If you patched Rails and moved on, move back. VulnCheck's honeypots caught live exploitation of CVE-2026-66066 — the Active Storage bug nicknamed KindaRails2Shell — with attackers reading environment secrets and standing up C2 within a day of the public write-ups. Worse: on a fully patched 8.1.3.1 server, their testing showed the fix blocks the libvips file read but leaves the variation-key Marshal deserialization intact, so the RCE gadget still fires given a valid signature. The traffic is real and targeted — probes hitting canaries in Singapore, Israel, and the UK from a single French IP, alongside a parallel campaign against Langflow's unauthenticated RCE (CVE-2026-0768) that harvests AWS keys and SSH access. Upgrade to Active Storage 7.2.3.2, 8.0.5.1, or 8.1.3.1 if you somehow haven't, then treat the patch as necessary but not sufficient: rotate secret_key_base and your master key, and watch for Marshal payloads in variation keys until a fuller fix ships.