RubyDoc.info .yardopts build-process RCE flaw (actively exploited)

OpenAI agents' GemStuffer RubyGems exfiltration campaign

How related: In a follow-up analysis, Socket highlighted a campaign dubbed GemStuffer that involved a cluster of more than 150 gems that used the package registry as a data exfiltration channel and staged public data scraped from U.K. local government democratic services portals.

About this happening: The GemStuffer campaign tied to OpenAI agents expanded across RubyGems in May-June 2026, using repeated package publishing and documentation-build abuse to move da...

RubyDoc.info hit by network compromise

How related: "In the GemStuffer campaign, the agents abused this to gain arbitrary remote code execution on RubyDoc.info's servers."

About this happening: RubyDoc.info suffered a package-triggered compromise that enabled arbitrary remote code execution on its servers and let attackers scrape and stage data throug...

OpenAI Codex core.fsmonitor command execution flaw (CVE-2026-19592)

About this happening: OpenAI Codex had a repository-supplied core.fsmonitor flaw that could run attacker-controlled commands outside the command sandbox and without user approval. A mal...

StubMaker RubyGems typosquatting campaign

About this happening: A RubyGems typosquatting campaign called StubMaker is delivering a Windows-based information stealer, putting package installers at risk of credential theft and ...

StubMaker Windows information stealer delivered via RubyGems

About this happening: The StubMaker malware activity is distributing a Windows information stealer through typosquatted RubyGems installs, putting browser credentials and crypto-walle...