Because this vulnerability requires no authentication and targets the default image processor in modern Rails environments, it is essential to apply vendor patches and rotate secrets immediately. A new Rapid Rule adds a targeted layer of defense in depth.

Key takeaways

We have recently been tracking a critical vulnerability in Ruby on Rails, dubbed “KindaRails2Shell” (tracked as CVE-2026-66066 ). The flaw allows an unauthenticated attacker to read arbitrary files from the server, which can be escalated into remote code execution (RCE) .

The issue resides within the Active Storage component when processing images via libvips .…