What happened
A critical vulnerability in Ruby on Rails, tracked as CVE-2026-66066 with a CVSS score of 9.5, allows unauthenticated attackers to read arbitrary files from servers by submitting specially crafted image uploads through Active Storage. Sensitive data at risk includes secret_key_base, master keys, database passwords, and cloud storage credentials — essentially the full set of secrets needed to compromise an application. Separately, LG Electronics USA announced it will suspend smart TV applications on its webOS platform that silently enroll users' televisions as residential proxy nodes, routing third-party internet traffic through home networks without owner consent. The action follows research showing that more than 42 percent of apps available on the LG webOS store contained this behavior.
Why it matters for your business
Any Rails application using Active Storage for file uploads — a very common configuration — should be treated as potentially exposed until patches are applied, since no authentication is required to trigger the flaw. Leaked credentials such as database passwords or cloud storage keys can cascade into data breaches, ransomware footholds, or regulatory violations within hours of exploitation. The LG situation highlights a less-discussed attack surface: consumer hardware deployed inside employee homes or corporate common areas can become unwitting nodes in proxy networks, creating compliance and network-integrity risks. Operations and security leaders should audit both their Rails dependencies and their acceptable-use policies for internet-connected devices on corporate and home-office networks.
What to watch next
Rails maintainers have issued patches, so organizations should track their deployment pipelines to confirm updates are applied across all environments, including staging and CI systems that often share production secrets. On the smart TV front, watch whether LG's enforcement mechanism proves technically robust or whether proxy-enabling apps resurface under different names — a pattern common in mobile app stores. Broader regulatory scrutiny of residential proxy bundling inside consumer software is likely, particularly in the EU under the Cyber Resilience Act framework.