UPDATE — CVE-2026-66066 (Rails Active Storage) now has a public Metasploit module and a validated code-execution path that does not need a Marshal gadget

UPDATE · originally covered CVE-2026-66066 (Rails Active Storage) — the withheld attack chain is public four weeks early, and Rails has shipped forensic tooling to answer 'was I exploited?' (2026-08-02)

the earlier entry recorded that Rails abandoned its embargo on the Active Storage attack chain four weeks early because researchers had already reconstructed it, and shipped forensic tooling so operators could determine whether they had been exploited. The delta is that the chain is now automated and packaged, and that the code-execution half has been validated more broadly than the original disclosure showed (Rapid7, 2026-08-03).

Rapid7 states it "reproduced the published chain against Rails 6.0.6.1, 6.1.7.10, 7.2.3.1, 8.0.5, and 8.1.3, and confirmed that patched 7.2.3.2, 8.0.5.1, and 8.1.3.1 targets block the crafted representation" — which is a useful independent confirmation that the vendor's fixed versions actually close it. Its Metasploit module "creates crafted direct-upload blobs, confirms the file read against /proc/version, recovers and validates Rails signing material, signs an ImageProcessing variation, and triggers either send/spawn for command payloads or send/eval for native Ruby payloads." The mechanically important finding for anyone who assumed a safer serializer contained this: "This RCE path does not depend on a Marshal object gadget. We validated it against Rails 8.0.5 configured with config.active_support.message_serializer = :json." Applications that moved off Marshal serialization are not insulated.

One correction is worth stating plainly, because it would be easy to record this as an exploitation-status change and it is not one. Rapid7's emergent-threat tracker says "As of July 30, 2026, Rapid7 is not aware of exploitation in the wild", and neither of its posts claims observed scanning, honeypot activity or intrusions (Rapid7, 2026-07-30). What changed is the cost of exploitation, not evidence of it: the chain went from reconstructable-by-a-researcher to a module anyone can run, against a flaw that needs no authentication and no user interaction.

Detection, telemetry class first. Application and web access logs carry the sequence: a direct-upload blob creation followed within the same session by a variant or representation request for that same blob, where the declared content type claims an image. The file-read primitive surfaces as image processing reaching paths that are not user content — a request whose rendered output derives from a system path rather than an uploaded asset is the anomaly, and Rapid7's own proof-of-concept methodology uses exactly such a read as its confirmation step. Triage: ordinary Rails applications create blobs and request variants constantly, so neither event is meaningful alone; the discriminator is a variant request whose processing touches a path outside the application's own storage tree, and the tight upload-then-immediately-transform pairing within one session.