Critical RCE Vulnerability CVE-2026-66066 Affects Ruby on Rails Active Storage with libvips
A critical vulnerability CVE-2026-66066 has been discovered in the popular web application framework Ruby on Rails. The issue, nicknamed KindaRails2Shell by some researchers, affects deployments that rely on Active Storage combined with the libvips image processing engine.
The flaw originates from unsafe operations permitted in the libvips dependency library. By uploading a specially crafted file, an unauthenticated attacker can read arbitrary files on the server. This capability may expose process environment variables, secret keys, and authentication credentials for external services.
Once sensitive data is obtained, attackers can leverage it to execute arbitrary code remotely or chain the access into broader compromise. The vulnerability is difficult to mitigate with web application firewalls, making prompt patching the primary defense.
The CVSS v4.0 base score is 9.5, placing the issue in the highest severity category of Critical. JPCERT/CC has published an advisory recommending immediate updates to affected Ruby on Rails installations.
Related articles
Mind Games: 30 Years of Hacking and Securing Game Consoles
The article traces the evolution of security mechanisms in home game consoles from the unprotected Atari 2600 in 1977 through hardware locks, optical media protections, and cryptographic boot chains up to the seventh generation. Early systems like the NES relied on the 10NES/CIC chip for mutual authentication using identical Sharp SM590 microcontrollers, which was quickly defeated by Tengen's Rabbit clone and physical pin-clipping attacks. PlayStation introduced SCEx regional signals on discs, leading to widespread modchip installations and swap tricks that bypassed all code verification. Microsoft’s original Xbox implemented a full cryptographic chain of trust starting from the MCPX southbridge, yet it fell to HyperTransport bus sniffing by bunnie Huang and buffer overflows in titles such as MechAssault. Nintendo Wii’s Twilight Hack exploited a stack overflow via an excessively long horse name in The Legend of Zelda: Twilight Princess, enabling unsigned code execution. The piece highlights recurring lessons about the limits of security-through-obscurity and the necessity of protecting both boot chains and runtime memory handling.
Oracle Issues Emergency Patches for Critical Remotely Exploitable WebLogic Server Vulnerabilities
Oracle released an emergency security update on August 18 containing 943 new patches across dozens of enterprise product families. The update addresses multiple high-severity flaws in Oracle WebLogic Server that can be exploited remotely without authentication over IIOP, T3, and RMI protocols. Four vulnerabilities—CVE-2026-60698, CVE-2026-60672, CVE-2026-60696, and CVE-2026-60977—received CVSS scores of 9.8 and can impact confidentiality, integrity, and availability of affected servers. A separate critical issue, CVE-2026-61241, was disclosed in the LDAP server component of Oracle Internet Directory with a maximum CVSS score of 10.0 and affects versions 12.2.1.4.0 and 14.1.2.1.0. Oracle urges customers to maintain supported releases and apply patches promptly, noting prior incidents where unpatched systems were targeted after fixes became available. Organizations are advised to validate patches in test environments before production deployment to minimize operational risk.
Google Patches Two Critical Memory Corruption Flaws in Chrome WebGL and Dawn Components
Google has issued a security update for Chrome that addresses 15 vulnerabilities, two of which are rated critical. The flaws, tracked as CVE-2026-76034 and CVE-2026-76036, involve buffer overflow conditions that can lead to out-of-bounds memory writes. CVE-2026-76034 affects the WebGL component used for 2D and 3D graphics rendering on web pages, while CVE-2026-76036 impacts Dawn, the Chromium implementation of WebGPU. Both issues were discovered internally and could result in crashes or remote code execution in certain scenarios. Updated versions are now available for Windows, macOS, Linux, and Android, and users are strongly advised to apply the patches immediately.
Oracle Releases August 2026 Monthly Security Patches Fixing 943 Vulnerabilities
Oracle has published its monthly Critical Security Patch Update on August 18, 2026, addressing a total of 943 vulnerabilities across a wide range of products. This release supplements the company's quarterly Critical Patch Update and includes fixes for third-party software issues, resulting in 925 unique CVEs after removing duplicates. Of these, 710 vulnerabilities received CVSSv3 base scores of 7.0 or higher, with 154 scoring 9.0 or above, including three at the maximum 10.0. A total of 467 flaws can be exploited remotely without authentication. Major products affected include Oracle Fusion Middleware with 262 patches, Oracle E-Business Suite with 120 fixes, and Oracle Database Server with six updates. The next monthly update is scheduled for September 15, 2026, followed by the quarterly release on October 20.