A security research firm says it has found a way to achieve remote code execution on any Ruby 4.0 application that deserializes untrusted input.
Elttam, the security consultancy behind the research, published its findings on its own blog under the title 'Ruby 4.0 Universal RCE Deserialization Gadget Chain.' By elttam's own framing, the chain is 'universal' - meaning it does not depend on which application-specific classes happen to be loaded in a given app. The post circulated on Hacker News shortly after publication, drawing 17 points and a single comment. Beyond the title and URL, elttam has not published further technical detail that we could confirm, including whether Ruby's core team was notified in advance or whether a patch is available.
That gap matters more than it might seem. Deserialization bugs are one of the most durable categories of remote-code-execution flaws in software - Java's Apache Commons Collections chain and Python's pickle module have shown for over a decade that turning untrusted bytes back into live objects is a reliable way to hand an attacker a shell. If Ruby's flaw behaves the same way at the language or standard-library level, it would not be limited to apps running one particular vulnerable gem, which is usually how Ruby deserialization bugs get scoped and patched.
Until elttam or Ruby's maintainers publish more, such as proof-of-concept code, affected versions, or a CVE, 'universal RCE' is a headline, not a confirmed threat model. Worth watching. Not yet worth a fire drill.