Full Daily Digest

The vulnerability stems from Fastjson's type-resolution mechanism, where an attacker-controlled @type value can trigger a class-resource lookup. In Spring Boot fat-JAR deployments, this allows fetching and executing malicious bytecode. The exploit chain bypasses AutoType checks and requires no classpath gadget, making it particularly dangerous. Affected systems include those running Fastjson 1.2.68 to 1.2.83 with Spring Boot fat-JARs and disabled SafeMode. Mitigations include enabling SafeMode (-Dfastjson.parser.safeMode=true) or using the restricted build com.alibaba:fastjson:1.2.83_noneautotype. Long-term, migrating to Fastjson2 is advised. Organizations should monitor for suspicious @type values, nested JAR URLs, and unexpected outbound connections.

The Hacker News · 2026-07-25 · Vulnerability: Attackers are exploiting a critical RCE flaw in Fastjson 1.x (CVE-2026-16723) targeting Spring Boot applications, with no patch currently available.

The vulnerability leverages two memory corruption bugs in Oj, a Ruby JSON parser, to achieve RCE through GitLab's notebook renderer. Attackers commit malicious Jupyter notebooks, triggering heap pointer leaks and callback manipulation to execute arbitrary commands. The exploit requires no admin rights or CI access, making it highly accessible to low-privilege users. Affected versions span multiple GitLab releases, with patches available in 18.10.8, 18.11.5, and 19.0.2. The lack of a CVE or CVSS score delayed awareness, leaving unpatched systems at risk. Mitigation requires immediate upgrades, as older versions receive no backports. The exploit's portability is limited to specific GitLab configurations, but the underlying Oj bugs are general, posing broader risks.

The Hacker News · 2026-07-25 · Vulnerability: Authenticated users can exploit a GitLab RCE flaw via crafted Jupyter notebooks to run commands as the 'git' user.

The attack path begins with victims lured to phishing sites mimicking legitimate insurance portals. Unlike traditional phishing, attackers authenticate in real-time as victims enter credentials, often intercepting OTPs to bypass multi-factor authentication. This method exploits the seamless digital services offered by insurers, which include policy management and claims submission. The compromised accounts contain extensive personal data, enabling identity theft and financial fraud. Mitigation requires layered defenses: implementing behavioral analytics to detect anomalous session activity, enhancing MFA with phishing-resistant methods like FIDO2, and integrating threat intelligence to map and disrupt attacker infrastructure. Security teams should also educate users on recognizing sophisticated phishing attempts.

The Hacker News · 2026-07-25 · Incidents: Insurance phishing now involves real-time account hijacking during active sessions, bypassing traditional detection methods.

The attack path begins with exploiting a pre-authentication information disclosure flaw in FlexPLM's WSDL endpoint, chained with a server-side vulnerability in Windchill's login servlet. This allows unauthenticated RCE and deployment of JSP web shells. Attackers then enumerate file systems, exfiltrate sensitive data, and execute double extortion. The campaign primarily targets high-value sectors like manufacturing and aerospace, leveraging CVE-2026-12569, a critical flaw in Windchill. Mitigations include patching vulnerable systems, restricting internet exposure of Windchill and FlexPLM, and monitoring for the provided IoCs. Organizations should also educate employees on recognizing extortion emails and implement robust endpoint detection and response (EDR) solutions.

The Hacker News · 2026-07-25 · Incidents: Cl0p ransomware affiliates exploit PTC Windchill and FlexPLM flaws for unauthenticated RCE and data extortion.

The DevMan RaaS platform represents a significant evolution in ransomware operations, combining payload generation, victim management, and financial tracking into a single interface. This modular approach lowers the barrier to entry for affiliates while increasing operational efficiency. The group's shift from affiliate to independent operator underscores the profitability of RaaS models. The SCADA locker development indicates a dangerous escalation in targeting critical infrastructure, with potential for physical damage beyond data encryption. The insider threat incident involving Huntress highlights the risks of unregulated researcher-threat actor interactions, necessitating stricter policies and oversight. Defenders should monitor for DevMan-associated IOCs, particularly in industrial environments, and review internal protocols for engaging with threat actors.

The Hacker News · 2026-07-25 · Incidents: DevMan RaaS operates a centralized portal for affiliates, with recent insider threat concerns after a Huntress employee leaked FBI communications.

The vulnerabilities stem from improper validation of user-supplied data, leading to out-of-bounds write conditions. Attackers could leverage social engineering to deliver malicious Arena files, exploiting the trust users place in routine file types. While Arena doesn’t control physical processes, its integration in supply chains and critical infrastructure increases the risk of lateral movement. Mitigations include upgrading to version 17.00.01, restricting file execution privileges, and training users to recognize suspicious files. The researcher identified 17 flaws, but Rockwell grouped them into four CVEs, highlighting potential underreporting of similar issues.

SecurityWeek · 2026-07-25 · Vulnerability: Rockwell patches four high-severity memory corruption flaws in Arena Simulation software, requiring user interaction for arbitrary code execution.