Ruby on Rails releases security patches for critical Active Storage vulnerability

…Storage image processing and accept image uploads from untrusted users. VulnCheck said it recorded more than 50 detections within a few hours on August 30, 2026, a figure that has since risen to 360 as of Monday. " Adversaries appear to be conducting a mix of reconnaissance and credential harvesting activities: Among other things, attacker requests are querying environment variables (LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, AWS_SECRET*), reading /root/.cache/langflow/secret_key, and checking .ssh access and .bash_history size ," Caitlin Condon, vice president of threat research at VulnCheck, said. "Source traffic primarily originates from Russia and has thus far exclusively hit Canaries in the U.K." The exploitation comes as threat actors…

…Israel, and the U.K. In a post shared on LinkedIn, security researcher Patrick Garrity said the activity originates from a single IP address in France and establishes command-and-control (C2) to a host in Israel. " Active Storage always enables the libvips loaders that are unsafe for untrusted content, so any app that renders image-upload variants with the default vips processor can be coerced into loading a malicious upload ," VulnCheck added. "Notably, we tested a patched 8.1.3.1 server and found that while the fix blocks the libvips file read, it does not neutralize the variation-key Marshal deserialization: the RCE gadget still executes…