Hackers Are Actively Exploiting a Near-Perfect-Score Flaw in Ruby on Rails
A critical vulnerability in the popular web framework lets criminals read files off a server and run their own code on it, and the official patch only closes half the door.
Key points
- CVE-2026-66066, nicknamed KindaRails2Shell, carries a CVSS score (a standard 1-to-10 severity rating) of 9.5 out of 10.
- Active exploitation began roughly one month after patches were released, according to security firm VulnCheck.
- Around 7,000 exposed Ruby on Rails servers were still vulnerable as of early August.
- VulnCheck says the official patch blocks the file-reading route but leaves a code-execution path open on servers running version 8.1.3.1.
- Rails published forensic tools to help administrators check whether their servers have already been targeted.
A critical flaw in Ruby on Rails, one of the most widely used frameworks for building websites and web apps, is now being actively exploited. VulnCheck, first reported by SecurityWeek, says attacks began last week, about a month after the fix was published.
The vulnerability is tracked as CVE-2026-66066 and carries a CVSS (Common Vulnerability Scoring System, a standard industry scale from 1 to 10) score of 9.5. Researchers call it KindaRails2Shell. We first covered the flaw when it was disclosed on 29 July.
What does this flaw actually do?
The bug lets an attacker read private files stored on the server and then take full control of it. Two distinct dangers, one vulnerability.
Rails is a pre-built toolkit developers use to build websites faster. Many of those sites accept image uploads. The flaw lives in how Rails hands uploads to a processing library called libvips.
Rails trusts the uploader's declared file type. Libvips ignores that label and reads the file's internal signature bytes instead. An attacker exploits that gap with a disguised file: when the server tries to display it as an image, it instead reads a file of the attacker's choosing and returns the contents. Anything the server process can access is exposed, including credential databases and storage keys.
With those secrets in hand, an attacker can forge user sessions, break into connected systems, and execute arbitrary code on the server.
Is the patch enough?
Not entirely. VulnCheck tested version 8.1.3.1 and found the fix stops the file-reading route but doesn't touch a second attack path. That path uses a technique called Marshal deserialization, where a crafted data payload tricks the server into running code. VulnCheck confirmed the code-execution part still works on a fully patched server given a valid signing key.
The table below summarises what defenders are dealing with.
| Detail | Value |
|---|---|
| CVE ID | CVE-2026-66066 |
| CVSS score | 9.5 / 10 |
| Nickname | KindaRails2Shell |
| Patched version (partial fix) | Rails 8.1.3.1 |
| Vulnerable instances (early August) | ~7,000 |
| Exploitation observed | Approximately one month post-patch |
Shortly after disclosure in late July, independent researchers reverse-engineered the bug and published proof-of-concept code. That kind of public availability almost always accelerates criminal activity, and it did here.
What should website owners and users do?
If you run a Rails application that accepts image uploads from the public, apply the patch now. Given the deserialization issue, rotate your application's secret keys and session signing keys too: a leaked key keeps the code-execution route open even after patching. Rails has also published forensic tools to help you check server logs for signs of past exploitation.
For ordinary users of sites built on Rails, the practical risk is credential exposure. If a site you use sends a security notice in the coming weeks, change your password for that service and watch for unusual account activity.
The partial patch is the part of this story that deserves more attention. Operators who applied 8.1.3.1 and considered themselves covered aren't: without key rotation, the worst outcome is still reachable.
