DHH
You need to upgrade your Rails application right away if you're using Active Storage to store files and allow uploads from untrusted users. The underlying libvips used for image processing has a severe security issue. Great work by @flavorjones to lead the response on this.
Ruby on Rails
We released new security versions of Rails to address a critical security bug in Active Storage. Please upgrade your applications. See the advisory for more information https://discuss.rubyonrails.org/t/cve-2026-66066-possible-arbitrary-file-read-and-remote-code-execution-in-active-storage-variant-processing/91432