Ruby, Rails & AI Weekly Roundup: KindaRails2Shell Under Active Attack, Ractor-Ready

This week’s roundup leads with CVE-2026-66066 (KindaRails2Shell), which went from published PoC to active exploitation on August 30: more than 50 detections within hours, around 360 by Monday, and roughly 7,100 exposed instances counted in early August. The part worth re-checking even if you already patched is that the fix is version-coupled. Vips.block_untrusted(true) only exists if libvips is 8.13 or newer and your ruby-vips binding is recent enough to call it, so an app on Rails 8.1.3.1 si...