On 7/29/2026 3:46 PM, Alan Coopersmith wrote:
https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm
advises:
Possible arbitrary file read and remote code execution in Active Storage
variant processing
Critical
byroot published GHSA-xr9x-r78c-5hrm 29 July 2026
[...]
Disclosure
----------
Technical details of the attack chain are intentionally omitted from this
advisory. They would add nothing to an administrator's decision to
upgrade,
while making it substantially easier to attack applications that have
not yet
done so.
Details will be disclosed no later than 2026-08-28, via the Rails
Security
Announcements forum:
https://discuss.rubyonrails.org/c/security-announcements/9
That further disclosure has happened now, announced at:
https://discuss.rubyonrails.org/t/cve-2026-66066-attack-details-and-tools-to-perform-a-forensic-investigation/91441
We originally intended to publish these details no later than
2026-08-28, but several researchers quickly reverse-engineered the
attack and have already published proofs-of-concept. As a result, we are
disclosing details about the attack now, along with some tools to help
assess whether an application was vulnerable and to help examine the
forensic evidence for signs of secret exfiltration.
We have published all of this in a git repository,
<https://github.com/rails/rails-forensics-CVE-2026-66066>,
which contains:
* reference/the-attack.md explains how the attack works, step by step,
from the incoming request to the file being read.
* reference/the-investigation.md explains what evidence the attack
leaves behind in your database and your object store, and what that
evidence does and does not prove.
* The kr2s-was-i-vulnerable agent skill works out whether your
application was ever vulnerable, and if it was, over what period of
time.
* The kr2s-was-i-exploited agent skill searches your Active Storage
data for the crafted files, and works out what was read if it finds
any.
--
-Alan Coopersmith- [email protected]
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
