Government Rails Site Hit Hours After CVE Patch

https://rietta.com/blog/ruby-on-rails-cve-exploited-hours-after-patch/

23•rietta•1h ago

Comments

dorianmariecom•27m ago

i thought cloudflare would protect against those no?

ceejayoz•25m ago

Where does it say the site used Cloudflare?

rietta•21m ago

Cloudflare or a WAF may or may not help. These can often catch and block specific bot traffic, but not every attack payload is delivered naively. It would be part of a defense in depth. Having the underlying vulnerability fixed is critically important. For those on AWS, WAF & Shield is also very useful but at the end of the day these let legitimate traffic through, such as legitimately uploading a file that only in its contents is malformed.

comrade1234•25m ago

Do you have to have matlab running on your rails server for this to happen?

rietta•21m ago

I am not sure, but my read on the original disclosure is no. libvips itself has a variant processor for matlab v5 files, which the exploit took advantage of.

kawsper•10m ago

libvips also have a block_untrusted mode where it will block unsafe loaders, .mat seems to be marked as untrusted:

    vips -l
    VipsForeignLoadMat (matload), load mat from file (.mat), priority=0, untrusted, is_a, get_flags, get_flags_filename, header, load

rietta•6m ago

Correct, which is how the ActiveStorage gem was patched. After this, Rails raises a Vips::Error: VipsForeignLoad exception on an attempted variant render of a malicious file. I plan on writing a technical detail post soon with some more code level details and "indicators of compromise" but this one was getting long. This is more for management to understand why wait to patch is a major issue. The discovery to active exploit attempt timeline is the story here.

bradly•9m ago

Not running, but supported. You can check your app with:

    bin/rails runner '
      require "vips"
      puts "ruby-vips #{Vips::VERSION}  libvips #{Vips.version(0)}.#{Vips.version(1)}.#{Vips.version(2)}"
      begin
        Vips::Operation.new("matload")
        puts "matload PRESENT - this build can reach libmatio"
      rescue Vips::Error
        puts "matload ABSENT - this build cannot reach libmatio"
      end
    '

This is from the Rails official docs for the CVE which they released as an agent skill. https://github.com/rails/rails-forensics-CVE-2026-66066/blob...

Formalizing Fermat's Last Theorem

Discovery of a new OpenAI agent message board

Shutting down our public encrypted DNS

Show HN: Open-Source eInk Bike Computer

Government Rails Site Hit Hours After CVE Patch

Can AI design circuit boards yet?

The Rust React Compiler is now native in Vite

IBM Bob

Solving the Jane Street reverse engineering challenge

deSEC – Free Secure DNS

Project HydraFusion: Frontier quality via multi-model orchestration

Adult Film Producer Unmasks Prolific 'John DOE' Torrent Pirate as Meta Executive

Show HN: TERMy – A fast terminal assistant that does not use LLMs

Nobody Is Saying Why OpenAI and Anthropic Had Outages

Resources to Get Good at Soldering?

The Two Abstractions of System Design: Hide or Reduce

Elevator of the Year Winner Modernization of the Metropolis Trust Building

People that worked on the same idea for decades

Getting Started with AT Protocol

Arrested for a Late Manuscript: Seicho Matsumoto's 'Tokyo Express'

Qwen 3.8 27B available on Cerebras at 1500 tokens/s

SubImage (YC W25) Is Hiring a Founding Engineer in SF

GPT-6 Astra

Google AI Mode shows same products 21.6% more expensive than traditional search

Restoring 5 GHz Wi-Fi on an LG C5 by changing its webOS region

The largest electric aircraft just flew [video]

Georgi Gerganov on llama.cpp/ggml future after Nvidia acquisition of HuggingFace

A Switch-Level Simulation Model for Integrated Logic Circuits (1981) [pdf]

How Fairphone built the Fairphone Gen 6+

Artificial beaver dams saw juvenile coho salmon survival rates go from 8% to 60%

Formalizing Fermat's Last Theorem

Discovery of a new OpenAI agent message board

Shutting down our public encrypted DNS

Show HN: Open-Source eInk Bike Computer

Government Rails Site Hit Hours After CVE Patch

Can AI design circuit boards yet?

The Rust React Compiler is now native in Vite

IBM Bob

Solving the Jane Street reverse engineering challenge

deSEC – Free Secure DNS

Project HydraFusion: Frontier quality via multi-model orchestration

Adult Film Producer Unmasks Prolific 'John DOE' Torrent Pirate as Meta Executive

Show HN: TERMy – A fast terminal assistant that does not use LLMs

Nobody Is Saying Why OpenAI and Anthropic Had Outages

Resources to Get Good at Soldering?

The Two Abstractions of System Design: Hide or Reduce

Elevator of the Year Winner Modernization of the Metropolis Trust Building

People that worked on the same idea for decades

Getting Started with AT Protocol

Arrested for a Late Manuscript: Seicho Matsumoto's 'Tokyo Express'

Qwen 3.8 27B available on Cerebras at 1500 tokens/s

SubImage (YC W25) Is Hiring a Founding Engineer in SF

GPT-6 Astra

Google AI Mode shows same products 21.6% more expensive than traditional search

Restoring 5 GHz Wi-Fi on an LG C5 by changing its webOS region

The largest electric aircraft just flew [video]

Georgi Gerganov on llama.cpp/ggml future after Nvidia acquisition of HuggingFace

A Switch-Level Simulation Model for Integrated Logic Circuits (1981) [pdf]

How Fairphone built the Fairphone Gen 6+

Artificial beaver dams saw juvenile coho salmon survival rates go from 8% to 60%

Government Rails Site Hit Hours After CVE Patch

Comments