If you resize user uploads in a Rails app, that upload path may be a file-write primitive on your server.
The Hacker News reports a critical Ruby on Rails flaw, disclosed by the Rails project: an unauthenticated attacker can write arbitrary files on an app's server by uploading a crafted file, as long as uploads get processed with ImageMagick. CISA added two actively exploited Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog, with attackers chaining three of them for unauthenticated root access. BleepingComputer reports that France's national blood service confirmed a cyberattack on a refrigeration equipment provider, which raised temperature and defrost settings at three of its facilities.
Not one of those entry points sits in your own business logic. A library you call, an appliance at your edge, equipment owned by a supplier. Patch the Rails side first, then stop trusting the processing step: I move image handling into an isolated worker with a strict format allowlist, and I review the upload and payment paths around it. That scope takes days, not months.
Send me the places where user files enter your system and I'll come back with cost and timeline within a day.