Log output is an attack surface too. CVE-2025-55193 lets ANSI escape sequences ride into your logs and rewrite what you see in the terminal. go.fastruby.io/tth #RailsSecurity

Three of the seven CVEs here do not live in Rails at all. Two sit in net-imap, one in REXML. A Rails bump leaves every one of them open.
go.fastruby.io/g3a #RailsSecurity

Rails 6.1 stopped trusting raw SQL in order, reorder, and pluck. Need it anyway? Wrap it in `Arel.sql`. Otherwise you get ActiveRecord::UnknownAttributeReference.

go.fastruby.io/xtw #RailsSecurity

Cannot patch libvips today? Vips.block_untrusted(true) closes the Active Storage file-read hole until you can. Stopgap, not a fix.

go.fastruby.io/w0k

#RailsSecurity