Ruby, Rails & AI Daily: Active Storage RCE Under Active Exploitation, ZJIT Inlines GC

Kicking off a daily roundup on RubyInsights covering Ruby, Rails, and AI. Today’s edition leads with CVE-2026-66066 (“KindaRails2Shell”), the Active Storage RCE that’s now confirmed under active exploitation months after patches shipped for Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1, worth a fleet check even if you patched back in July. Also covered: ZJIT learning to inline GC allocations, this week’s Rails codebase updates, Claude Fable 5.1 topping the Agents on Rails benchmark, Chrome 153’s 230 security fixes, and the new wave of cybersecurity-focused models from OpenAI, Anthropic, and Google. Full roundup with sources.

Your Webhook Endpoint Is a Tiny Distributed System

A simple bit of webhook consumption is sometimes not that simple: [more inside]

Ruby Daily: RubyLLM 2.0 hits RC, Active Storage exploited in the wild, Rails goes Rac

I’ve started a daily roundup of the Ruby, Rails and AI world over at RubyInsights, and today had more than usual to cover. ruby_llm 2.0.0.rc1 hit RubyGems, the first RC of the rewrite that splits providers from protocols and makes the Responses API the OpenAI default. More urgently, CVE-2026-66066 in Active Storage (CVSS 9.5, arbitrary file read via libvips) is now being exploited in the wild, so if you accept image uploads: patch to 7.2.3.2 / 8.0.5.1 / 8.1.3.1, and rotate secret_key_base and your storage credentials, because the patch does not un-leak what was already read. On the happier side, the September 4 This Week in Rails is almost entirely Ractor-safety merges, and ZJIT now inlines the GC allocation fastpath for about 1.77x on hash allocation. [more inside]

time to run some maintenance tasks

- a new gem, inspired by the limitations of Shopify/maintenance_tasks gem. [more inside]

Ruby, Rails & AI Weekly Roundup: KindaRails2Shell Under Active Attack, Ractor-Ready

This week’s roundup leads with CVE-2026-66066 (KindaRails2Shell), which went from published PoC to active exploitation on August 30: more than 50 detections within hours, around 360 by Monday, and roughly 7,100 exposed instances counted in early August. The part worth re-checking even if you already patched is that the fix is version-coupled. Vips.block_untrusted(true) only exists if libvips is 8.13 or newer and your ruby-vips binding is recent enough to call it, so an app on Rails 8.1.3.1 sitting on an old libvips reports itself as patched while staying fully exploitable. And because the chain reads SECRET_KEY_BASE before escalating to RCE, patching does not undo a read that already happened. [more inside]

Video: Glimmer DSL for Web 0.10.4 Insert Mutation

Release video for Glimmer DSL for Web (Award-Winning Frontend Framework for Ruby on Rails) 0.10.4 Insert Mutation.

Use OpenAI models in Claude Code

Created the connector between 2 agents that allows using 2 subscriptions See

What Actually Happens When You Call perform_later

A source-backed trace of how perform_later constructs an Active Job, hands it to a queue adapter, stores backend work, and reaches a worker. It also shows why an enqueued job may never begin. [more inside]

Still way beyond cool: resurrecting the Doomguy TDD loop

Psych has new libfyaml bindings - how much better are they?

I did a writeup on Psych’s libyaml bindings vs the brand new libfyaml bindings: [more inside]

Testing mailers in Rails

Chapter 14 of the Minitest Rails guide is out now. Learn how to test mailers with Minitest Rails: [more inside]

Ruby Users Forum - Monthly Update - August 2026

Testing Rails from Scratch book now includes integration testing

Hello, I’ve released two new chapters to my work-in-progress book Testing Rails from Scratch! The highlights this time are two new chapters on integration testing, along with several revisions to the test data chapters.

PostnHost - Open source Multilingual Rails CMS

It comes both as a self-hosted Rails app and as a drop-in Rails Engine, with multilingual content, structured data, version control, and a rich editor. [more inside]

SolidQueue batches: evolution and architecture

The SolidQueue batches 2.5 year architectural journey, filled with O(n^2) algorithms, hot row contention, excessive jobs, and much in between [more inside]

Video: Glimmer DSL for Web 0.10.3 Append & Prepend Mutations

Release video for Glimmer DSL for Web (Award-Winning Frontend Framework for Ruby on Rails) 0.10.2 & 0.10.3 Append & Prepend Mutations

The Race Your Rails Validation Cannot Prevent

A source-backed explanation of why two Rails uniqueness validations can pass concurrently, how a composite unique index arbitrates the inserts, and how Active Record exposes the losing write. [more inside]

typst-rails: use Typst for PDF production in Rails

Just released typst-rails, a PDF templating solution for Rage and Rails apps: [more inside]

I Tested Rails Baseline by Leaving Architecture Out of the Prompt

What two fresh coding-agent sessions revealed about an agent-friendly Rails starter. [more inside]

llm.rb v15.1.0 released

llm.rb is an advanced runtime for building agentic AI applications on CRuby. It has zero runtime dependencies by default, supports concurrent and parallel tool execution and has a single coherent API that spans 14+ providers.

When Should You Raise an Exception in Ruby?

How to decide between raising an exception and returning a value in Ruby by separating expected outcomes from failures that break a method’s contract. [more inside]

llm_cost_tracker v0.14.0: per-tag LLM budgets and a batch of cost-accuracy fixes

llm_cost_tracker is a Rails engine that records what your app spends on LLM APIs - per call, per model, per tag - into your own database, with a mounted dashboard. [more inside]

How I found two command injections in the spatial_features Ruby gem

While using the spatial_features Ruby gem for a side project, I noticed that filenames were being passed to system. It led me to two command injection paths, fixed in version 3.11.2. Here’s how I found them, built the PoC, and reported the issue:

How to Test User Registration with Minitest Rails

Rails 8’s bin/rails generate authentication gives you sign-in, sign-out, and password reset but it does not give you a way to register new users to the app. In this post you will add the registration feature and test it with Minitest: [more inside]

RailsDocks - Rails hosting the way it should be

I built RailsDocks because deploying a Rails application shouldn’t require becoming a part-time infrastructure engineer. [more inside]