--- title: Ruby Insights Daily: RubyLLM 2.0 Hits RC, Rails Turns... description: RubyLLM 2.0.0.rc1 shipped with a rewrite that separates providers from protocols, defaults OpenAI to the Responses API, adds a provider-gem generator, and... canonical: https://daily.dev/posts/ruby-insights-daily-rubyllm-2-0-hits-rc-rails-turns-ractor-safe-and-active-storage-is-under-attac-eblsu6bgz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Ruby Insights Daily: RubyLLM 2.0 Hits RC, Rails Turns Ractor-Safe, and Active Storage Is Under Attack | daily.dev og:description: RubyLLM 2.0.0.rc1 shipped with a rewrite that separates providers from protocols, defaults OpenAI to the Responses API, adds a provider-gem generator, and... og:url: https://daily.dev/posts/ruby-insights-daily-rubyllm-2-0-hits-rc-rails-turns-ractor-safe-and-active-storage-is-under-attac-eblsu6bgz og:image: https://api.daily.dev/og/posts/eBlsU6bGZ.png og:image:alt: Ruby Insights Daily: RubyLLM 2.0 Hits RC, Rails Turns Ractor-Safe, and Active Storage Is Under Attack og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Ruby Insights Daily: RubyLLM 2.0 Hits RC, Rails Turns Ractor-Safe, and Active Storage Is Under Attack **[Ruby Flow](https://daily.dev/sources/rubyflow)** · 6 min read · 3 upvotes · 0 comments ## Summary RubyLLM 2.0.0.rc1 shipped with a rewrite that separates providers from protocols, defaults OpenAI to the Responses API, adds a provider-gem generator, and raises the provider count to 17. Separately, the critical Active Storage vulnerability CVE-2026-66066 (CVSS 9.5, nicknamed KindaRails2Shell) is now being exploited in the wild about a month after patches shipped, with roughly 7,000 exposed instances counted earlier; fixed in Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1, with Rails 6.x left unpatched. Rails also merged a batch of Ractor-safety fixes across config objects, callbacks, and time zones, ZJIT gained inlined GC allocation fastpaths showing up to 1.77x speedups, and a new Rails benchmark shows the best coding model reaching only 41% Rails API recall. A LiteLLM auth bypass (CVE-2026-59822) and Rails World 2026 dates are also noted. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-66066 in Rails Active Storage and how do I fix it? CVE-2026-66066, nicknamed KindaRails2Shell, is a CVSS 9.5 arbitrary file read vulnerability in Active Storage's Vips variant processor that can escalate to secret exposure and remote code execution, and it is now being exploited in the wild. Upgrade to Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1, ensure libvips is 8.13 or later, set VIPS_BLOCK_UNTRUSTED, and rotate secret_key_base, credentials, and storage keys. _Track exploited CVEs like Active Storage's before they hit your production stack on daily.dev._ ### What changed in RubyLLM 2.0 compared to RubyLLM 1.x? RubyLLM 2.0.0.rc1 decouples providers (OpenAI, Mistral, Vertex AI, Cohere, Ollama Cloud, ElevenLabs, Deepgram) from the wire protocols they speak (Chat Completions, Responses, Anthropic), letting one provider support multiple dialects without duplicated code. OpenAI now defaults to the Responses API for tool use with extended thinking, a provider gem generator scaffolds new integrations, and the provider count rises from 13 to 17. Minimum Ruby version is 3.1.3. _Developers weighing an LLM library upgrade can follow architecture shifts like this one on daily.dev._ ### How well do current AI coding models write idiomatic Rails code? In a benchmark running 17 models through 21 atomic Writebook tasks with three attempts each, the top performer, Claude Fable 5.1, scored 58 of 63 correct at $75 total cost, narrowly ahead of Claude Opus 5 at the same score for $120. But the best model's Rails API recall, meaning how often it reaches for framework methods versus hand-rolling logic, was only 41%, still favoring non-idiomatic code over half the time. _Teams deciding how much to trust AI coding agents on Rails can track benchmarks like this on daily.dev._ ## Similar posts on daily.dev - [Ruby & Rails Weekly: KindaRails2Shell Exploited, Ractor Rails](https://daily.dev/posts/ruby-rails-weekly-kindarails2shell-exploited-ractor-rails-70dte5arg) · Ruby Flow · 3 upvotes · 0 comments - [Ruby, Rails & AI Daily — September 10, 2026" description: "A critical Active Storage RCE is now under active exploitation, ZJIT learns to inline GC allocations, and Google, Anthropic, and OpenAI all