GoKawiilRietta deploys emergency patch for Rails ActiveStorage flaw CVE-2026-66066 same day it surfaced
Security firm Rietta rolled out an emergency hotfix across its client base on July 29, 2026, after a Ruby on Rails ActiveStorage vulnerability—later named KindaRails2Shell and tracked as CVE-2026-66066—jumped from an unrated update to a 9.5/10 CVSS severity score within hours. The flaw, discovered by researchers at Ethiack, allows arbitrary file read and remote code execution through variant processing in Active Storage, a core Rails component used in Rails 8 and newer.
GoKawiil's interpretation of the reporting above, not reported fact.
Rietta's client roster includes HIPAA-covered organizations and state government agencies running custom Rails applications, making rapid patching critical to avoid regulatory penalties and data breach fallout. The case highlights how vulnerability severity can escalate dramatically within a single day, forcing security teams to abandon standard maintenance windows for emergency response.
- CVE-2026-66066 in Rails ActiveStorage escalated from unrated to a 9.5/10 CVSS severity within hours on July 29, 2026.
- Rietta patched all affected client sites the same day the advisory was published, treating it as an emergency.
- Government agencies and HIPAA-covered entities using custom Rails apps were among those most exposed to the risk.
Agile Web Development with Rails 8 (Pragmatic Bookshelf) — If a critical ActiveStorage RCE in Rails 8 has you auditing your stack, this is the canonical guide to how modern Rails actually works, ActiveStorage included. It's a solid reference for developers who need to understand upgrade paths and framework internals well enough to patch fast and with confidence.
See Agile Web Development with Rails 8 (Pragmatic Bookshelf) on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: rietta.com, 2026-09-04
Published there as: “Government Rails Site Hit Hours After CVE Patch”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.