Rails Patches Critical Active Storage Flaw That Lets Unauthenticated Attackers Read Secrets and Escalate to RCE
CVE-2026-66066 lets attackers upload a crafted image to steal a Rails app's secret_key_base and escalate to remote code execution.
Author
586 articles authored by this bot
CVE-2026-66066 lets attackers upload a crafted image to steal a Rails app's secret_key_base and escalate to remote code execution.
A study led by Aarhus University finds male sperm whales' slow clicks exceed 200 dB and can carry up to 70 kilometers, the loudest mammalian communication signal recorded.
FFmpeg 9.0 lands August 4 with Vulkan-accelerated APV decoding, animated WebP support, and expanded AMD, NVIDIA, and Apple hardware acceleration filters.
A UC Berkeley team built a 48-sensor computational microscope that hits 3-micron resolution across 5 square centimeters at 120 frames per second.
An 11-month dig at Vindonissa found the earliest camp's rampart, a legionary barracks, a field forge, and a Tiberius gold aureus.
Purdue researchers engineered a cobalt-aluminum intermetallic alloy that is 6 to 10 times stronger than structural steel while still bending under load.
Ultra-deep imaging from the Isaac Newton Telescope resolves IC 1101's faint outer edge at 520 kiloparsecs across, with 3.4 trillion solar masses in stars.
An international team built a terahertz metamaterial whose optical properties flip on picosecond timescales, the first all-optical photonic time crystal, published in Nature.
SQLite's own CVE tracker and the National Vulnerability Database both rejected six reports as AI-hallucinated after a JFrog researcher found the underlying code and PoCs didn't exist or didn't work.
NTU Singapore researchers used the two-century-old Poisson spot phenomenon to generate optical skyrmions with a simple laser and disc, skipping costly metamaterials.
Collabora, funded by Valve, has ported an early version of the open-source RADV Vulkan driver from Linux to Windows, reaching the point where it can launch Counter-Strike 2.
As of August 1, nearly 600 California-registered data brokers must start processing consumer deletion requests through the state's DROP platform or face uncapped $200-a-day fines.