Loading story…
Security researcher NullSecurityX reported a critical remote code execution (RCE) issue in RubitMQ Ruby job workers caused by unsafe JSON deserialization using the Oj gem. The worker pattern stores user-influenced job payloads as JSON and later processes them with Oj.load, which can reconstruct full Ruby objects (not just primitive JSON types). By abusing Oj’s object directives (e.g., {"^o":"ClassName"}), an attacker can trigger object instantiation and inject state, turning a background-job data channel into code execution and potentially enabling full system/infrastructure compromise.
The exploitation path described relies on design-level trust assumptions and a capability-based dynamic dispatch pattern: the worker checks whether a deserialized object responds to a method (notably run_find) and then executes it, treating method presence as authorization. In the demonstrated RubitMQ scenario, attackers craft a payload that instantiates an application class (e.g., a Node utility class) exposing run_find, which executes shell commands via Open3.capture3, making command execution deterministic. The issue is described as CVE-2024-XXXX with a CVSS 9.8 rating, and mitigations center on eliminating object deserialization of untrusted data (avoid Oj.load on attacker-controlled payloads) and applying required updates/configuration changes in affected RubitMQ/Oj deployments.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Several security news outlets reported a critical deserialization vulnerability affecting Ruby background job workers using Oj.load, including RubitMQ-based patterns. Coverage highlighted that crafted JSON payloads could trigger object injection, invoke dangerous methods such as those using Open3.capture3, and lead to arbitrary command execution and broader infrastructure compromise.
On Medium, researcher NullSecurityX published technical details of a deterministic remote code execution issue in Ruby background workers caused by unsafe JSON deserialization with the Oj gem. The write-up described how attacker-controlled JSON could instantiate application objects and abuse dynamic method dispatch to achieve worker takeover and potential full system compromise.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecyberpress.org
Open sourcegbhackers.com
Open sourcenullsecurityx.medium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Active exploitation has been observed against an Apache ActiveMQ remote code execution chain involving the Jolokia management API. VulnCheck reported canary-network hits tied to `CVE-2026-34197`, which was added to CISA's Known Exploited Vulnerabilities catalog, and said attackers are also using an unauthenticated variant that chains `CVE-2024-32114` with `CVE-2026-34197` to achieve zero-credential RCE. According to the reporting, `CVE-2024-32114` removes authentication from the Jolokia endpoint in ActiveMQ versions `6.0.0` through `6.1.1`, exposing the management interface to unauthenticated abuse. Technical details published by Horizon3.ai describe the RCE path through the Jolokia API, while VulnCheck said observed payloads invoked `addNetworkConnector` through Jolokia during exploitation. One captured payload referenced a private IP address, indicating the attacker activity may have reused a lab or proof-of-concept configuration, but the exploitation itself was confirmed in the wild. The combined reporting indicates that exposed ActiveMQ instances with vulnerable Jolokia configurations face immediate risk of unauthenticated remote compromise.
Jun 29, 2026
A critical remote code execution (RCE) vulnerability, identified as CVE-2025-54539, has been discovered in the Apache ActiveMQ NMS AMQP Client. This flaw is rated with a CVSS 3.1 score of 9.8, indicating its severe impact and ease of exploitation. The vulnerability arises from the deserialization of untrusted data within the NMS AMQP Client component, which can allow attackers to execute arbitrary code on the server. Security researchers have confirmed that successful exploitation of this vulnerability could lead to full server-side code execution, potentially granting attackers complete control over affected systems. The issue specifically affects deployments using the NMS AMQP Client, a component commonly integrated into enterprise messaging infrastructures. Organizations relying on Apache ActiveMQ for message brokering are at heightened risk if they utilize the vulnerable client library. The vulnerability can be exploited remotely, requiring no prior authentication, which significantly increases the attack surface and urgency for remediation. Security advisories recommend immediate patching or mitigation to prevent exploitation in the wild. The flaw was publicly disclosed on October 16, 2025, prompting rapid response from the Apache ActiveMQ development team and the broader security community. No reports of active exploitation have been confirmed at the time of disclosure, but the critical nature of the bug has led to widespread concern among enterprise users. Technical analysis indicates that the vulnerability stems from improper handling of serialized objects received over the AMQP protocol. Attackers can craft malicious payloads that, when processed by the vulnerable client, trigger arbitrary code execution. The Apache Software Foundation has released updated versions of the NMS AMQP Client to address the issue and urges all users to upgrade immediately. Security experts highlight the importance of reviewing all systems for the presence of the affected library and applying compensating controls where patching is not immediately feasible. The vulnerability underscores the ongoing risks associated with deserialization flaws in widely used open-source components. Organizations are advised to monitor for indicators of compromise and to review their application architectures for similar risks. The incident serves as a reminder of the critical need for secure coding practices and regular vulnerability management in enterprise environments.
Jun 29, 2026
Wazuh disclosed a critical remote code execution flaw, **`CVE-2026-25769`**, affecting versions **4.0.0 through 4.14.2** when deployed in **cluster mode**. The vulnerability stems from unsafe JSON deserialization in cluster communications, where a custom `object_hook` can be abused to trigger attacker-controlled module imports and function execution on the **master node**. According to the advisory, an attacker who has already compromised a trusted worker can send a crafted payload through DAPI and execute arbitrary commands on the master, potentially with **root privileges**. Because the master centrally manages workers, rules, and security processing, successful exploitation can lead to **full cluster compromise**, lateral movement, data theft, and evasion of security monitoring. Wazuh addressed the issue in **4.14.3** by introducing a deserialization allowlist, and defenders were urged to limit access to **TCP port `1516`**, monitor worker integrity, segment cluster networks, and rotate cluster keys to reduce the risk of a compromised worker being used as a launch point against the master.
Jun 29, 2026