Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

The feed reports multiple critical cybersecurity developments, including unauthenticated remote code execution and arbitrary file-read vulnerabilities in Rails, Ruflo, OpenWrt, TeamCity, Gitea, and VMware; active exploitation of Check Point and VeloCloud flaws; browser compromise via malicious webpages; supply-chain malware in npm packages; Android and Linux botnets; exposed BMC authentication hashes; and attacks against water infrastructure. Several vulnerabilities carry CVSS scores of 9.3–10.0, with some confirmed exploited in the wild.