Rails 8.0.5.2 and 8.1.4.1 are security releases fixing 21 vulnerabilities across the framework. The most serious affect Active Storage: image analysis may permit arbitrary file reads or writes, while video previews, analysis, and image processing may enable file access or remote code execution. Other high-severity issues include a Strong Parameters bypass, denial of service through `safe_constantize`, and - in Rails 8.1 only - possible IP spoofing. The releases also address cross-site scripting in Action View helpers and serialization, and denial-of-service risks involving live streaming and Active Storage.
The remaining fixes cover Active Storage upload limits, file handling, proxy-mode information exposure, and Google Cloud Storage uploads; session restoration and cookie protections; content-negotiation cache poisoning; and Mailgun signature replay. The release announcement urges users to upgrade promptly and says older Rails versions are unsupported. Rails 8.0 security support ends November 7, 2026, so users on older versions are advised to move to at least the 8.0 series. SHA-256 checksums are provided for the gems in both releases so installations can be verified.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Brazil’s Credit Guarantee Fund (FGC) reported unauthorized access to personal data in systems used for guarantee payments, but has found no evidence of disclosure, misuse, or financial loss. It restricted access, blocked unauthorized accounts, notified Brazil’s data protection authority, and continues investigating the incident. (fgc.org.br)
Data collected through ads in popular apps gives police a way to track users’ phones. The surveillance relies on advertising technology rather than direct access to a device. (bloomberg.com)
Mark Cuban says Facebook knowingly runs scam ads featuring AI-generated deepfakes. Documents reportedly estimate the platform earns $16 billion from fraudulent ads. (finance.yahoo.com)
Claude Code allegedly sends users’ email addresses to third-party websites in the User-Agent header during web searches. The reported privacy issue prompted a request to remove the behavior entirely. (github.com)
CVE-2026-83844 is listed as a remote code execution vulnerability in MS Paint. The provided page contains no details about affected versions, exploit conditions, or fixes. (cve.org)
A remote code execution vulnerability affects Microsoft Paint. An attacker can exploit it by getting a user to open a specially crafted file in the app. (msrc.microsoft.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.