The item to act on tonight is Ruby on Rails, and it is not the biggest-sounding thing that happened today. Rails’ patch for CVE-2026-66066 stops the file read that leaks secret_key_base. It does not stop the Marshal deserialization gadget that read exposed, which still executes on a fully patched server for anyone holding a valid key. An organization that upgraded in early August and did nothing else is closed to the theft and still open to code execution by whoever completed the theft first. Patch status and compromise status have come apart here, and the step that reconciles them — rotating secret_key_base and every other secret readable from the application process — is the one no scanner reports as missing. VulnCheck says exploitation began the week of August 24. That claim is thin, and it is not what should decide this: a working exploit against more than 7,100 exposed instances has been public since August 7.
Bigger headlines were available today, and both of them shrank on inspection. The Justice Department rewrote its China hacking announcement so that NASA, the Federal Reserve, and the Senate are now “among the targets” of QTFY rather than its victims — a withdrawal, not an escalation. And a 9.8 critical CVE for the open-source project hulumi turns out to describe an over-permissive IAM policy in the project’s own CI sandbox account, a resource nobody who installs hulumi has.
The day did have a thread, and it is a narrow one: in four of the nine stories, the fix and the record of the fix do not match. Rails is one. Nodemailer’s new 9.8 names 8.0.3 as the fixed version, and the 8.0.3 tarball on npm still carries the vulnerable line. Eight MCPHub CVEs published within a single second this afternoon carry fixes shipped between April 22 and August 23 — the critical remote code execution among them was fixed in May and disclosed today. And Eclipse Theia’s agent-mode workspace escape, an 8.8 that let the AI agent write and delete files outside the workspace on a model-supplied path, was closed in a release whose notes described the change only as a breaking API change. The engineering is not the failure in any of the four. The patch exists in all of them. What is unreliable is the thing a vulnerability management program actually reads.
Second for most shops is Microsoft’s confirmation that Windows is falsely reporting Defender as turned off across effectively every supported client and server version, with no originating update to roll back, no named build to compare against, and alerts that persist even when notification settings are off. Expect it at the service desk at boot tomorrow, and brief staff with Get-MpComputerStatus rather than “ignore it” — the alert being trained out is the tamper signal.
Then the rest. Seven ToolJet CVEs describe the same cross-tenant authorization gap in tooljet-db, and the worst of them carries a 9.9 and a 2.4 from the same scorer in the same record, against the vendor’s own 5.9. Nutex Health refiled its August 24 breach disclosure under Item 1.05 seven days later without adding the materiality determination that item exists for — a change of flag that automated screening will read and the filing’s own text contradicts.
Still open: Microsoft has named neither the Defender build that causes the false alert nor a fix date. VulnCheck has published no correction on the ToolJet scoring conflict or the Nodemailer fixed-version range. The Justice Department has not said which, if any, of the seven named bodies QTFY actually compromised, and the pre-edit wording survives only in contemporaneous reporting. Nutex has not said whether it made a materiality determination, and the affected-individual count will come from state and federal breach portals, not EDGAR. And the Rails exploitation claim still rests on one social media post that VulnCheck’s own weekly report for that week does not list.