The Rails project's GitHub advisory says an unauthenticated attacker can abuse Active Storage image variant processing with libvips to read arbitrary files accessible to the Rails process, including environment secrets; exposed signing or service credentials can enable remote code execution or lateral movement. The affected configuration uses libvips for Active Storage and accepts untrusted image uploads. Upgrade Active Storage to 7.2.3.2, 8.0.5.1 or 8.1.3.1, use libvips 8.13 or later, and rotate secret_key_base plus every other secret readable by the application process.

Rails branches without a fixed release should move to a supported branch or remove libvips until they can patch. No vendor, CISA or other source Cyberstack can cite has confirmed exploitation of CVE-2026-66066 in the wild; it was not in CISA's Known Exploited Vulnerabilities catalogue when checked on 26 October 2026.

Correction (26 Oct 2026): a 1 September report of exploitation against honeypots in Singapore, Israel and the UK from a single IP address in France, with command-and-control in Israel, has been removed: The Hacker News attributed it to one threat-intelligence company's honeypot data, and no vendor, CISA or other independent source confirms it. A SecurityWeek link this Cyberstack does not use has also been removed. (source: Rails security advisory)