Comment by burlesona

This is interesting, although not that novel. Marshal deserialization has always been unsafe, and in > 10 years as a Ruby engineer I’ve never seen it used in a production system. I would guess that finding a system vulnerable to this exploit would be a more interesting story than the exploit itself.