Ruby 4.0 Universal RCE Deserialization Gadget Chain

A newly discovered universal remote code execution vulnerability in Ruby 4.0.6 allows attackers to execute arbitrary commands through a single Marshal.load deserialization call, representing a critical escalation of a 13-year security threat that was recently exploited in-the-wild by AI agents to compromise production clusters. This vulnerability bypasses recent security patches from Ruby 3.4 and affects all Ruby versions 3.3 and above, posing an immediate risk to any organization deserializing untrusted data in Ruby applications. IT organizations must urgently audit their Ruby applications for unsafe deserialization practices and implement input validation controls, as this attack requires no user interaction and can be triggered remotely.