Ruby, Rails & AI Weekly Roundup: KindaRails2Shell Under Active Attack, Ractor-Ready

This week’s roundup leads with CVE-2026-66066 (KindaRails2Shell), which went from published PoC to active exploitation on August 30: more than 50 detections within hours, around 360 by Monday, and roughly 7,100 exposed instances counted in early August. The part worth re-checking even if you already patched is that the fix is version-coupled. Vips.block_untrusted(true) only exists if libvips is 8.13 or newer and your ruby-vips binding is recent enough to call it, so an app on Rails 8.1.3.1 sitting on an old libvips reports itself as patched while staying fully exploitable. And because the chain reads SECRET_KEY_BASE before escalating to RCE, patching does not undo a read that already happened. [more inside]

Video: Glimmer DSL for Web 0.10.4 Insert Mutation

Release video for Glimmer DSL for Web (Award-Winning Frontend Framework for Ruby on Rails) 0.10.4 Insert Mutation.

Use OpenAI models in Claude Code

Created the connector between 2 agents that allows using 2 subscriptions See

What Actually Happens When You Call perform_later

A source-backed trace of how perform_later constructs an Active Job, hands it to a queue adapter, stores backend work, and reaches a worker. It also shows why an enqueued job may never begin. [more inside]

Still way beyond cool: resurrecting the Doomguy TDD loop

Psych has new libfyaml bindings - how much better are they?

I did a writeup on Psych’s libyaml bindings vs the brand new libfyaml bindings: [more inside]

Testing mailers in Rails

Chapter 14 of the Minitest Rails guide is out now. Learn how to test mailers with Minitest Rails: [more inside]

Ruby Users Forum - Monthly Update - August 2026

Testing Rails from Scratch book now includes integration testing

Hello, I’ve released two new chapters to my work-in-progress book Testing Rails from Scratch! The highlights this time are two new chapters on integration testing, along with several revisions to the test data chapters.

PostnHost - Open source Multilingual Rails CMS

It comes both as a self-hosted Rails app and as a drop-in Rails Engine, with multilingual content, structured data, version control, and a rich editor. [more inside]

SolidQueue batches: evolution and architecture

The SolidQueue batches 2.5 year architectural journey, filled with O(n^2) algorithms, hot row contention, excessive jobs, and much in between [more inside]

Video: Glimmer DSL for Web 0.10.3 Append & Prepend Mutations

Release video for Glimmer DSL for Web (Award-Winning Frontend Framework for Ruby on Rails) 0.10.2 & 0.10.3 Append & Prepend Mutations

The Race Your Rails Validation Cannot Prevent

A source-backed explanation of why two Rails uniqueness validations can pass concurrently, how a composite unique index arbitrates the inserts, and how Active Record exposes the losing write. [more inside]

typst-rails: use Typst for PDF production in Rails

Just released typst-rails, a PDF templating solution for Rage and Rails apps: [more inside]

I Tested Rails Baseline by Leaving Architecture Out of the Prompt

What two fresh coding-agent sessions revealed about an agent-friendly Rails starter. [more inside]

llm.rb v15.1.0 released

llm.rb is an advanced runtime for building agentic AI applications on CRuby. It has zero runtime dependencies by default, supports concurrent and parallel tool execution and has a single coherent API that spans 14+ providers.

When Should You Raise an Exception in Ruby?

How to decide between raising an exception and returning a value in Ruby by separating expected outcomes from failures that break a method’s contract. [more inside]

llm_cost_tracker v0.14.0: per-tag LLM budgets and a batch of cost-accuracy fixes

llm_cost_tracker is a Rails engine that records what your app spends on LLM APIs - per call, per model, per tag - into your own database, with a mounted dashboard. [more inside]

How I found two command injections in the spatial_features Ruby gem

While using the spatial_features Ruby gem for a side project, I noticed that filenames were being passed to system. It led me to two command injection paths, fixed in version 3.11.2. Here’s how I found them, built the PoC, and reported the issue:

How to Test User Registration with Minitest Rails

Rails 8’s bin/rails generate authentication gives you sign-in, sign-out, and password reset but it does not give you a way to register new users to the app. In this post you will add the registration feature and test it with Minitest: [more inside]

RailsDocks - Rails hosting the way it should be

I built RailsDocks because deploying a Rails application shouldn’t require becoming a part-time infrastructure engineer. [more inside]

Rails Baseline 1.0: A Rails SaaS Starter Built for Coding Agents

I shipped Rails Baseline 1.0 today. [more inside]

Install rv as a mise tool

If you’re already using mise and would like to try rv, you can install it by following this guide:

ActiveRecord with update_all/delete_all with returning option

- this could be useful to know what actual records were updated/deleted. A small utility gem to solve this problem.

Access control for AI agents on Rails: gating SQL with Action Policy

An AI assistant with read-only SQL is a superhero. Until it fails privacy responsibilities and leaks sensitive data to everyone. We noted this possibility in an internal tool, moved the data boundary from prompt to Action Policy, and kept open-ended SQL: Access control for AI agents on Rails: gating SQL with Action Policy