After hours connected Wednesday, July 29, 2026, Rietta executed our emergency hotfix process crossed our full customer guidelines for sites impacted by a terrible distant codification execution vulnerability successful ActiveStorage, a constituent of Ruby connected Rails 8 and newer. We worked disconnected the first GitHub Security Advisory, published the aforesaid time the spot shipped. Ethiack, 1 of the investigation teams that discovered the flaw, dubbed it KindaRails2Shell (CVE-2026-66066) successful their first disclosure station that aforesaid day, July 29th, pinch a afloat method deep-dive pursuing the adjacent time connected July 30th.
When our squad first reviewed this vulnerability during business hours connected the 29th, it showed nary assigned severity, conscionable a Ruby connected Rails update released, its exploitation specifications withheld nether the modular embargo terms. By evening, though, our squad saw it had climbed to an highly terrible 9.5/10 CVSS score. That is astir arsenic bad arsenic it gets and meant that immoderate hold successful patching was an existential consequence of imminent compromise.
Client Background
Our customer guidelines includes HIPAA-covered entities and State authorities agencies, galore of which person Ruby connected Rails-based civilization applications wrong their infrastructure. These are entities that look important regulatory and reputational harm successful a information breach scenario, and they tin brook nary hold erstwhile faced pinch a terrible threat.
During business hours, our squad reviewed the released details, saw nary severity yet assigned, and initially triaged it arsenic a regular update that could proceed nether normal attraction windows. By evening, our team’s ongoing monitoring showed the CVSS had climbed to 9.5/10, and we declared a hotfix emergency.
These patches were applied connected the aforesaid time that the vulnerability was announced and published by the Rails information squad astatine Possible arbitrary record publication and distant codification execution successful Active Storage version processing. The process itself was straightforward. The squad prepared propulsion requests for each impacted Rails app that ran the bundle update activestorage rails command, which fetched the latest patched release. The squad past locally ran and fto continuous integration (CI) tally the afloat automated trial suite. Only erstwhile the afloat trial suites passed cleanly, confirming thing other had broken, we deployed to production.
We notified each impacted customer of the action via email and concluded our activity astir 11:30 PM EST.
The Detail Embargo Was Already Overtaken by Events
The advisory withheld the method attack-chain narrative, promising afloat disclosure “no later than” August 28, 2026. In practice, that embargo was functionally meaningless from the infinitesimal the spot shipped, and not because anyone breached it. The hole itself, a nationalist codification diff, was ne'er embargoed astatine all, only the mentation of really to utilization it. That mentation didn’t moreover clasp for a month. The Rails task published forensic tooling pinch method item the very adjacent day, July 30th astatine 6:25 PM EST, connected GitHub. Ethiack published its afloat method write-up the pursuing morning, July 31st astatine 6:56 AM EDT. Both arrived astir 4 weeks up of the primitively stated embargo day connected the GitHub Advisory. Rapid7’s ain incident tracking independently confirms why: Rails released the forensic tooling up of its planned day specifically because respective researchers had already reverse-engineered the onslaught and published proof-of-concept code, truthful the embargo was giving measurement sloppy of what Rails aliases the original researchers preferred.
The first onslaught against our customer predates all of that. It deed astatine 7:10:25 AM EST connected July 30th, 8 hours and 1 infinitesimal aft we applied the patch, much than eleven hours earlier Rails’ ain forensic tooling went nationalist and astir a afloat time earlier Ethiack’s ain write-up. We initially assumed whoever built that first payload had done truthful independently, patch-diffing the hole themselves successful the hours aft it shipped. New grounds points to a different, simpler explanation. A nationalist proof-of-concept utilization was committed to GitHub astatine 9:47:30 PM UTC connected July 29th. That’s complete 5 hours earlier our ain spot was moreover afloat deployed (11:09 PM EDT / 3:09 AM UTC connected July 30th), and 13 hours, 22 minutes, and 55 seconds earlier the first onslaught effort against our client.
Timing unsocial doesn’t beryllium our attacker utilized that circumstantial PoC alternatively than thing else, aliases their ain tooling. André Baptista of Ethiack (@0xacb), 1 of the vulnerability’s ain discoverers, pointed retired a item successful a public speech pinch maine connected X. That GitHub PoC was the first nationalist proof-of-concept to usage a malformed BMP record to trigger the exploit. The first onslaught effort against our customer besides utilized a maliciously formed BMP.
