sign in--:--:--UTC

CVE-2026-66066

exploited in the wild☆ pin

CVSS

9.5

Reports

4

First seen

Jul 29, 2026

Last seen

Aug 3, 2026

Affected product

Ruby on Rails Active Storage (libvips backend) Rails 6.0.0–6.1.7.10, 7.0.0–7.2.3.1, 8.0.0–8.0.5, 8.1.0–8.1.3

Associated actors

APT29 ×1 Chaotic Eclipse ×1 Storm-2945 ×1 Void Blizzard ×1

Recent reports

Weekly Cybersecurity Recap: AI Model Breaches, Water-System Attacks, Ransomware, and Critical Vulnerabilities

The Hacker NewsAug 3, 2026 High

Threat Intelligence Report – Week of 27 July: Critical Vulnerabilities, Water Utility Attacks, and Breach Activity

Check Point ResearchAug 3, 2026 Critical

Rails patches critical Active Storage RCE flaw CVE-2026-66066

Bleeping ComputerAug 1, 2026 Critical

Critical Rails Active Storage Vulnerability Enables Arbitrary File Read via Image Uploads

The Hacker NewsJul 29, 2026

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign up See plans