A Ruby-first blog about web development, Rails, AI, backend engineering, and frontend craft.
Get new articles in your inbox. No spam — unsubscribe anytime.
A critical Rails RCE is under active exploitation, Ruby's JIT gets a garbage-collection speedup, and OpenAI, Anthropic, and Google all raced to ship cybersecurity-grade AI models this week.
RubyLLM 2.0.0.rc1 landed on RubyGems today with a full provider and protocol rewrite. Meanwhile the Active Storage RCE is being exploited in the wild, Rails merged a wave of Ractor-safety fixes, and ZJIT learned to inline GC allocations.
Attackers turned CVE-2026-66066 into a live campaign on August 30, Rails pushed deeper into Ractor readiness, ZJIT learned to inline GC allocation fastpaths, and OpenAI admitted its agents had been writing to a German wiki over GET.
Ruby patches two resolv gem DNS vulnerabilities, the Rails Foundation open-sources its lemans AI-agent benchmark harness, and RubyLLM 2.0 splits providers from protocols.
Rails 7.2 left security support on August 9, the Rails Foundation published its first benchmark of coding agents against real Rails code, HTTP QUERY routing went up for review, and a community LTS fork of Rails 8 was announced.