CVE-2026-66066 is a critical vulnerability in the Rails Active Storage framework. It is exploitable when the libvips image processing library is used for generating thumbnails from uploaded media. An unauthenticated attacker can upload a specially crafted image to a vulnerable Rails application where image uploads from untrusted users are allowed. This allows the attacker to read arbitrary files on the server, including the process environment which typically contains 'secret_key_base' and credentials for databases, cloud storage, and other services. With 'secret_key_base' compromised, attackers can forge session cookies, sign global IDs, and manipulate serialized data, enabling full Remote Code Execution (RCE) on the underlying server. Akamai has named the attack chain 'KindaRails2Shell'. ImageMagick users are NOT affected by this vector. libvips is the default processor in official Rails Docker images and Debian/Ubuntu setups. Public proof-of-concept (PoC) exploits became available shortly after initial disclosure, prompting the Rails team to release full technical details and forensic investigation tooling ahead of schedule.