Critical Ruby on Rails Flaw Under Active Attack — Patch Now

Security researchers have identified a critical vulnerability in Ruby on Rails, a widely used web application framework, that is now being actively targeted by attackers. Known as KindaRails2Shell, the flaw allows an attacker to read arbitrary files from a server, potentially exposing sensitive information such as configuration files, credentials, or encryption keys.

Worse, attackers can leverage the stolen secrets to escalate the attack further, ultimately achieving remote code execution — meaning they could take control of the affected system entirely. Because Ruby on Rails powers a large number of business websites, customer portals, and internal applications, any organisation using this framework should treat this as an urgent risk.

While the source does not detail specific victim numbers, active exploitation attempts have been observed, underscoring the urgency for organisations to check whether their systems are affected and apply available patches or mitigations as soon as possible.