Daily Writeups
@Daily_Writeups
3.47K subscribers
2 photos
127K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.47K subscribers
Daily Writeups
⤷ Title: Essential Rails Security: Protecting Your Application from Top Pitfalls
════════════════════════
𐀪 Author: Anamika
════════════════════════
ⴵ Time: Fri, 29 Aug 2025 09:24:27 GMT
════════════════════════
⌗ Tags: #strong_parameters #backend_development #ruby_on_rails #sql_injection #web_security
Medium
Essential Rails Security: Protecting Your Application from Top Pitfalls
Ruby on Rails, often lauded for its developer-friendliness and convention-over-configuration philosophy, provides a robust foundation for…
12 views
Daily Writeups
⤷ Title: Inside RubyGems’ Silent War Against Malicious Packages: A Developer’s Reality Check
════════════════════════
𐀪 Author: Mi Do
════════════════════════
ⴵ Time: Mon, 01 Sep 2025 00:12:10 GMT
════════════════════════
⌗ Tags: #ruby_on_rails #ruby #devops #devsecops #cybersecurity
Medium
Inside RubyGems’ Silent War Against Malicious Packages: A Developer’s Reality Check
The untold story of how Ruby’s package registry fights supply chain attacks daily — and what it means for your next project
29 views
Daily Writeups
⤷ Title: JetBrains Makes RubyMine Free for Non-Commercial Use
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 03 Sep 2025 03:21:13 +0000
════════════════════════
⌗ Tags: #Technology #Developers #free software #IDE #JetBrains #non_commercial #open_source #ruby on rails #RubyMine
Daily CyberSecurity
JetBrains Makes RubyMine Free for Non-Commercial Use
JetBrains has made its RubyMine IDE free for non-commercial use. The move is designed to lower the barrier for new developers and content creators.
13 views
Daily Writeups
⤷ Title: Rack Security Update: High-Severity Flaw Bypasses Parameter Limit, Exposing Apps to DoS Attacks
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 26 Sep 2025 08:37:36 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2025_59830 #Denial of Service #dos #QueryParser #Rack #Ruby #RubyGems #Web Security
Daily CyberSecurity
Rack Security Update: High-Severity Flaw Bypasses Parameter Limit, Exposing Apps to DoS Attacks
Rack patches CVE-2025-59830 (CVSS 7.5), a flaw where attackers could use semicolon separators to bypass the parameter count limit and trigger DoS attacks.
19 views
Daily Writeups
⤷ Title: Protect Your Rails API with Rack-Attack Rate Limiting (Step-by-Step)️
════════════════════════
𐀪 Author: Ahmet Kaptan
════════════════════════
ⴵ Time: Wed, 12 Nov 2025 09:32:21 GMT
════════════════════════
⌗ Tags: #rest_api #api_security #ruby_on_rails #software_development #backend_development
Medium
Protect Your Rails API with Rack-Attack Rate Limiting (Step-by-Step)🛡️
A while back, while working at a company that handled one of our biggest enterprise clients, I ran into one of those production nightmares…
44 views
Daily Writeups
⤷ Title: Critical Authentication Bypass Flaws Discovered in Ruby SAML Library (CVE-2025-66567 & CVE-2025-66568)
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 09 Dec 2025 02:29:23 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Authentication Bypass #Canonicalization #CVE_2025_66567 #Digest Bypass #Ruby SAML #XML Parser Differential
Daily CyberSecurity
Critical Authentication Bypass Flaws Discovered in Ruby SAML Library (CVE-2025-66567 & CVE-2025-66568)
Two Critical (CVSS 9.3) flaws in ruby-saml allow Authentication Bypass. Exploits use XML parser differential and a digest bypass due to failed canonicalization. Update to v1.18.0 immediately.
