After hours on Wednesday, July 29, 2026, Rietta executed our emergency hotfix procedure across our entire client base for sites impacted by a severe remote code execution vulnerability in Active Storage, a component of Ruby on Rails 8 and newer. We worked off the initial Git Hub Security Advisory, published the same day the patch shipped. Ethiack, one of the research teams that discovered the flaw, dubbed it Kinda Rails2Shell (CVE-2026-66066) in their initial disclosure post that same day.

When our team first reviewed this vulnerability during business hours on the 29th, it showed no assigned severity, just a Ruby on Rails update released, its exploitation details withheld under the standard embargo terms. By evening, though, our team saw it had climbed to an extremely severe 9.5/10 CVSS score. That is about as bad as it gets and meant that any delay in patching was an existential risk of imminent compromise.

Our client base includes HIPAA-covered entities and State government agencies, many of which have Ruby on Rails-based custom applications. These entities face significant regulatory and reputational damage in a data breach scenario. The patches were applied on the same day the vulnerability was announced. The process was straightforward: the team prepared pull requests, ran the bundle update activestorage rails command, and ran the full automated test suite before deploying.

The advisory withheld the technical attack-chain narrative, promising full disclosure “no later than” August 28, 2026. In practice, that embargo was functionally meaningless. The fix itself, a public code diff, was never embargoed. The Rails project published forensic tooling with technical detail the very next day, July 30th at 6:25 PM EST, on Git Hub. The first attack against our client hit at 7:10:25 AM EST on July 30th, eight hours after we applied the patch, more than eleven hours before Rails’ own forensic tooling went public.