Added virtual patch for CVE-2026-66066 (KindaRails2Shell)

Fastly has released a virtual patch for CVE-2026-66066, an arbitrary file-read vulnerability in Ruby on Rails Active Storage that may create a path to remote code execution. Customers can enable the rule through either the Next-Gen WAF controls or Fastly’s virtual-patch interface, with the option to begin in logging mode before blocking matching requests.

Why this is newsworthy

The key issue is time to mitigation. A Rails security update still needs to be assessed, tested, deployed, and verified across every affected application. An edge-delivered rule can reduce exposure during that window, especially for organizations with many services, slow release cycles, or an incomplete inventory of where Active Storage is in use.

This is also a useful example of what a modern WAF should provide: a targeted control tied to a specific vulnerability, rather than a generic signature with little application context. Making the rule available as a managed virtual patch gives security teams a consistent response mechanism while application owners work on the permanent correction.

A virtual patch is a compensating control, not the final fix. Teams should still identify affected Rails versions, apply the upstream remediation, and test whether the WAF rule produces false positives against legitimate upload and download flows. Starting in logging mode where risk permits, watching detections, and then moving to blocking can provide protection without treating an emergency signature as infallible.

Source: Fastly Changelog