# Socket Weekly: Shai-Hulud Descendant Surfaces in a Malicious Ruby Gem Canonical: https://brew.new/templates/socket/socket-weekly-shai-hulud-descendant-surfaces-in-a-malicious-ruby-gem Brand: socket.dev Category: newsletter ![Preview of Socket Weekly: Shai-Hulud Descendant Surfaces in a Malicious Ruby Gem](https://cdn.brew.new/email-preview-5547a61cf13a660d-tracking_r57sm3jg023bsf0njqmc7f25xs8hzeqh-1794291676878.png) ## Email content Socket Weekly Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes. Feross Aboukhadijeh Feross Aboukhadijeh Founder & CEO at Socket Top Story Shai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI Tools A malicious Ruby gem called strutil-core ran a credential-stealing worm at install time, then wrote itself into MCP configs, CLAUDE.md and AGENTS.md so AI tools would run it again. It’s a new build of the testmetest worm from the Miasma family, which grew out of the Shai-Hulud toolkit that went public in May. It also installs a monitor that deletes the user’s home directory when a stolen GitHub token starts returning 401 or 403. Revoking the token, the first thing a responder would do, triggers the wipe. Read more More News Rails Patches 21 Vulnerabilities Including a Critical Active Storage Flaw Rails shipped 8.0.5.2 and 8.1.4.1 on November 4, fixing 21 vulnerabilities including a critical Active Storage flaw that lets unauthenticated attackers write arbitrary files through a crafted upload. It affects apps processing untrusted uploads through ImageMagick with mini_magick. We’ve released a free Certified Patch for teams that can’t upgrade right away. Read more GitHub to Block pull_request_target Workflows by Default Starting December 2 GitHub is blocking the pull_request_target trigger in public repos unless an Actions policy explicitly allows it, closing off the pwn request pattern behind the Nx, PostHog, and TanStack compromises. Safe workflows get caught too, so maintainers running it across dozens of repos will need to allowlist each one before enforcement starts. Read more More Worth Reading Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot Hardening GitHub Actions Against Outside Threats Binance says the $6.34 billion theft started with an engineer installing a tampered Homebrew copy OpenAI’s GPT-6 Cyber found 81 unknown high-severity Firefox vulnerabilities Composer 2.11 Adds Dependency Cooldowns PyPI adds provenance warnings for releases that lose, change, or mix their attestations Socket on X Socket on GitHub Socket on LinkedIn Socket on Bluesky Socket Inc. Secure your supply chain. Ship with confidence. 2810 N Church St., Wilmington, DE 19802 Book a Demo · Unsubscribe [Open and remix this design](https://brew.new/templates/socket/socket-weekly-shai-hulud-descendant-surfaces-in-a-malicious-ruby-gem) [Browse email designs](https://brew.new/browse/templates)