Critical Rails Flaw CVE-2026-66066 Enables File Theft and Remote Code Execution

·1 views

JPCERT/CC published an advisory on July 30, 2026, warning of a critical vulnerability tracked as CVE-2026-66066 in Ruby on Rails' Active Storage component. The flaw allows unauthenticated attackers to upload a crafted file and trigger malicious variant processing through libvips, potentially reading arbitrary files and stealing sensitive credentials. Under certain conditions, attackers can escalate to full remote code execution running under the Rails process's OS permissions, with no user interaction required. Affected versions include Rails releases earlier than 7.2.3.2, 8.0 to 8.0.5.1, and 8.1 to 8.1.3.1, particularly when the variant processor is set to :vips with a default libvips build. Administrators are advised to upgrade to patched versions immediately and treat all readable credentials as already compromised.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

California aquifer may be irreversibly depleted, scientists warn

A California aquifer may have reached a critical threshold beyond which recovery is no longer possible, according to new research. The findings raise serious concerns about long-term water availability in a state that heavily relies on groundwater for agriculture and drinking supplies. Scientists suggest the aquifer's depletion has progressed to a point where natural recharge cannot keep pace with extraction. The situation underscores growing warnings about unsustainable groundwater use across drought-prone regions of the American West.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Why NVIDIA Open-Sourced Its Linux GPU Kernel Modules: Architecture, Not Just Policy

NVIDIA released GPL-licensed Linux kernel modules — including nvidia.ko, nvidia-drm.ko, nvidia-uvm.ko, and nvidia-modeset.ko — while keeping user-space components like CUDA, OpenGL, and GSP firmware proprietary. The move was enabled by the introduction of the GPU System Processor (GSP), which shifted low-level hardware control from the host CPU's kernel driver into onboard firmware, allowing the kernel-facing interface to be safely open-sourced. Previously, NVIDIA's proprietary modules required a DKMS-based workflow that frequently broke after kernel updates and caused Secure Boot and packaging difficulties for Linux distributions. With source code now available, major distros such as Ubuntu, Red Hat, and SUSE can integrate, sign, and maintain the modules within their own infrastructure far more easily. NVIDIA also highlights improved debuggability, security review, and compatibility with modern environments like Kubernetes clusters, AI training servers, and Confidential Computing platforms as key benefits of the change.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Enterprises Can Build Audit and Observability Stacks for AI Agents

As autonomous AI agents take on complex, multi-step business tasks across databases and APIs, traditional monitoring tools are proving inadequate for diagnosing failures or hallucinations. Enterprise security, audit, and regulatory teams now require verifiable, non-repudiable records of every agent execution to comply with frameworks such as SOC 2, FedRAMP, and the EU AI Act. Platform engineering teams are being urged to adopt an Audit, Observability, and Lineage architecture built on OpenTelemetry, OWASP Agent Observability Standards, and immutable lineage graphs. This approach encapsulates each agent run within a traceable root context, recording sub-tasks, tool calls, and model invocations as hierarchical spans with standardized metadata. To manage the high data volumes generated, the architecture applies tail sampling — retaining all error and anomaly traces while downsampling routine successful runs to reduce storage costs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Chaos Ransomware Deployed in Under 17 Hours via Microsoft Teams IT Support Scam

Cybersecurity firm Sophos has detailed a threat cluster, tracked as STAC4749, in which attackers impersonate IT support staff using external Microsoft Teams accounts to trick employees into granting remote access. The attacker initiates contact from a Teams account on a deceptive .top domain, then uses legitimate remote tools like Quick Assist and RemSupp to establish control over the victim's device. Once inside, they deploy PowerShell scripts, a PyArmor-obfuscated PyInstaller backdoor, multiple remote management tools, and a reverse SOCKS proxy to move laterally across the internal network. In at least one confirmed case, the attackers exfiltrated data before simultaneously encrypting multiple devices with Chaos ransomware, completing the entire attack in under 17 hours. Sophos recommends restricting external Teams communications, enforcing strict application controls, and training users to verify IT staff identity before approving any remote support session.

0 comments Read more at DEV Community