BRbradly·Sep 4, 2026
Not running, but supported. You can check your app with:
bin/rails runner '
require "vips"
puts "ruby-vips #{Vips::VERSION} libvips #{Vips.version(0)}.#{Vips.version(1)}.#{Vips.version(2)}"
begin
Vips::Operation.new("matload")
puts "matload PRESENT - this build can reach libmatio"
rescue Vips::Error
puts "matload ABSENT - this build cannot reach libmatio"
end
'
This is from the Rails official docs for the CVE which, interestingly, they only released as an agent skill. https://github.com/rails/rails-forensics-CVE-2026-66066/blob...
In Government Rails Site Hit Hours After CVE Patch