Security

• Ruby Array Pack Bleed December 28th, 2025
• The Ruby on Rails _json Juggling Attack December 9th, 2024
• Gem::SafeMarshal escape December 3rd, 2024
• Shiny Vulnerabilities in R's Most Popular Web Framework December 2nd, 2024
• Cross-Site POST Requests Without a Content-Type Header November 26th, 2024
• Ruby 3.4 Universal RCE Deserialization Gadget Chain November 24th, 2024
• Ruby's String Slice is Broken November 4th, 2024
• SQL Injection Polyglots October 22nd, 2024

Elsewhere

• Ruby Marshal Kick-off Gadgets August 26th, 2026
• Ruby 4.0 Universal RCE Deserialization Gadget Chain August 14th, 2026
• Hacking with Environment Variables June 24th, 2020
• Ruby 2.x Universal RCE Deserialization Gadget Chain November 8th, 2018

Meta

• CSS Fix for Monospace Fonts on iOS Safari November 2nd, 2024