The Embargo Was the Bug

A security advisory that ships without a severity score is not neutral information. It is a delay mechanism that punishes the operators carrying the heaviest obligations. CVE-2026-66066 was published the morning of July 29, 2026 with no CVSS attached, under standard embargo terms; the embargo was overtaken the same day when the score climbed to 9.5 out of 10 and Rietta's own clients were already being hit. By the time the gravity was legible to a downstream reader, the response window had already opened.

The framework and the bug are interchangeable. What is not interchangeable is who was on the receiving end. Rietta's client base is HIPAA-covered healthcare entities and State government agencies running custom Rails applications, and the only thing that kept a HIPAA-grade breach from becoming a same-day statistic was Rietta's own discipline: an emergency hotfix procedure that finished around 11:30 PM Eastern on the day the patch shipped. The disclosure did not save them. The hotfix did.

The reusable mechanism: severity-free advisories turn the embargo into a one-sided clock. Vendors preserve coordination; the people on the receiving end, who carry the legal and operational exposure, run blind until the score catches up. Rietta's same-day response is the kind of gap-closing that most operators will not have. The next CVE will repeat the same gap unless disclosure timing is read as the second-order vulnerability.