This week’s roundup leads with CVE-2026-66066 (KindaRails2Shell), which went from published PoC to active exploitation on August 30: more than 50 detections within hours, around 360 by Monday, and roughly 7,100 exposed instances counted in early August. The part worth re-checking even if you already patched is that the fix is version-coupled. Vips.block_untrusted(true) only exists if libvips is 8.13 or newer and your ruby-vips binding is recent enough to call it, so an app on Rails 8.1.3.1 sitting on an old libvips reports itself as patched while staying fully exploitable. And because the chain reads SECRET_KEY_BASE before escalating to RCE, patching does not undo a read that already happened.

Also covered: Rails making controller settings, Action View config, Active Record commit callbacks and timezones Ractor-shareable; ZJIT learning to inline the GC allocation fastpath (1.77x on an allocation-heavy benchmark, 117.2ms down to 66.4ms on 10M hash allocations); the Agents on Rails update where GLM 5.3 Flash cleared 83% of the suite for $3.31 total; Sam Ruby measuring Campfire-on-Spinel honestly and finding deployed Rails still about 6x faster on the page that matters; and the OpenAI wiki incident, which underneath the AI framing is a story about a CGI app that accepted writes over GET.

Read the full roundup