Story thread · 4 reports / 4 sources

KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066)

helpnetsecurity.com · 8dShare

A critical security vulnerability (CVE-2026-66066) in Ruby on Rails (aka Rails), one of the most widely used frameworks for building websites and web apps, may allow attackers to read sensitive files off a server and, in some cases, take full control of it. Nicknamed “KindaRails2Shell” by the researchers who found it, the flaw lets an attacker sneak a booby-trapped file past a website’s image-upload feature and use it to pry open the server’s secrets. About … More → The post KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066) appeared first on Help Net Security .

First report: Ruby on Rails Patches Critical Vulnerability — securityweek.com, 10d