exploit · Sat 25 Jul 2026 · 12:58 UTC
RT by @TheHackersNews: ALERT - A malicious JSON request can become unauthenticated RCE on affected Spring Boot fat-JAR apps running Fastjson 1.x. Fastjson 1.x has no patched release, and ThreatBook and Imperva report attacks targeting the flaw. Learn how it works and who’s exposed: https://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html
Filed UTCSource X ↗
<p>🛑 ALERT - A malicious JSON request can become unauthenticated RCE on affected Spring Boot fat-JAR apps running Fastjson 1.x.<br /> <br /> Fastjson 1.x has no patched release, and ThreatBook and Imperva report attacks targeting the flaw.<br /> <br /> Learn how it works and who’s exposed: <a href="https://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html">thehackernews.com/2026/07/fa…</a></p> <video loop="loop" poster="https://nitter.net/pic/tweet_video_thumb%2FHOEzhTYaUAAQHDA.jpg"> <source src="https://nitter.net/pic/video.twimg.com%2Ftweet_video%2FHOEzhTYaUAAQHDA.mp4"…
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.