That’s a correlation, not impervious of causation. By logical abduction, though, it’s the simplest mentation that fits the grounds we have. This astir apt wasn’t 1 particularly accelerated aliases skilled attacker beating the embargo alone. It looks much for illustration the vulnerability investigation ecosystem arsenic a full outpacing the coordinated disclosure timeline. Our ain emergency spot wasn’t moreover vanished yet erstwhile that PoC went public. The embargo strategy grounded earlier we had immoderate chance to adjacent that gap.
Baptista put the broader move plainly:
“We person been holding backmost method specifications successful aggregate cases to springiness defenders much time, but things are happening excessively fast.”
Baptista is 1 of the researchers who held backmost method specifications connected this very CVE, which gives him circumstantial penetration into this matter.
Attack Attempts Started Overnight connected July 30th
One peculiar client, a State authorities entity, logged the first onslaught effort pinch a maliciously formed Windows bitmap (BMP) record connected July 30, 2026, astatine 07:10:25 AM EST, from an IP reside connected the RIPE network, presenting arsenic Chrome 131.0.0 connected Windows 10. That first effort was an isolated azygous hit, not the opening changeable of sustained activity. The logs show thing further against this customer for respective days afterward. That’s accordant pinch a probe originated from the early PoC alternatively than the commencement of a broader scanning campaign.
The continuous, adapting activity of probing began separately, connected August 3, 2026 astatine 1:01:05 AM EDT, utilizing a disguised PNG record alternatively than the BMP from the first attempt. From that constituent on, the attempts continued connected a rotating group of IP addresses astir the world, utilizing a assortment of personification agents, including a malformed spoof of Anthropic’s Claude-SearchBot crawler and an unusually candid personification agent, Mozilla/5.0 (CVE-2026-66066 information verification), that openly named the CVE it was probing for alternatively than attempting to disguise itself, again from an world IP reside range.
While our State authorities customer does employment information appraisal services, nary of these attempts, the isolated July 30th probe aliases the sustained run that began August 3rd, are attributable to those activities. This was intelligibly unauthorized and, from August 3rd onward, continual probing of this high-severity vulnerability.
Attack Attempts and Probing Continued passim August, 2026
The attempts to utilization this behaviour continued passim the period connected a regular basis, often during overnight hours. We person log grounds of onslaught frameworks not only automating but immoderate denotation of adaptation, specified arsenic erstwhile definite further information measures were put into spot the attempts changed to travel different variants. The grade this was each automated aliases the information of the attackers, we are not commenting connected publically astatine this time.
Timeline Recapped
| Initial find by morganatic information researchers |
| Researchers get successful touch pinch due Ruby connected Rails maintainers pursuing a responsible disclosure procedure |
| Critical ActiveStorage update released. Disclosure and nationalist vulnerability search numbers assigned |
| A nationalist proof-of-concept utilization is committed to GitHub, hours earlier our ain spot was complete |
| Late night, Rietta applies patches to our impacted clients pursuing emergency hotfix procedure |
| Rietta deployed the specific, tested update to a peculiar State authorities client |
| Early morning, that aforesaid State authorities exertion objection logs bespeak the first onslaught effort from a overseas IP address, an isolated azygous hit |
| Ruby connected Rails task releases tooling to cheque for compromise |
| André Baptista publishes method findings connected https://ethiack.com |
| Continuous, sustained probing originates utilizing a disguised PNG file, chopped from the isolated July 30th attempt |
What This Means for Rails Applications Handling Sensitive Data
The instruction present is bigger than this 1 CVE. A coordinated disclosure timeline doesn’t bargain defenders a grace period. The infinitesimal a spot ships, the hole itself, a nationalist codification diff, is disposable to anyone consenting to publication it alternatively of waiting for a plain-English writeup. Our ain logs beryllium the spread betwixt “patch published” and “working utilization attempted” tin beryllium measured successful hours, not weeks, sloppy of what the embargo day says.
That’s why our emergency hotfix process exists independent of severity scoring, first vendor communication, aliases embargo dates. We spot connected the fix, not connected the writeup. For our clients handling regulated data, whether HIPAA-covered wellness records aliases authorities government systems bound by nationalist spot and disclosure obligations, that quality is the full constituent of retaining a patient that treats “patched” arsenic time 1 of monitoring, not the extremity of the incident.
Had we followed a modular notify-and-wait process, this customer wouldn’t person had a moving spot until sometime aft business hours resumed, apt mid-morning astatine the earliest, erstwhile personification pinch authority was reachable to o.k. the change. The first exploitation effort deed astatine 7:10 AM, 8 hours and 1 infinitesimal aft we patched without waiting for permission. Under a accepted support cycle, that model wasn’t a delay, it was a live, unpatched, actively-targeted captious vulnerability sitting unfastened done the client’s full pre-business-hours period, pinch nary 1 moreover alert yet that a determination needed to beryllium made.