31 views
Daily Writeups
⤷ Title: Ruby 4.0 Unwrapped: Meet ZJIT and the Game-Changing Ruby Box
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Fri, 26 Dec 2025 02:26:41 +0000
════════════════════════
⌗ Tags: #Technology #Backend #JIT Compiler #Memory Safety #performance #Programming 2026 #Ractor #Ruby 4.0 #Ruby Box #Web Development #ZJIT
Penetration Testing Tools
Ruby 4.0 Unwrapped: Meet ZJIT and the Game-Changing Ruby Box
Ruby has almost settled into a festive tradition of its own: each Christmas, the developers unveil a new
18 views
Daily Writeups
⤷ Title: How I Discovered a Dependency Confusion Vulnerability in a Ruby Application Leading to RCE
════════════════════════
𐀪 Author: Ahmed Tarek
════════════════════════
ⴵ Time: Sat, 17 Jan 2026 19:06:39 GMT
════════════════════════
⌗ Tags: #pentesting #bug_bounty #dependency_confusion #bug_bounty_tips #ruby
Medium
How I Discovered a Dependency Confusion Vulnerability in a Ruby Application Leading to RCE
hey there,
22 views
Daily Writeups
⤷ Title: Secure Query Practices in Ruby on Rails
════════════════════════
𐀪 Author: Muhammad Bin Hussain
════════════════════════
ⴵ Time: Fri, 20 Feb 2026 20:30:29 GMT
════════════════════════
⌗ Tags: #ruby_on_rails #web_security #secure_coding_practice #sql_injection #backend_development
Medium
Secure Query Practices in Ruby on Rails
Preventing SQL Injection Through Understanding, Not Fear
45 views
Daily Writeups
⤷ Title: The Unsafe Send: How an HTTP Client Library Led to Remote Code Execution
════════════════════════
𐀪 Author: Alperen
════════════════════════
ⴵ Time: Sat, 21 Feb 2026 02:44:52 GMT
════════════════════════
⌗ Tags: #hackerone #source_code_security #source_code #ruby #bugbounty_writeup
Medium
The Unsafe Send: How an HTTP Client Library Led to Remote Code Execution
Finding a vulnerability in a core library is always a “hold your breath” moment. You realize that the impact isn’t just limited to one…
45 views
Daily Writeups
⤷ Title: Unsafe Deserialization in Ruby Background Workers Leading to Deterministic Remote Code Execution
════════════════════════
𐀪 Author: NullSecurityX
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 16:57:42 GMT
════════════════════════
⌗ Tags: #cybersecurity #ctf_writeup #json #bug_bounty #ruby
Medium
Unsafe Deserialization in Ruby Background Workers Leading to Deterministic Remote Code Execution
Object Injection via Oj.load Allows Command Execution in RubitMQ Job Workers
23 views
Daily Writeups
⤷ Title: Rate Limiting Your Rails API with Rack::Attack gem
════════════════════════
𐀪 Author: Talha Khalid
════════════════════════
ⴵ Time: Mon, 02 Mar 2026 00:52:59 GMT
════════════════════════
⌗ Tags: #api_rate_limiting #api_security #ruby_on_rails #web_development #rubygems
Medium
Rate Limiting Your Rails API with Rack::Attack gem
Rate limiting is a fundamental aspect of API security and stability. Without it, endpoints are vulnerable to brute force attacks…
25 views
Daily Writeups
⤷ Title: Bridging the Gap: North Korean APT37 Deploys ‘Ruby Jumper’ to Infiltrate Isolated Air-Gapped Networks
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 03 Mar 2026 00:05:18 +0000
════════════════════════
⌗ Tags: #Malware #Air_gap attack #APT37 #Cloud C2 #infosec #North Korean APT #Ruby Jumper #ScarCruft #SNAKEDROPPER #THUMBSBD #USB malware #VIRUSTASK
Daily CyberSecurity
Bridging the Gap: North Korean APT37 Deploys 'Ruby Jumper' to Infiltrate Isolated Air-Gapped Networks
Zscaler unmasked APT37's "Ruby Jumper" campaign, which uses weaponized USBs and cloud services to bypass network isolation and steal data from air-gapped systems.
