патча

https://kripta.biz/posts/529A41AE-B232-41B4-80D3-3DDDB2E11E8E
September 4, 2026 at 7:33 PM
fastruby.io
Bumping activestorage to 8.1.3.1 does not fix CVE-2026-66066 by itself. The fix needs libvips 8.13+, and rebuilding on a Debian bullseye base quietly reinstalls 8.10.5 every time. go.fastruby.io/vdx #RailsSecurity
August 24, 2026 at 3:02 PM
fastruby.io
bundler-audit will not catch this one. CVE-2026-66066 needs a patched activestorage AND libvips 8.13 or newer. Gem-level scanning stops at the Gemfile.
go.fastruby.io/56m
August 17, 2026 at 3:02 PM
stackflag.bsky.social
CVE-2026-66066 - activestorage
A vulnerability in Active Storage can allow an attacker to read sensitive files and potentially run malicious code on your server. This is possible if your application uses…

Too many irrelevant or confusing CVEs? Use stackflag.com

#activestorage #Ruby #CVE #infosec
CVE-2026-66066: Active Storage can leak sensitive files and run malicious code
A vulnerability in Active Storage can allow an attacker to read sensitive files and potentially run malicious code on your server.
stackflag.com
July 30, 2026 at 7:04 PM