Zero-Day to Zero Doubt: AI-Powered CVE Forensics in an Afternoon

On July 29, the Rails team released security patches for CVE-2026-66066 — an arbitrary file read (and potential RCE) through Active Storage, internally dubbed KindaRails2Shell . Found independently by researchers at Ethiack (0xacb, s3np41k1r1t0, castilho) and GMO Flatt Security (RyotaK), it&rsquo;s the kind of vulnerability that makes you pause.