File upload
3 articles
A crafted photo upload can read and write files on Rails servers. Upgrade Active Storage to 8.1.4.1 or 8.0.5.2
How to fix GHSA-f3w6-w445-fwh9: upgrade activestorage to 8.1.4.1 or 8.0.5.2 (and mini_magick to 5.1+). Rails says an unauthenticated upload processed by ImageMagick can write files on the server and read them on the Disk service, including secret_key_base. A sibling video bug, GHSA-v924-7rp8-4mxh, can disclose files through FFmpeg.
HOL GuardMagento PolyShell (CVE-2026-48356) is on CISA KEV: install APSB26-73, then hunt the webshells
How to fix CVE-2026-48356: upgrade Adobe Commerce or Magento Open Source to the APSB26-73 (2026-jul) release for your line, then search pub/media/custom_options for uploaded shells. CISA added PolyShell to KEV on October 27; it has been mass-exploited since March.
HOL GuardCVE-2026-18549 - @fastify/multipart Aborted Upload DoS
CVE-2026-18549 lets unauthenticated clients leak temp files and hang request handlers in @fastify/multipart <10.1.1, causing disk and event-loop exhaustion. Upgrade to 10.1.1.
HOL GuardRelated topics
Keep exploring
The engineering desk continues across the ecosystem: security research on shipping agents safely, and plugins that put the standards to work.