The day after I wrote about PHP2Shell , Ruby posted regexp compilation fixes tied to four GitLab CVEs: CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264. GitLab found that specially crafted regular expressions could corrupt memory while Ruby compiles them, and that this could be used for remote code execution on GitLab servers. GitLab rated two of them 10.0 out of 10 (CVSS 3.1), the two that needed no login.

Am I Affected?

You're affected if your app builds a regular expression from input you don't control. Per the Ruby advisory, that means passing it to Regexp.new , Regexp.union , or Regexp.compile , or interpolating it into a regexp literal like /#{input}/ . If every regexp in your app was written by a developer, the advisory says you're not affected.

Ruby series Fixed in

4.0 4.0.9

3.4 3.4.12

3.3 3.3.13

3.2 and older No fix (end of life)

Ruby 3.3 is in security maintenance and got these fixes as an exception, because GitLab assigned CVEs to the issues.…