[CVE-2026-66066]

August 4, 2026

• Rapid7 dropped a technical teardown of the Rails Active Storage RCE (CVE-2026-66066). "KindaRails2Shell" allows unauthenticated file reads and potential RCE via image processing; the analysis details the exploitation path (Rapid7). Builds on earlier coverage. · Vulnerabilities & Exploits

in Attackers Seize N-central RMM Servers After N-able's Second Fix Falls Short

July 30, 2026

• KindaRails2Shell (CVE-2026-66066) is a critical RCE in Rails Active Storage when using libvips, allowing arbitrary file read escalating to remote code execution; Ethiack published a technical write-up and mitigations. Ethiack · Vulnerabilities & Exploits

in OpenAI's Rogue Agent Widens: Four More Companies Caught in the Blast Radius