CVE-2026-66066 Exploitation Starts One Month After Patch, RCE Persists on Updated Rails 8.1.3.1

The flaw stems from type confusion between Rails content-type handling and libvips magic-byte inspection. An attacker uploads a crafted MATLAB Level 5 file that libmatio routes to HDF5, whose External File List directive pulls arbitrary server files such as credential stores. This grants session forgery and lateral movement before any code execution. Roughly 7,000 exposed instances were enumerated in early August. VulnCheck testing showed the July patch blocks the libvips read primitive yet leaves the variation-key deserialization gadget intact when a valid signature is supplied. Original coverage understated this residual attack surface. Businesses running Rails with Active Storage and public image endpoints face direct exposure of database keys and storage credentials, enabling both data theft and subsequent RCE against customer-facing applications. Procurement records and job postings at affected organizations indicate many still rely on default libvips configurations without additional sandboxing. Individuals using Rails-based SaaS tools inherit the same risk through shared infrastructure. Full mitigation requires disabling untrusted uploads or moving to isolated processing pipelines rather than depending on the current partial fix. Continued scanning and PoC refinement are expected; operators should monitor Rails forensic tooling logs for HDF5 External File List patterns and rotate all secrets immediately.