Hackers Are Actively Exploiting a Near-Perfect-Score Flaw in Ruby on Rails

Key points

• CVE-2026-66066, nicknamed KindaRails2Shell, carries a CVSS score (a standard 1-to-10 severity rating) of 9.5 out of 10.
• Active exploitation of the flaw began roughly one month after patches were released, according to security firm VulnCheck.
• Around 7,000 exposed Ruby on Rails servers were still vulnerable as of early August.
• VulnCheck says the official patch blocks one attack route but leaves a second, code-execution route open on servers running version 8.1.3.1.
• Ruby on Rails released forensic tools to help administrators check whether their servers have already been targeted.

A critical security flaw in Ruby on Rails, one of the most widely used frameworks for building websites and web apps, is now being actively exploited by criminals. Security researchers at VulnCheck, first reported by SecurityWeek, say attacks began last week, about a month after the original fix was published.

The vulnerability is tracked as CVE-2026-66066 and carries a CVSS (Common Vulnerability Scoring System, a standard industry scale from 1 to 10) score of 9.5. Researchers have named it KindaRails2Shell.

What does this flaw actually do?

The bug lets an attacker read private files stored on the server and, from there, take full control of it. That is two distinct dangers in one.

Ruby on Rails is a software framework, meaning a pre-built toolkit that developers use to build websites faster. Many of those sites accept image uploads from users. The flaw lives in how Rails hands those images off to a processing library called libvips.

Rails trusts the uploader to declare what kind of file it is sending. Libvips ignores that label and checks the file's internal signature bytes instead. An attacker can exploit the gap between those two approaches by crafting a disguised file. When the server tries to display it as an image, it instead reads a file of the attacker's choosing and sends the contents back. Sensitive files like login credentials, session keys, and database passwords are all fair game for anything the server process can access.

Once those secrets are stolen, the criminals can forge user sessions (essentially impersonating any account), break into connected systems, and run arbitrary code, meaning any command or program, on the server itself.

Is the patch enough?

Not entirely. VulnCheck tested a server running the patched version 8.1.3.1 and found that while the fix stops the file-reading route, a second attack path remains open. That path involves a technique called Marshal deserialization, where a crafted data payload tricks the server into executing code. VulnCheck confirmed the code-execution part of the attack still works on a fully patched server given a valid signing key.

The table below summarises what defenders are dealing with.

Shortly after disclosure in late July, independent researchers reverse-engineered the bug and published proof-of-concept code showing exactly how to exploit it. That kind of public availability almost always accelerates criminal activity.

What should website owners and users do?

If you run a Rails application that accepts image uploads from the public, apply the available patch immediately if you have not already done so. Given the deserialization issue, rotate your application's secret keys and session signing keys as well, since a leaked key keeps the RCE route open even on a patched server. Rails has also published forensic tools to help you check server logs for signs of past exploitation.

For ordinary users of websites built on Rails, the practical concern is credential exposure. If a site you use sends you a notification about a security incident in the coming weeks, take it seriously, change your password for that service, and watch for unusual account activity.