Attackers exploit critical Rails flaw as patch leaves RCE gap open

A critical remote code execution vulnerability in Ruby on Rails actively exploited targets applications using libvips for Active Storage image processing with untrusted user uploads. The initial patch blocks the main file-read exploit but leaves a secondary deserialization path open, enabling remote code execution if attackers have a valid signature.

This Wire brief sits within Fusion42's coverage of Enterprise Software.