TechJul 30, 2026updated14 minCVE-2026-66066 hits Rails apps that never generate a single thumbnail15 formats renamed to .png, then Rails 8.1.3 vs 8.1.3.1 on one attachment: SVG logged 123x45 on the vulnerable build, nothing on the patched one. Plus the matload entry point and the libvips 8.13 floor that stops boot.SecurityCVERCERailsRubyVulnerabilityExperiment
