Rails CVE-2026-66066: Active Storage Flaw Enables Arbitrary File Read and RCE

·1 views

The Rails project disclosed CVE-2026-66066 this week, a critical vulnerability in Active Storage's variant processing that could allow arbitrary file reads and remote code execution. Apps are at risk if they use libvips as the variant processor and allow untrusted users to upload images that trigger variant generation. Affected versions include Active Storage 8.0, 8.1, and 8.13, and developers are urged to upgrade immediately. Beyond patching, the advisory strongly recommends rotating all application secrets, as credentials may already have been exposed if the app was previously vulnerable. On libvips 8.13 or newer, a workaround exists via the VIPS_BLOCK_UNTRUSTED environment variable or a ruby-vips initializer call, but no workaround is available for older libvips versions.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

A Decade in Software Engineering: Key Lessons From Banking, Gov and Tech Projects

A full-stack software engineer with ten years of experience reflects on lessons learned while building systems for a bank, Georgia's Ministry of Healthcare, major online marketplaces, and an international reinsurance platform. The engineer argues that mastering fundamentals like HTTP, database indexing, and problem modelling outlasts any specific framework, as tools are routinely replaced across the industry. Most serious performance issues encountered across sectors traced back to data problems — poor indexing, inefficient queries, or poorly designed schemas — rather than frontend or application logic. Breadth as a full-stack developer proved valuable not for technical superiority in any one area, but for the ability to trace problems across an entire system and resolve disputes between siloed teams. The engineer also highlights that reading and understanding unfamiliar codebases is a critical but underrated skill rarely taught formally, yet essential in real-world engineering roles.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Claude Fable 5 vs GPT-4o: Which Model Writes Better TypeScript Code?

A developer and AI systems architect ran head-to-head TypeScript code generation tests on Claude Fable 5 and GPT-4o using identical prompts and a three-part rubric covering compilation, strict mode compliance, and error handling. Claude Fable 5 performed better with generics, utility types, and async error boundaries, consistently producing output that passed strict TypeScript mode with minimal edits. GPT-4o handled simple and intermediate type inference reliably but struggled with advanced patterns like conditional types and heavily generic helpers. Both models occasionally missed exhaustiveness checks on discriminated unions, a gap the tester flagged as requiring manual human review. The key takeaway is that each model has distinct failure modes, and choosing the right one depends on the complexity and patterns specific to the project being built.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Optimajet Rebuilds Workflow Engine Docs to Let AI Coding Agents Integrate .NET Library

Optimajet has overhauled the documentation for its embeddable .NET workflow library, Workflow Engine, with AI coding agents specifically in mind. The new docs at docs.workflowengine.io publish their full text as a single file so agents can read everything in one request, reducing the guesswork that leads to hallucinated API calls. A dedicated endpoint also allows agents to obtain a trial license key autonomously, removing the human-in-the-loop bottleneck that previously stalled automated evaluations. The documentation spans 57 pages across four sections, and a separate API reference at api.workflowengine.io covers all 20 packages in the library. Workflow Engine is commercial software shipping since 2014, supports .NET Framework 4.6.2 and above, and works with major databases including PostgreSQL, SQL Server, and MongoDB; its latest stable release is version 22.0.0, dated July 16, 2026.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer finds distributed systems lessons hidden inside a simple Rock Paper Scissors game

A developer built an online Rock Paper Scissors game in 2023 as a weekend project, which has since grown to include an iOS app, a Turkish sister site, and a matchmaking queue over three years. Building the game revealed classic distributed systems challenges, including the need to withhold a player's move from their opponent until both picks are locked, preventing any timing-based cheating. A race condition bug emerged at launch when two users joined the same room simultaneously, both seeing an empty seat — a check-then-set flaw fixed using atomic Redis operations. The developer chose to keep all live match state in Redis with a time-to-live expiry, reserving PostgreSQL only for completed match records, which kept the database lean and allowed horizontal scaling. A silent failure in the iOS Live Activity feature, caused by a swallowed error in a token refresh path, went unreported for weeks, highlighting the danger of features that fail quietly without user-facing feedback.

0 comments Read more at DEV Community