--- title: Issue #811: You need to upgrade Rails 7.x and 8.x now —... description: Ruby Weekly issue #811 leads with an urgent security advisory to upgrade Rails 7.x and 8.x due to a critical RCE vulnerability dubbed KindaRails2Shell... canonical: https://daily.dev/posts/issue-811-you-need-to-upgrade-rails-7-x-and-8-x-now-ruby-weekly-37nw6gntz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Issue #811: You need to upgrade Rails 7.x and 8.x now — Ruby Weekly | daily.dev og:description: Ruby Weekly issue #811 leads with an urgent security advisory to upgrade Rails 7.x and 8.x due to a critical RCE vulnerability dubbed KindaRails2Shell... og:url: https://daily.dev/posts/issue-811-you-need-to-upgrade-rails-7-x-and-8-x-now-ruby-weekly-37nw6gntz og:image: https://api.daily.dev/og/posts/37nW6gNtZ.png og:image:alt: Issue #811: You need to upgrade Rails 7.x and 8.x now — Ruby Weekly og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Issue #811: You need to upgrade Rails 7.x and 8.x now — Ruby Weekly **[Ruby Weekly](https://daily.dev/sources/rbywkly)** · 2 min read · 1 upvotes · 0 comments ## Summary Ruby Weekly issue #811 leads with an urgent security advisory to upgrade Rails 7.x and 8.x due to a critical RCE vulnerability dubbed KindaRails2Shell (CVE-2026-66066). Other highlights include ZJIT's new inlining capabilities delivering up to 35x microbenchmark speedups for block-heavy Ruby code, a code-golfing story using GPT to shrink a Roman numeral generator from 250 to 90 bytes, a 60% heap size reduction discovered through agent-assisted debugging, and the release of Courrier 1.0 for multi-provider email sending. Notable releases include Solid Queue 1.5, RBS 4.1 with JRuby support, RMagick 7.1, SimpleCov 1.0.3, and the official MCP Ruby SDK 1.0. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why do I need to upgrade Rails 7.x or 8.x right now? A critical remote code execution vulnerability, tracked as CVE-2026-66066 and nicknamed KindaRails2Shell, affects both Rails 7.x and 8.x. Upgrading is urgent. If Bundler's cooldown protection feature is enabled, the fixed gem version may be blocked from installing, so running bundle update rails --cooldown 0 may be necessary to force the update through immediately. _Rails maintainers tracking urgent security patches can follow CVE disclosures like this one on daily.dev._ ### How does bundle update with the cooldown flag work when a security patch needs to go out immediately? Running bundle update rails --cooldown 0 overrides Bundler's cooldown protection, which normally delays adoption of newly released gem versions to let them get vetted before use. Setting the cooldown to 0 forces Bundler to install the newly released, patched version right away instead of waiting out the vetting period, which matters when a fix addresses an active vulnerability like KindaRails2Shell. _Ruby developers managing dependency upgrades under time pressure can track Bundler workflow changes on daily.dev._ ## Similar posts on daily.dev - [Ruby & Rails Weekly: KindaRails2Shell Exploited, Ractor Rails](https://daily.dev/posts/ruby-rails-weekly-kindarails2shell-exploited-ractor-rails-70dte5arg) · Ruby Flow · 3 upvotes · 0 comments - [Issue \#814: Bringing Rails into the Ractor age — Ruby Weekly](https://daily.dev/posts/issue-814-bringing-rails-into-the-ractor-age-ruby-weekly-vch5zguhp) · Ruby Weekly · 0 upvotes · 0 comments - [Short Ruby Newsletter - edition 162](https://daily.dev/posts/short-ruby-newsletter---edition-162-xngdavw9r) · RUBYLAND · 0 upvotes · 0 comments - [Ruby, Rails & AI Daily — September 10, 2026" description: "A critical Active Storage RCE is now under active exploitation, ZJIT learns to inline GC allocations, and Google, Anthropic, and OpenAI all s](https://daily.dev/posts/ruby-rails-ai-daily-september-10-2026-description-a-critical-active-storage-rce-is-now-unde-xetkjqgtn) · Ruby Flow · 2 upvotes · 0 comments - [Rails Versions 7.2.3.1, 8.0.4.1, and 8.1.2.1 have been released\!](https://daily.dev/posts/rails-versions-7-2-3-1-8-0-4-1-and-8-1-2-1-have-been-released--swfvkc3sb) · Rails · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ruby](https://daily.dev/tags/ruby), [#rails](https://daily.dev/tags/rails) [View this post on daily.dev](https://daily.dev/posts/issue-811-you-need-to-upgrade-rails-7-x-and-8-x-now-ruby-weekly-37nw6gntz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Issue #811: You need to upgrade Rails 7.x and 8.x now — Ruby Weekly","url":"https://daily.dev/posts/issue-811-you-need-to-upgrade-rails-7-x-and-8-x-now-ruby-weekly-37nw6gntz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/issue-811-you-need-to-upgrade-rails-7-x-and-8-x-now-ruby-weekly-37nw6gntz"},"datePublished":"2026-07-30T12:28:29.458Z","dateModified":"2026-09-14T06:40:42.001Z","description":"Ruby Weekly issue #811 leads with an urgent security advisory to upgrade Rails 7.x and 8.x due to a critical RCE vulnerability dubbed KindaRails2Shell...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"Ruby Weekly","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Ruby Weekly","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3caaad8c23954502ac0e20b2189fd420","url":"https://daily.dev/sources/rbywkly"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/issue-811-you-need-to-upgrade-rails-7-x-and-8-x-now-ruby-weekly-37nw6gntz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ruby,rails","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Ruby Weekly","item":"https://daily.dev/sources/rbywkly"},{"@type":"ListItem","position":3,"name":"Issue #811: You need to upgrade Rails 7.x and 8.x now — Ruby Weekly"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/issue-811-you-need-to-upgrade-rails-7-x-and-8-x-now-ruby-weekly-37nw6gntz#faq","mainEntity":[{"@type":"Question","name":"Why do I need to upgrade Rails 7.x or 8.x right now?","acceptedAnswer":{"@type":"Answer","text":"A critical remote code execution vulnerability, tracked as CVE-2026-66066 and nicknamed KindaRails2Shell, affects both Rails 7.x and 8.x. Upgrading is urgent. If Bundler's cooldown protection feature is enabled, the fixed gem version may be blocked from installing, so running bundle update rails --cooldown 0 may be necessary to force the update through immediately. Rails maintainers tracking urgent security patches can follow CVE disclosures like this one on daily.dev."}},{"@type":"Question","name":"How does bundle update with the cooldown flag work when a security patch needs to go out immediately?","acceptedAnswer":{"@type":"Answer","text":"Running bundle update rails --cooldown 0 overrides Bundler's cooldown protection, which normally delays adoption of newly released gem versions to let them get vetted before use. Setting the cooldown to 0 forces Bundler to install the newly released, patched version right away instead of waiting out the vetting period, which matters when a fix addresses an active vulnerability like KindaRails2Shell. Ruby developers managing dependency upgrades under time pressure can track Bundler workflow changes on daily.dev."}}]} ```