Ruby gadgets, an AI-found Artifactory hack, and the AI pipeline as both tool and target

Luke Jahnke published the first universal Ruby RCE deserialization gadget chain back in 2018, and it is great to see him still pushing this research forward.

What I find most interesting is what happened after the previous chain was published. Maintainers patched enough gadgets to break that specific chain, but left other pieces untouched. Luke simply reused the surviving gadgets in a new chain.

This brings me back to KindaRails2Shell. The patch blocks the file-read stage that gave attackers access to Rails signing secrets, but the dangerous transformation surface used later in the chain was not fully removed.

The lesson is important: do not patch just to break the published exploit. Patch as many of the underlying primitives as you can. Otherwise, you are not forcing the next attacker to start from scratch. You are simply asking them to replace the few links in the chain that you broke. Ruby 4.0 Universal RCE Deserialization Gadget Chain - elttam.

Luke Jahnke, the author of the Ruby gadget-chain research above, sent me this article because he knew I would love the chain. It begins with a trailing-slash authentication bypass, moves through refresh tokens and JWT claim confusion, then ends with Logback writing the files needed for a Tomcat CGI shell. I have spent years building JWT labs and have used Tomcat Manager to shell more servers than I can count during pentests. If a dream intrusion can exist, this is probably mine. The irony is that an agent got there first.

But the most interesting part of this research is how it was found. The author reused the prompt that Adam Kues had used against WordPress (wp2shell), replaced WordPress with JFrog Artifactory, and pointed Codex at the decompiled source. Four hours later, Codex returned the full chain. For every person publicly writing about using AI this way, how many are already doing the same thing without talking about it? And now that this article has been published, how many more people will try it? Will you? Full Chain Pre-Auth RCE on JFrog Artifactory - Edra - Cybersecurity Blog.

LiteLLM has had a few interesting vulnerabilities recently. But what happens after an attacker compromises a LiteLLM instance?

You may think an attacker could steal your provider keys and raid your account, or access your billing and usage data. This article shows something more interesting. With proxy-admin access, an attacker can silently reroute traffic through their own gateway, intercept every prompt and response, modify the model’s output, and even inject tool calls after inference, where prompt-level guardrails cannot see them. It gives the attacker a stealthy way to retain visibility and influence over an enterprise’s AI traffic.

This is not another LiteLLM vulnerability. It uses documented admin functionality after the compromise. But it shows the real blast radius of a component many organizations deploy for observability and billing. LLM Heist: Hijacking LiteLLM for Traffic Interception, Key Theft, and Tool-Call Injection.

Visa has open sourced an eleven-stage harness for finding, verifying, chaining, fixing, and validating vulnerabilities with AI.

The most interesting part is the assumption behind it: finding vulnerabilities is becoming cheap. Validation and remediation are the new bottlenecks.

Visa calls its metric Mean Time to Adapt: the time between discovering an exploitable weakness and getting a validated fix into production. The model is only one part. The real product is the pipeline around it.

There are no published accuracy numbers yet, so treat this as a reference architecture, not proof that agentic SAST has been solved. visa/visa-vulnerability-agentic-harness: Visa Vulnerability Agentic Harness.