Provenance Record

Well-structured News piece (859 words, within the 400-1200 range for the category) using the Overview / What We Know / Remediation / What We Don't Know format. Technical content (libvips 'unfuzzed' operations, the two-condition exposure test, CVSS v4 vector, remediation steps including the VIPS_BLOCK_UNTRUSTED stopgap) is accurately and neutrally summarized with no sensationalism beyond what the sources themselves convey (both the GHSA and Akamai independently rate it CVSS 9.5/Critical).

Read all 4 source snapshots from sources/2026-08/rails-patches-critical-active-storage-flaw-that-lets-unauthenticated-attackers-read-secrets-and-escalate-to-rce/, independently re-hashed with sha256sum -- all 4 match manifest.json exactly (source-0: c691ba10..., source-1: c05250f1..., source-2: 1f33f20d..., source-3: 3865cb34...). source-1 (GitHub Security Advisory GHSA-xr9x-r78c-5hrm, decompressed and read in full) verbatim-confirms: CVE ID 'CVE-2026-66066'; CVSS score '9.5' Critical; the full CVSS v4 vector 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'; CWE-1188 'Initialization of a Resource with an Insecure Default'; affected version ranges (<7.2.3.2, >=8.0 <8.0.5.1, >=8.1 <8.1.3.1); the 'unfuzzed' libvips operations mechanism; the load_defaults 7.0 default-processor claim; the VIPS_BLOCK_UNTRUSTED / Vips.block_untrusted(true) / ruby-vips 2.2.1 remediation details; published by byroot on Jul 29, 2026; disclosure held until 2026-08-28 via the Rails Security Announcements forum; and the Credit list ('0xacb, s3np41k1r1t0 and castilho from Ethiack, and RyotaK from GMO Flatt Security Inc.'). source-2 (Akamai blog, decompressed and read in full) verbatim-confirms both direct quotes used in the article ('With the secret_key_base compromised, the attacker holds the master cryptographic key to the application... directly translates into full RCE on the underlying server' and 'the secret_key_base, cloud storage credentials, and database passwords'), the CVSS 9.5 rating, the 'KindaRails2Shell' name in Akamai's own headline, the Jul 29 2026 WAF rule deployment date, the exact rule name '3000989 v1 — Rails2Shell Exploit Attempt Detected (CVE-2026-66066)', and the stated coordination with Ethiack. source-3 (Ethiack, decompressed and read in full) verbatim-confirms the 'we found a rails2shell… kinda' quote, the 'assume attackers with AI tooling can reconstruct one quickly once patches ship and diffs go public' quote, and the discoverer attribution (Andre Baptista/0xacb, Bruno Mendes/S3np41k1r1t0, Rafael Castilho/Castilho of Ethiack; RyotaK of GMO Flatt Security reported independently a few days later) -- this cross-checks exactly against the GHSA Credit list's aliases.

All four sources read in full; every specific fact (CVE number, CVSS score and vector, CWE, affected version ranges, exploit mechanism, remediation steps, vulnerability name, discoverer attribution, and every direct quote) verified character-for-character or verbatim against source content -- either the on-disk canonical snapshot or, for the one snapshot that was captured incomplete, a live fallback fetch of the same URL. No fabrication, no misattribution, no orphan sources, and originality confirmed. Approved without corrections; the allowlist gap for two credible domains is a maintenance item, not a public-facing error.