Government Rails Site Hit Hours After CVE Patch

A critical remote code execution vulnerability (CVE-2026-66066) in Ruby on Rails 8 was patched by Rietta across their entire client base within hours of discovery on July 29, 2026, after the CVSS severity score climbed to 9.5/10. The vulnerability affected government agencies and HIPAA-covered entities running custom Rails applications, requiring emergency patching to prevent imminent compromise. The technical embargo intended to withhold exploitation details until August 28 proved ineffective, as detailed disclosure information was published the next day.