CVE-2026-66066 is being probed in the wild. Active Storage + libvips, CVSS 9.5, arbitrary file read.
Triage:
• bundle list | grep -E "activestorage|ruby-vips"
• patched: 7.2.3.2 / 8.0.5.1 / 8.1.3.1
• can’t deploy today? Vips.block_untrusted(true) in an initializer
