https://rietta.com/glossary/cve/ Recent content in CVE (Common Vulnerabilities and Exposures) on Rietta Cybersecurity Hugo -- gohugo.io en-us 1999-2026 Rietta Inc. All Rights Reserved. Tue, 20 Oct 2026 10:13:26 -0400 https://rietta.com/learning/appsec/what-is-a-cve/ Mon, 01 Jan 0001 00:00:00 +0000 https://rietta.com/learning/appsec/what-is-a-cve/ A quick explainer on what a CVE (Common Vulnerabilities and Exposures) is, and why staying current on them is a non-negotiable part of running a secure application. https://rietta.com/learning/appsec/patching-rails-critical-cve-atlrug/ Mon, 01 Jan 0001 00:00:00 +0000 https://rietta.com/learning/appsec/patching-rails-critical-cve-atlrug/ A walkthrough of efficiently patching a Ruby on Rails application when a critical CVE drops, using CVE-2022-32224 (an ActiveRecord vulnerability affecting YAML-serialized fields) as the working example. The principles apply broadly, well beyond that one CVE. Recorded at the monthly Atlanta Ruby Users’ Group (ATLRUG) meeting on July 13, 2022. https://rietta.com/blog/rubygems-supply-chain-openai/ Mon, 14 Sep 2026 14:00:00 +0000 https://rietta.com/blog/rubygems-supply-chain-openai/ Over the weekend it has been widely reported that OpenAI agents attacked RubyGems on May 11, 2026, two months before Hugging Face, including by mainstream wire service Reuters. The use of Artificial Intelligence frontier models both for good and for evil is happening now regardless of what any particular individual or company wishes were the case. In this case, OpenAI saying that it did not have the intent to perform the particular attack does little to show that its amoral agent (as in a computer system with no moral agency) did not pattern match and actually perform malicious activity. https://rietta.com/blog/ruby-on-rails-cve-exploited-hours-after-patch/ Fri, 04 Sep 2026 12:55:00 -0400 https://rietta.com/blog/ruby-on-rails-cve-exploited-hours-after-patch/ After hours on Wednesday, July 29, 2026, Rietta executed our emergency hotfix procedure across our entire client base for sites impacted by a severe remote code execution vulnerability in ActiveStorage, a component of Ruby on Rails 8 and newer. We worked off the initial GitHub Security Advisory, published the same day the patch shipped. Ethiack, one of the research teams that discovered the flaw, dubbed it KindaRails2Shell (CVE-2026-66066) in their initial disclosure post that same day, July 29th, with a full technical deep-dive following the next day on July 30th. https://rietta.com/blog/cve-program-funding-lapse-national-security/ Wed, 16 Apr 2025 12:00:00 +0000 https://rietta.com/blog/cve-program-funding-lapse-national-security/ News started breaking yesterday of an imminent funding lapse for the United States government-funded Common Vulnerabilities and Exposures database maintained for the last 25 years under contract with MITRE Corporation. The reporting yesterday included Funding Expires for Key Cyber Vulnerability Database (krebsonsecurity.com) and this lapse has been confirmed by multiple sources CVE program faces swift end after DHS fails to renew contract, leaving security flaw tracking in limbo (csoonline.com) and CVE Program Funding Expires—What It Means And What To Do Next (forbes.