EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Hacker News·Sep 4·5 min read
Government Rails Site Hit Hours After CVE Patch
TL;DR
A severe remote code execution vulnerability in ActiveStorage for Ruby on Rails 8 was patched on July 29, 2026, after its CVSS score surged to 9.5/10. Rietta executed an emergency hotfix for clients, including HIPAA-covered entities and state agencies, to mitigate the risk of data breaches.
✦ Why It Matters
Ensure your Ruby on Rails applications are updated to mitigate critical vulnerabilities like CVE-2026-66066.
Key Takeaways
- Treat all security releases as urgent, even without a CVSS score.
- Patch vulnerabilities within hours and establish emergency approval processes.
- Run nightly security scans using tools like bundler-audit and Brakeman.
- Implement strict validation for user-uploaded files to mitigate risks.
Full Summary
On July 29, 2026, a severe vulnerability, dubbed KindaRails2Shell (CVE-2026-66066), was discovered in ActiveStorage, a component of Ruby on Rails 8 and newer. Rietta executed an emergency hotfix across its client base, which includes HIPAA-covered entities and state agencies, after the vulnerability's CVSS score escalated to 9.5/10, indicating an urgent need for patching.
Despite the patch being deployed late on July 29, attackers attempted exploitation just hours later, highlighting the rapid pace at which vulnerabilities can be exploited. A public proof-of-concept exploit was released on GitHub the same day, allowing attackers to act quickly.
Rietta's proactive measures, including immediate patching and continuous monitoring, successfully thwarted the initial attack, demonstrating the importance of swift vulnerability management in protecting sensitive data.