RubyGems: JFrog Artifactory JRuby RubyGems Signing Key Theft & Admin Forgery

Arnold Chan@slaz

•updated Sep 12, 2026•0•0•3

Detects a suspicious sequence of events within JFrog Artifactory where an account accesses sensitive code-signing material (rubygems/gemspec/signing keys) and subsequently performs administrative actions (user addition/role assignment/privilege escalation) within a one-hour window, indicating potential account takeover or exploitation.