Blog

Cve

3 posts tagged cve — the same founder-tested patterns, filtered.

Rails CVE-2026-66066: Patch Isn't Enough

Aug 8, 2026 · 9 min read

rails, security, cve, active-storage, devops

CVE-2026-66066 lets an unauthenticated upload read server files via Active Storage. Patching Rails is not enough - libvips must go to 8.13 and secrets rotate.

Rails 7 End of Life: Pick Your Exit

Aug 8, 2026 · 8 min read

rails, security, cve, upgrade

Rails 7.1 got no patch for CVE-2026-66066, a CVSSv4 9.5 pre-auth RCE. How to find every app of yours on a dead branch and pick between four realistic exits.

Rails CVE-2026-41316: Detection and Patch

May 2, 2026 · 3 min read

rails, ruby, security, cve

CVSS 8.1 universal RCE chain through ERB::DeprecatedInstanceVariableProxy and Marshal.load. Detection, upgrade path, Rails 7.0/7.1 EOL options.

Reading this because something is going wrong?

A free code audit gives you a written assessment of your codebase in plain English.

Get a Free Code Audit

Rated 4.8/5 on Clutch · you keep the write-up either way