[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

official (Rails security advisory GHSA-f3w6-w445-fwh9)

Tip: find which of your Rails apps are actually exposed to the Active Storage ImageMagick bug before a public exploit lands

  • Processor: grep for variant_processor in config/; if absent, check config.load_defaults (6.1 or earlier defaults to :mini_magick).
  • Versions: bundle exec gem list activestorage mini_magick; you need activestorage 8.0.5.2 / 8.1.4.1 and mini_magick 5.1+.
  • Policy: magick -list policy (or convert -list policy) inside the running container; look for MSL, PS/EPS/PDF coders and the gs delegate denied.
  • Storage: grep config/storage.yml and active_storage.service for service: Disk. Those apps need secret rotation after patching.
  • Don't forget background workers and image-processing services that share the same image.

Sources: Rails: Possible arbitrary file write and read in Active Storage image analysis (GHSA-f3w6-w445-fwh9)