Reported by 2 outlets

Timeline

1. original reporting

   Ruby RCE Gadget Chain Turns Unsafe Marshal.load Into Command Execution

   cyberpress.org · 59d ago · August 15th, 2026

   A newly disclosed universal deserialization gadget chain demonstrates that a single unsafe Marshal.load operation can lead to remote command execution on Ruby 4.0.6. The chain reportedly also works unchanged on Ruby versions as far back as 3.3, renewing concerns that Ruby’s native serialization mechanism remains a high-risk attack surface when exposed to untrusted data. The research builds on more than a decade of Ruby deserialization exploitation, including prior chains targeting Ruby on Rails , YAML.load , RubyGems, and the standard library. New Ruby RCE Gadget Chain Turns Unsafe Marshal.load Unlike older proofs-of-concept that stopped working after changes in Ruby 3.4, the latest chain uses a new combination of RubyGems and core language features to execute code without requiring application-specific dependencies or pre-existing files on the target host. At a high level, the attack abuses Ruby’s object reconstruction process. Marshal.load restores serialized objects and may trigger class loading, method calls, and object-state restoration during deserialization. November 2024 3.4-rc chain vs. Ruby 4.0 chain (Source: elttam) The new chain reportedly begins by referencing Gem::SpecFetcher , causing RubyGems autoloading to make additional classes available in an otherwise minimal Ruby process. The attack then combines two capabilities: retrieving attacker-controlled content and evaluating it as Ruby code. A surviving RubyGems gadget can fetch compressed content from an attack

2. update from gbhackers.com

   Ruby 4.0 Marshal.load RCE Gadget Chain Exposes Critical Deserialization Risk

   gbhackers.com · 59d ago · August 15th, 2026

   […] The post Ruby 4.0 Marshal.load RCE Gadget Chain Exposes Critical Deserialization Risk appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .