[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2NKwd9XyBg9EpivYsn385Q_cS4WdfsbuvVQc-OGjs2M":3},{"article":4,"iocs":54},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":31,"category":32,"article_tags":36},"f624bc70-d608-4c92-90a5-9754a44252e4","Hackers target US firms in FastJson RCE zero-day attacks","hackers-target-us-firms-in-fastjson-rce-zero-day-attacks-acea04","Hackers are actively exploiting a vulnerability in the FastJson open-source Java library, allowing remote code execution without user interaction or elevated privileges. [...]","A critical remote code execution zero-day vulnerability (CVE-2026-16723) in the FastJson Java library is being actively exploited by hackers to target U.S. organizations across various sectors. The flaw affects versions 1.2.68 through 1.2.83 and allows attackers to execute code without user interaction. As FastJson 1.x is no longer actively maintained, there is no immediate fix, and users are advised to enable SafeMode or migrate to fastjson2.","Hackers exploit FastJson RCE zero-day in US firms, targeting multiple industries.","Hackers target US firms in FastJson RCE zero-day attacks By Bill Toulas July 27, 2026 07:49 PM 0 Hackers are actively exploiting a vulnerability in the FastJson open-source Java library, allowing remote code execution without user interaction or elevated privileges. The security issue affects FastJson versions 1.2.68 through 1.2.83 and is leveraged in attacks targeting various organizations in the U.S. The malicious activity was observed last week by the agentic security company ThreatBook, and researchers at the business protection company Imperva confirmed that it was \"targeting a wide range of organizations, across Financial Services, Healthcare, Computing, Retail, Business, and other industries.\" “Attacks are currently almost entirely targeting US-based organizations, with a few attacks in Singapore and Canada, although this will likely continue to expand globally,” Imperva says. Industries targetedSource: Imperva FastJson is an open-source Java library developed by Alibaba, used for serializing Java objects to JSON, and vice versa. The project has 25,600 stars and 6,400 forks on GitHub, and is especially prevalent in Chinese enterprise software and projects built on Alibaba's platform. CVE-2026-16723 was discovered by FearsOff, an offensive security company, which published a technical write-up earlier this month. The researchers explain that the flaw stems from the library’s type-resolution logic, which performs attacker-controlled resource lookups before enforcing AutoType restrictions. This creates a path for executing code remotely in Spring Boot fat-JAR deployments. By abusing @type processing, the researchers were able to load and execute malicious classes without AutoType enabled or requiring third-party gadget chains. No fix available In its security bulletin, Alibaba confirmed the critical severity of the vulnerability and warned that it is exploitable on \"the most common Spring Boot deployment model.\" \"The only deployment prerequisite is that the target runs as a Spring Boot executable fat-jar (i.e., launched via java -jar xxx.jar),\" reads Alibaba's security advisory. The vendor notes that specifying a target class during deserialization does not mitigate CVE-2026-16723, as attackers can embed malicious payloads within ‘Object’ or ‘Map’ fields. The vulnerable type-resolution logic is not present in fastjson2, which uses an allowlist-first model for polymorphic deserialization and doesn’t rely on the @JSONType annotation as a trust signal. Also, FastJson versions 1.2.60 and earlier, and any non-fat-JAR deployments, aren’t affected either. Developers using a version within the affected spectrum are urged to immediately enable SafeMode or switch to a non-impacted build. Currently, there’s no fix issued for CVE-2026-16723. Imperva has also noted that FastJson 1.x is no longer actively maintained, so it’s unlikely it will receive a security update. Test every layer before attackers do Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper Related Articles: CISA orders urgent action on actively exploited Langflow RCE flawCritical Langflow RCE flaw exploited to hack AI app serversCISA sets urgent deadline to fix Cisco flaw exploited in attacksCritical ServiceNow code execution flaw now exploited in attacksCISA: Microsoft SharePoint RCE flaw now actively exploited","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-target-us-firms-in-fastjson-rce-zero-day-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F05\u002F05\u002Fhacker.jpg","2026-07-27T23:49:44+00:00","2026-07-28T00:00:34.838924+00:00",9,[18,21,24,27,29],{"name":19,"type":20},"FastJson","product",{"name":22,"type":23},"Alibaba","vendor",{"name":25,"type":26},"Java","technology",{"name":28,"type":26},"Spring Boot",{"name":30,"type":20},"fastjson2","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":56,"value":57,"context":58},"cve","CVE-2026-16723","FastJson RCE zero-day vulnerability"]