A Universal Ruby RCE, DRAM Physics Exploited Again, and What Regulators Are Watching

Three security stories this week span the full stack from application runtime to memory hardware to AI-assisted offense. Researchers at Elttam published a universal remote code execution gadget chain for Ruby 4.0's deserialization path. The 'universal' framing is the critical detail: unlike gadget chains that require a specific gem or library version in the target's dependency tree, this one works through a common path in the runtime itself, meaning any Ruby 4.0 application that deserializes untrusted data is potentially exposed. The Rails ecosystem serves substantial web traffic across e-commerce and SaaS applications, and organizations running Ruby 4.0 in production have immediate reason to evaluate their exposure.

The hardware-level story is Spaghettifying DRAM, a GitHub repository from the xoreaxeaxeax research group — the team behind a long series of creative low-level hardware exploitation work. The name invokes the gravitational metaphor for what happens to matter near a black hole: stretched until unrecognizable. Applied to DRAM, the research reportedly documents techniques for inducing bit flips and data corruption through crafted memory access patterns that exploit the physical properties of how DRAM cells interact at close proximity. The post scored 639 points and 166 comments. Rowhammer-class attacks have been a research concern for over a decade, but each new iteration demonstrates that the fundamental physics of DRAM creates attack surfaces not addressable through software mitigations alone. In shared-tenant cloud environments, where memory isolation between virtual machines depends on physical separation that DRAM physics can partially undermine, the implications require reassessment of whether existing mitigations — ECC memory, scrubbing, adjusted refresh rates — remain sufficient.

The GLM-5.3 cyber capability framing connects to a regulatory dimension worth naming explicitly. Antitrust law in the US rests primarily on the Sherman Act, which prohibits monopolization and exclusionary conduct — not market dominance itself, but the use of dominant market power to foreclose competitors through means other than competing on the merits. Regulators are beginning to apply that logic to AI: the Justice Department has scrutinized AI investment flows, the EU is implementing the AI Act, and the FTC has examined exclusive arrangements between cloud providers and AI labs. The relevant-market definition — whether the market is 'AI APIs,' 'foundation models,' or 'cloud AI services' — is the fight that will shape the industry's structure for the next several years. If regulators eventually designate offensive AI capabilities as a separately regulated category, voluntary disclosure of those capabilities, as ZhipuAI did with GLM-5.3, becomes a competitive and legal variable, not merely a safety gesture.