s](https://daily.dev/posts/ruby-rails-ai-daily-september-10-2026-description-a-critical-active-storage-rce-is-now-unde-xetkjqgtn) · Ruby Flow · 2 upvotes · 0 comments - [Issue \#814: Bringing Rails into the Ractor age — Ruby Weekly](https://daily.dev/posts/issue-814-bringing-rails-into-the-ractor-age-ruby-weekly-vch5zguhp) · Ruby Weekly · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#llm](https://daily.dev/tags/llm), [#ruby](https://daily.dev/tags/ruby), [#rails](https://daily.dev/tags/rails) [View this post on daily.dev](https://daily.dev/posts/ruby-insights-daily-rubyllm-2-0-hits-rc-rails-turns-ractor-safe-and-active-storage-is-under-attac-eblsu6bgz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Ruby Insights Daily: RubyLLM 2.0 Hits RC, Rails Turns Ractor-Safe, and Active Storage Is Under Attack","url":"https://daily.dev/posts/ruby-insights-daily-rubyllm-2-0-hits-rc-rails-turns-ractor-safe-and-active-storage-is-under-attac-eblsu6bgz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ruby-insights-daily-rubyllm-2-0-hits-rc-rails-turns-ractor-safe-and-active-storage-is-under-attac-eblsu6bgz"},"datePublished":"2026-09-09T05:36:42.999Z","dateModified":"2026-09-13T20:49:43.859Z","description":"RubyLLM 2.0.0.rc1 shipped with a rewrite that separates providers from protocols, defaults OpenAI to the Responses API, adds a provider-gem generator, and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/55dd465daed6ae11e1deae1d0560b856?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/55dd465daed6ae11e1deae1d0560b856?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Ruby Flow","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Ruby Flow","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/a21aaa8bcbbf448193a016895c90a0e1","url":"https://daily.dev/sources/rubyflow"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ruby-insights-daily-rubyllm-2-0-hits-rc-rails-turns-ractor-safe-and-active-storage-is-under-attac-eblsu6bgz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,llm,ruby,rails","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Ruby Flow","item":"https://daily.dev/sources/rubyflow"},{"@type":"ListItem","position":3,"name":"Ruby Insights Daily: RubyLLM 2.0 Hits RC, Rails Turns Ractor-Safe, and Active Storage Is Under Attack"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ruby-insights-daily-rubyllm-2-0-hits-rc-rails-turns-ractor-safe-and-active-storage-is-under-attac-eblsu6bgz#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-66066 in Rails Active Storage and how do I fix it?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-66066, nicknamed KindaRails2Shell, is a CVSS 9.5 arbitrary file read vulnerability in Active Storage's Vips variant processor that can escalate to secret exposure and remote code execution, and it is now being exploited in the wild. Upgrade to Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1, ensure libvips is 8.13 or later, set VIPS_BLOCK_UNTRUSTED, and rotate secret_key_base, credentials, and storage keys. Track exploited CVEs like Active Storage's before they hit your production stack on daily.dev."}},{"@type":"Question","name":"What changed in RubyLLM 2.0 compared to RubyLLM 1.x?","acceptedAnswer":{"@type":"Answer","text":"RubyLLM 2.0.0.rc1 decouples providers (OpenAI, Mistral, Vertex AI, Cohere, Ollama Cloud, ElevenLabs, Deepgram) from the wire protocols they speak (Chat Completions, Responses, Anthropic), letting one provider support multiple dialects without duplicated code. OpenAI now defaults to the Responses API for tool use with extended thinking, a provider gem generator scaffolds new integrations, and the provider count rises from 13 to 17. Minimum Ruby version is 3.1.3. Developers weighing an LLM library upgrade can follow architecture shifts like this one on daily.dev."}},{"@type":"Question","name":"How well do current AI coding models write idiomatic Rails code?","acceptedAnswer":{"@type":"Answer","text":"In a benchmark running 17 models through 21 atomic Writebook tasks with three attempts each, the top performer, Claude Fable 5.1, scored 58 of 63 correct at $75 total cost, narrowly ahead of Claude Opus 5 at the same score for $120. But the best model's Rails API recall, meaning how often it reaches for framework methods versus hand-rolling logic, was only 41%, still favoring non-idiomatic code over half the time. Teams deciding how much to trust AI coding agents on Rails can track benchmarks like this on daily.dev."}}]} ```