Ruby Daily: RubyLLM 2.0 hits RC, Active Storage exploited in the wild, Rails goes Rac

I’ve started a daily roundup of the Ruby, Rails and AI world over at RubyInsights, and today had more than usual to cover. ruby_llm 2.0.0.rc1 hit RubyGems, the first RC of the rewrite that splits providers from protocols and makes the Responses API the OpenAI default. More urgently, CVE-2026-66066 in Active Storage (CVSS 9.5, arbitrary file read via libvips) is now being exploited in the wild , so if you accept image uploads: patch to 7.2.3.2 / 8.0.5.1 / 8.1.3.1, and rotate secret_key_base an...