Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Rails maintainers security patch release for CVE-2026-66066

Security Patch Release
First reported
Last updated
Happening score
H score 40
1 unique sources, 1 articles

Summary

Hide ▲

Rails published an advisory and version guidance for CVE-2026-66066, a critical Active Storage flaw affecting specific release lines and requiring upgrades. The patch scope covers Active Storage before 7.2.3.2, 8.0.x before 8.0.5.1, and 8.1.x before 8.1.3.1. Systems using libvips should move to 8.13 or later and rotate exposed secrets because the issue can expose arbitrary files and lead to RCE.

Related Happenings

Rails Active Storage mitigation guidance for CVE-2026-66066

Advisory/Mitigation
H score40 First: 01.08.2026 17:20 Last: 01.08.2026 17:20 Sources 1

How related: The Rails team recommends upgrading to libvips 8.13 or later and rotating the ‘secret_key_base’ (the Rails master key), database credentials, Active Storage service credentials, and any other secrets accessible to the application process.

About this happening: Rails maintainers issued mitigation guidance for CVE-2026-66066, directing Active Storage operators to upgrade to libvips 8.13 or later and rotate secrets after th...

Open Happening

Adobe security patch release for CVE-2026-48395

Security Patch Release
H score39 First: 01.08.2026 10:12 Last: 01.08.2026 10:12 Sources 1

About this happening: Adobe shipped a security update for Adobe Bridge on 2026-08-01 that closes eight critical-rated flaws with risk of privilege escalation and arbitrary code execut...

Open Happening

Linux kernel upstream security patch release for CVE-2026-53264

Security Patch Release
H score32 First: 28.07.2026 11:04 Last: 28.07.2026 11:04 Sources 1

About this happening: Linux kernel maintainers have backported CVE-2026-53264 fixes across stable branches, closing a local privilege-escalation path that can turn a local user into root on...

Open Happening

RabbitMQ maintainers security patch release for CVE-2026-57219

Security Patch Release
H score29 First: 14.07.2026 16:48 Last: 14.07.2026 16:48 Sources 1

About this happening: RabbitMQ maintainers released fixed versions for multiple supported release lines, closing two access-control flaws that could expose OAuth client secrets and cross-te...

Open Happening

Microsoft YellowKey patch release (CVE-2026-45585)

Security Patch Release
H score20 First: 11.06.2026 20:43 Last: 11.06.2026 20:43 Sources 1

About this happening: Microsoft's Patch Tuesday updates this week patched YellowKey (CVE-2026-45585), closing a Windows BitLocker bypass that could expose protected volumes. The vendor rele...

Open Happening

Timeline

  1. 01.08.2026 17:20 2 articles · 2h ago

    Rails publishes CVE-2026-66066 advisory for Active Storage

    Initial Disclosure

    Rails maintainers issued a critical advisory for CVE-2026-66066 in Active Storage, warning that an unauthenticated attacker can read arbitrary files and potentially reach remote code execution when libvips is used with untrusted image uploads. The advisory covers Active Storage before 7.2.3.2, 8.0.x before 8.0.5.1, and 8.1.x before 8.1.3.1; Rails 6.x is only affected if Active Storage was configured outside its defaults. Recommended mitigation includes upgrading to libvips 8.13 or later, rotating secret_key_base and other credentials, and using VIPS_BLOCK_UNTRUSTED or Vips.block_untrusted(true) on supported ruby-vips builds.

    Show sources
    Open in new tab