Ruby Insights Daily: RubyLLM 2.0 Hits RC, Rails Turns Ractor-Safe, and Active Storage Is Under Attack

Today's Ruby world has one shipping story, one story you should act on before lunch, and three that tell you where the runtime is heading. Here is the September 8 rundown.

RubyLLM 2.0.0.rc1 is on RubyGems

Carmine Paolino pushed ruby_llm 2.0.0.rc1 today. It is the first release candidate of a rewrite he described in detail back in August, and the headline is architectural: providers and protocols are now separate concepts.

In 1.x, every provider inherited a wire format, which is why adding a service that spoke two API dialects meant duplicating code. In 2.0, a provider (OpenAI, Mistral, Vertex AI) is decoupled from the protocol it speaks (Chat Completions, Responses, Anthropic). Three things follow from that split:

• OpenAI now defaults to the Responses API. Reasoning models can use tools and extended thinking in the same call, which Chat Completions could not express. You can fall back per chat or globally.
• There is a provider gem generator. ruby_llm provider-gem Acme --api-base https://api.acme.ai/v1 scaffolds a full gem with CI, tests, and model catalog management, so a provider no longer has to be merged into core to exist.
• The provider count goes from 13 to 17, adding Cohere, Ollama Cloud, ElevenLabs, and Deepgram, plus a published model registry at rubyllm.com/models.json that refreshes every six hours with pricing, capabilities, and context windows.

Minimum Ruby is 3.1.3. It is an RC, so treat it accordingly, but if you are running RubyLLM in production this is the upgrade to start reading now rather than in a month.

Patch Active Storage today if you have not

CVE-2026-66066, nicknamed KindaRails2Shell, is a CVSS 9.5 arbitrary file read in Active Storage that can escalate to secret exposure, RCE, and lateral movement. It was disclosed on July 29, and SecurityWeek reports it is now being exploited in the wild, roughly a month after the patches shipped. VulnCheck counted about 7,000 exposed vulnerable instances in early August.

The root cause is that Active Storage did not disable dangerous libvips operations before processing user-supplied files. If you accept image uploads and use the Vips variant processor, you are in scope.

Fixed releases:

Rails 6.0.0 through 6.1.7.10 may also be affected when Active Storage uses Vips, and no fixes were published for those branches. Upgrading the gem is not the whole job: make sure libvips is 8.13 or later, set VIPS_BLOCK_UNTRUSTED (or call Vips.block_untrusted(true)) as an interim control, and rotate anything the file read could have leaked, starting with secret_key_base, credentials, and storage keys. A patch alone does not un-leak a secret that was already read.

Rails is being made Ractor-safe, one config object at a time

The September 4 This Week in Rails is almost entirely a Ractor changelog. Merged this week: controller configuration made shareable across Ractors (#58647), Action View settings (#58620), Active Record commit callbacks (#58653), time zone configuration (#58642), a fix so schema context no longer deadlocks while initializing attributes (#58651), and per-Ractor storage for event reporters on non-main Ractors (#58599).

None of these is exciting on its own. Together they are the unglamorous work that has to land before Ractors are usable in a real Rails app, and it is the clearest signal yet that the framework intends to get there rather than leave concurrency to threads and processes.

Two non-Ractor merges worth noting in the same digest: fetch_multi now returns keys in the original order instead of reordering them, which quietly fixes a class of subtle cache bugs, and the PostgreSQL adapter accepts an error_verbosity option.

ZJIT inlines the GC allocation fastpath

Peter Zhu published a walkthrough on Rails at Scale of teaching ZJIT to inline object allocation instead of calling into C on every new. The GC hands ZJIT its allocation cursor and limit, the JIT emits a bump-pointer allocation inline, and it falls back to the C path only when that fails.

The hash allocation benchmark goes from 117.2 ms to 66.4 ms, about 1.77x, with 2x to 3x gains reported on other types. The array variant (ruby/ruby#17277) merged to master in July at roughly 1.5x on empty array allocation. This is on the main branch, not in a stable release, but allocation is the hot path in almost every Rails request, so it is worth tracking.

Fable 5.1 takes the Agents on Rails lead

The Rails team's September 2 benchmark report ran 17 models through the lemans harness: 21 atomic Writebook tasks, three attempts each, 63 runs total, with hidden verification.

• Claude Fable 5.1: 58 of 63, $75
• Claude Opus 5: 58 of 63, $120
• Kimi K3: 57 of 63
• GLM 5.3 Flash: $3.31 for the full suite, about five cents a run

The number I keep coming back to is Rails API recall, which measures whether a model reaches for the framework method or hand-rolls its own. The leader scores 41%. So the best coding model available still writes non-idiomatic Rails more often than not, which is a decent argument for keeping a human on the review side of any agent workflow.

Also worth your time

• LiteLLM users: CVE-2026-59822 is an authentication bypass on the MCP Streamable HTTP endpoint (CVSS 8.2). An OAuth2 passthrough fallback substituted an empty auth object when key validation failed, so a fabricated Bearer token reached your connected tools. Fixed in 1.84.0.
• Rails World 2026 is September 23 and 24 in Austin, Texas, with DHH, Matz, and Aaron Patterson on the roster. Two weeks out.

The short version

Upgrade Rails and rotate your secrets if you touch Active Storage. Read the RubyLLM 2.0 upgrade notes before the final release lands. And if you have been writing off Ractors as a research project, this week's merge list is a reason to look again.