Loading story…
Security researchers published a universal Ruby Marshal deserialization gadget chain that can achieve remote code execution in Ruby 4.0 by abusing RubyGems internals. The chain begins with Marshal.load and Time._load, where a crafted time-zone object triggers attacker-controlled to_str or to_s behavior.
The exploit builds a malicious RubyGems source URI that retrieves a compressed gemspec into /tmp/quick/Marshal.4.8/; Gem::StubSpecification and Gem::Specification.load subsequently evaluate the gemspec through Ruby eval. A proof of concept using an S3 URI and traversal-style port value executed id as root in a Ruby 4.0.6 container, though the demonstration also produced later Gem::StubSpecification errors. The technique provides an alternative to an older gadget path blocked by stricter type validation in Gem::Version#marshal_load.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
A r/netsec post by AnimalStrange linked to elttam's research on a Ruby 4.0 universal remote-code-execution deserialization gadget chain.
elttam disclosed a universal Ruby Marshal.load deserialization gadget chain for Ruby 4.0 that abuses Time deserialization and RubyGems internals to reach Gem::Specification.load's eval sink. Its proof of concept demonstrated an attacker-controlled gemspec executing `id` as root in a ruby:4.0.6 Docker container.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers documented updated universal gadget chains that can achieve remote command execution when Ruby applications call `Marshal.load` on attacker-controlled data. A Ruby 3.4 proof of concept autoloads RubyGems’ vendored `Gem::URI` namespace, removing the former requirement for `net/http` to have been loaded, and substitutes commonly available `rake` or `make` binaries for the prior `zip` dependency. It also uses `UncaughtThrowError` to suppress the post-exploitation exception; its `Gem::Source::Git` `popen` sink can generate outbound network traffic and modify the filesystem. The technique builds on earlier universal Ruby 2.x deserialization research. New analysis finds that risk is not limited to classes implementing documented custom Marshal hooks such as `marshal_load`, `_load`, and `_load_data`. During object reconstruction, `Marshal.load` can implicitly invoke attacker-influenced `hash`, `eql?`, `<=>`, `to_str`, `to_s`, and `respond_to?` methods, creating broad gadget-discovery opportunities even in Ruby 4.0.6 processes started with `--disable-gems`. Removing RubyGems `.rz` Marshal-spec support may reduce attack surface but does not eliminate it; organizations should treat untrusted Marshal input as unsafe, eliminate its use at trust boundaries, and audit deserialization paths and exposed RubyGems-dependent applications.
Sep 3, 2026
A coordinated RubyGems supply-chain attack dubbed **SleeperGem** used malicious releases of `git_credential_manager`, `Dendreo`, and `fastlane-plugin-run_tests_firebase_testlab` to target developer workstations. Researchers reported that the attacker appears to have hijacked long-dormant maintainer accounts and pushed trojanized gem versions, including `git_credential_manager` `2.8.0` through `2.8.3`, with code that executed on library load, fetched additional payloads from a fake-looking Git ecosystem repository on `git.disroot.org`, and deliberately avoided running in CI environments to reduce detection. On developer machines, the gems reportedly acted as loaders for a second stage that installed a native daemon, established persistence through **systemd** and **cron**, and attempted privilege escalation via passwordless `sudo` to place a setuid root shell at `/usr/local/sbin/ping6`. Investigators said the malicious releases did not match legitimate source tags and that some affected packages had been inactive for years before suddenly publishing updates, indicating account compromise rather than normal maintenance. Security firms warned that any system that installed or required the affected gems should be treated as fully compromised and that all accessible credentials and secrets should be rotated.
Jul 26, 2026
A researcher disclosed a four-vulnerability chain that enabled unauthenticated remote code execution on GitHub Enterprise versions before `2.8.7`. The attack began with a WebHook server-side request forgery (SSRF) bypass using an unusual IP-address representation to evade Faraday restrictions, then used a second SSRF flaw to reach the internal Graphite service. A CRLF injection in Python's `HTTPConnection` allowed protocol smuggling to internal Memcached, where an attacker could plant a malicious Ruby Marshal object in cache. When GitHub Enterprise deserialized the poisoned object, it executed attacker-controlled commands. GitHub validated the report and released version `2.8.7`, adding SSRF and internal network-access protections.
Sep 3, 2026