7 views
Daily Writeups
⤷ Title: Jumping the Gap: APT37’s “Ruby Jumper” Campaign Weaponizes Cloud Storage and USBs to Breach Isolated Networks
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 04 Mar 2026 07:01:03 +0000
════════════════════════
⌗ Tags: #Cybercriminals #air_gapped network #APT37 #Cybersecurity 2026 #RESTLEAF #Ruby Jumper #ScarCruft #SNAKEDROPPER #THUMBSBD #USB Malware #Velvet Chollima #VIRUSTASK #Zoho WorkDrive #Zscaler ThreatLabz
Penetration Testing Tools
Jumping the Gap: APT37’s "Ruby Jumper" Campaign Weaponizes Cloud Storage and USBs to Breach Isolated Networks
The DPRK-affiliated syndicate APT37 has augmented its arsenal dedicated to breaching air-gapped networks. The Zscaler ThreatLabz vanguard has
13 views
Daily Writeups
⤷ Title: Rocket — CVE-2021–22911 NoSQL Injection + Ruby cap_setuid to Root | TryHackMe
════════════════════════
𐀪 Author: Roshan Rajbanshi
════════════════════════
ⴵ Time: Tue, 14 Apr 2026 14:46:42 GMT
════════════════════════
⌗ Tags: #penetration_testing #cybersecurity #ethical_hacking #sql #ruby
Medium
Rocket — CVE-2021–22911 NoSQL Injection + Ruby cap_setuid to Root | TryHackMe
The Rocket machine presents a layered, multi-service attack surface that rewards methodical enumeration and precise exploit chaining. The…
12 views
Daily Writeups
⤷ Title: GemStuffer: Attackers Weaponize RubyGems as a Covert Data Drop for UK Gov Scraping
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 13 May 2026 04:21:32 +0000
════════════════════════
⌗ Tags: #Malware #Cyber Security #data exfiltration #GemStuffer #infosec #Malware Analysis #ModernGov #Ruby Security #RubyGems #Socket #supply chain attack #UK Council Security
Daily CyberSecurity
GemStuffer: Attackers Weaponize RubyGems as a Covert Data Drop for UK Gov Scraping
GemStuffer exploits RubyGems as an illicit data transport to scrape UK council portals. Discover how this supply chain attack bypasses standard defenses.
23 views
Daily Writeups
⤷ Title: RubyGems Under Siege: New Account Registrations Suspended After Massive Malware Incursion
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 13 May 2026 09:00:18 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Cyber Security News #Infosec #Maciej Mensfeld #Malware 2026 #Mend.io #open source security #Package Manager Security #Ruby on Rails #RubyGems #supply chain attack #TeamPCP
Penetration Testing Tools
RubyGems Under Siege: New Account Registrations Suspended After Massive Malware Incursion
RubyGems has temporarily suspended the registration of new accounts following a pervasive assault on the Ruby ecosystem. According
27 views
Daily Writeups
⤷ Title: Before You Deploy, Ask One Question: Are Your Gems Secure?
════════════════════════
𐀪 Author: J3
════════════════════════
ⴵ Time: Mon, 15 Jun 2026 20:04:58 GMT
════════════════════════
⌗ Tags: #devsecops #ruby_on_rails #cybersecurity #application_security #bundleraudit
Medium
Before You Deploy, Ask One Question: Are Your Gems Secure?
A hands-on introduction to Bundler Audit, CVEs, dependency security, and safer Ruby deployments.
17 views
Daily Writeups
⤷ Title: Stop Ignoring Brakeman Warnings: The Hidden Meaning Behind CWE Codes
════════════════════════
𐀪 Author: J3
════════════════════════
ⴵ Time: Sat, 20 Jun 2026 15:50:42 GMT
════════════════════════
⌗ Tags: #cwecodes #ruby_on_rails #application_security #brakeman #secure_coding
Medium
Stop Ignoring Brakeman Warnings: The Hidden Meaning Behind CWE Codes
Learn how CWE mappings expose critical vulnerabilities like SQL Injection and XSS before they reach production.
15 views
Daily Writeups
⤷ Title: Avo Flaw CVE-2026-55518 Enables Privilege Escalation in Rails Apps
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Mon, 22 Jun 2026 01:11:11 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #admin panel #Authorization Bypass #Avo #CVE_2026_55518 #Missing Authorization #privilege escalation #Rails Security #ruby on rails
Daily CyberSecurity
Avo Flaw CVE-2026-55518 Enables Privilege Escalation in Rails Apps
CVE-2026-55518 is a critical Avo authorization bypass flaw enabling privilege escalation in Ruby on Rails admin panels. Update to Avo 3.32.1 now.
21 views