Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Debian 12 ruby-oauth2 Important Token Leak Vulnerability DLA-4822-1
A vulnerability was discovered in ruby-oauth2, a Ruby library for OAuth 2.0, which could result in a bearer token being sent to the host named by a redirect Lo…
Debian 11: ruby-rmagick High Memory Leak DoS DLA-4433-1 CVE-2023-5349
A memory leak flaw was found in ruby-magick, an interface between Ruby and ImageMagick. This issue can lead to a denial of service (DOS) by memory exhaustion. …
Mageia 2020-0252: ruby-rack security upda
Updated ruby-rack packages fix security vulnerabilities: There's a possible information leak / session hijack vulnerability in Rack(RubyGem rack). Attackers ma…
Malicious PyPI, npm, and Ruby Packages Exposed in Ongoing Open-Source Supply Chain Attacks
Several malicious packages have been uncovered across the npm, Python, and Ruby package repositories that drain funds from cryptocurrency wallets, erase entire…
Researchers Identify Rack::Static Vulnerability Enabling Data Breaches in Ruby Servers
Cybersecurity researchers have disclosed three security flaws in the Rack Ruby web server interface that, if successfully exploited, could enable attackers to …
Debian LTS: DLA-3858-1: ruby2.7 Security Advisory Updates
Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may result in denial-of-service (DoS), information leak, and remot…
Over 700 Malicious Typosquatted Libraries Found On RubyGems Repository
As developers increasingly embrace off-the-shelf software components into their apps and services, threat actors are abusing open-source repositories such as R…
CentOS 9 ruby-GraphQL-Processor Flawed Memory Leak 2024-2c7dbb48e2
Upgrade to upstream. Eliminates distributing harfbuzz sources. Upgrade to upstream 0.032.
SUSE: ruby2.5 Moderate Read Header & Userinfo Leakage 2025:02739-2
* bsc#1237805 * bsc#1245254 Cross-References: * CVE-2025-27221
Fedora 35: rubygem-mechanize 2022-fda14723ec
New version 2.8.5 is released. This new version address the security issue CVE-2022-31033 related to header information leak.
ScarCruft Uses Zoho WorkDrive and USB Malware to Breach Air-Gapped Networks
The North Korean threat actor known as ScarCruft has been attributed to a fresh set of tools, including a backdoor that uses Zoho WorkDrive for command-and-con…
Fedora 42: Critical URI Leakage DoS Mitigation CVE-2025-61594 Update
Upgrade to Ruby 3.4.7. Fix URI Credential Leakage Bypass previous fixes. Resolves: CVE-2025-61594 Fix REXML denial of service. Resolves: rhbz#2396204