All of these attempts grounded cleanly, astatine the nonstop constituent our spot intended. That doesn’t mean thing happened. A period of sustained, adapting, multi-actor probing against a unrecorded authorities strategy is its ain story. Patching accelerated made the quality betwixt an incident and a non-event. We’ve since added much hardening: tighter upload validation, automated blocking for repetition scanning attempts, and centralized alerting. “The utilization failed” is simply a consequence we want to support being true, not a logic to extremity paying attention.
Practical Advice
For each of you, particularly those who are not our clients, I person immoderate applicable advice.
- Treat immoderate dependency’s standalone information merchandise arsenic urgent by default, moreover earlier a CVSS people is assigned. Score duty lags existent risk, sometimes by galore hours. If a vendor ships a dedicated information merchandise astatine all, don’t hold for a number to show you really captious it is.
- Check whether your Ruby connected Rails exertion uses ActiveStorage. If truthful and your squad hasn’t upgraded yet, return this threat very seriously, spot instantly and analyse your exposure.
- Patch terrible vulnerabilities wrong hours. Have emergency change-approval authority established successful advance, earlier you request it, truthful a hole isn’t blocked waiting for personification to aftermath up and assistance permission.
- Run automated, ecosystem-specific information scanning connected a nightly job. For Rails, that intends devices for illustration bundler-audit (known CVEs successful your dependencies) and Brakeman (static study for Rails-specific vulnerability patterns). In our experience, these nightly scans person beaten GitHub’s ain Dependabot to flagging an issue, and they rustle distant waiting connected a periodic outer information audit study to show you what’s already been sitting exposed. Triage what they emblem daily.
- For immoderate codification way that processes user-uploaded files, dainty it arsenic its ain threat exemplary boundary. Validate record type by magic bytes, not content-type headers; harden your image aliases archive processing library’s argumentation (for example, ImageMagick’s policy.xml, disabling coders aliases delegates you don’t use); and sandbox aliases tally that processing pinch reduced privileges wherever you can. This was the existent onslaught aboveground successful this incident.
- Set up a web exertion firewall (WAF) specified arsenic Cloudflare aliases AWS WAF & Shield, show it, and tune it to your environment. Signature-based rules often miss a caller payload hidden wrong a malformed file. Treat a WAF arsenic 1 furniture of defense, ne'er the full plan.
- Continuously adhd much and much automated testing to springiness you assurance that your package worked earlier and aft specified patching. Start to spot this information nett capable to move accelerated nether pressure.
- Ensure you person objection monitoring successful spot and that your method squad reviews it regularly. Unsuccessful requests matter arsenic overmuch arsenic successful ones. Pay circumstantial attraction to POST and PUT requests to paths that do not exist, a beardown parameter of adversarial probing. When thing recurs, adhd validation and automated countermeasures, for Rails, thing for illustration rack-attack to throttle repetition offenders.
- Ensure your exertion only responds to requests directed to your circumstantial domain name, not conscionable routed to your IP. Cloud providers rotate IP addresses among customers truthful this is conscionable bully hygiene and reduces noise.
- Configure and clasp logs astatine your WAF, particularly blocks, and wrong your application. Ensure your exertion logs some authentication successes and failures and reappraisal regularly.
I cognize this database mightiness look for illustration a lot. This is often what we locomotion our clients done and grip straight connected their behalf. However, this is excessively important to ignore. Please transcript this list, usage it, stock it pinch your friends. I want you to beryllium much unafraid moreover if we ne'er personally activity together.
Rietta’s Specific Ruby connected Rails Expertise
As a company, Rietta has agelong served arsenic a Ruby connected Rails improvement agency, done our Atlanta Ruby Developer division. We person a estimation arsenic a long-time vendor for security-sensitive industries pinch civilization Ruby connected Rails applications successful their infrastructure. We besides are the sponsor of the Atlanta Ruby Users’ Group, a long-standing organization of Ruby developers.
Personally, I person been moving pinch the Ruby programming connection since postgraduate schoolhouse successful 2006, and professionally pinch Ruby connected Rails since 2011. I person worked with, trained developers on, and consulted connected each matters of Ruby connected Rails improvement and information for a agelong clip now. If you person immoderate questions, fto maine know.
English (US) · 
Indonesian (ID) · 
