No Patch, No Problem (For Attackers)

Security researchers at ThreatBook and Imperva have confirmed active exploitation attempts targeting a critical vulnerability in Fastjson, according to The Hacker News. Fastjson is a popular Java library built by Alibaba that converts data between JSON format and Java objects. It is widely used in enterprise web applications across finance, healthcare, and retail.

The flaw, tracked as CVE-2026-16723, allows an attacker to send a crafted JSON request to a vulnerable application and execute arbitrary code on the server without needing to log in. The attack requires no special setup on the attacker's side — no pre-existing access, no special tools.

Here is the uncomfortable part: as of July 25, Alibaba had not released a patched version of Fastjson 1.x. The latest release, version 1.2.83, remains vulnerable. Imperva observed exploitation attempts hitting organisations in financial services, healthcare, and retail, primarily in the United States, with activity also recorded in Singapore and Canada.

While neither firm has confirmed a successful compromise of a real-world target, the activity is real and the window of exposure is open.

What you should do: If you or your team maintain Java applications, check whether Fastjson 1.2.68 through 1.2.83 is a dependency — direct or transitive. Until a patch exists, enable SafeMode by adding -Dfastjson.parser.safeMode=true to your startup configuration. The longer-term fix is migrating to Fastjson2, which is not affected by this flaw.

A campaign called SourTrade has refined a technique where the victim's own browser assembles the final malware file from innocent-looking pieces, according to threat intelligence firm Confiant, as reported by The Hacker News.

The attack begins with fake ads impersonating legitimate trading platforms such as TradingView and Solana. When a targeted user clicks through, the phishing page quietly instructs the browser to download fragments: a clean, legitimate runtime application called Bun, a configuration file containing Base64-encoded (data encoded as text for safe transmission) payload chunks, and a set of random values used to vary the final file's digital fingerprint. The browser's background worker then stitches these fragments together into a complete Windows executable, meaning no single complete malware file ever travels across the network where a security tool might catch it.

The campaign has been running since late 2024 across 12 countries and 25 languages.

What you should do: Only download trading or cryptocurrency wallet software directly from the vendor's official website. Never install software prompted by an advertisement, regardless of how convincing it looks.

What Fastjson is: Fastjson is an open-source Java library maintained by Alibaba that parses and generates JSON (a common data exchange format), used extensively in enterprise web services and APIs.

What it is: An attacker can send a specially crafted JSON request containing a malicious @type field (a directive that tells Fastjson which Java class to load) to a vulnerable application endpoint. Without any prior authentication or special privileges, this causes the server to load and execute attacker-controlled code.

Who's at risk: Developers and organisations running Java applications packaged as Spring Boot fat-JARs (self-contained executable files that bundle all dependencies) using Fastjson versions 1.2.68 through 1.2.83 with SafeMode left at its disabled default. Standard WAR deployments on Tomcat or Jetty are not affected.

CVSS: 9.0 (Critical — patch today; no fix yet exists, so apply mitigations immediately.)

Root cause: Fastjson's type-resolution path trusts an attacker-supplied @type value and converts it into a class-resource lookup. When running inside a Spring Boot fat-JAR, this lookup can traverse nested JAR paths, fetch attacker-controlled bytecode from a remote location, and then treat an @JSONType annotation in that retrieved resource as a verification signal. Because that annotation is treated as evidence the class is trustworthy, Fastjson loads and executes the class. The developer failure here is allowing attacker-controlled input to influence which code gets loaded and trusted at runtime — without any independent validation.

Attack vector: An attacker identifies a network-reachable endpoint that passes user-supplied JSON to JSON.parse, JSON.parseObject(String), or JSON.parseObject(String, Class). They submit a payload embedding a crafted @type value pointing to a nested JAR path they control. Fastjson follows that path, retrieves the attacker's bytecode, reads the @JSONType annotation as a trust signal, and loads the class — executing the attacker's code with the full privileges of the Java process. No login, no existing access, and no classpath manipulation required.

Detection strategies:

1. Look for outbound connections from your Java application process to unexpected external hosts, particularly fetching .jar files.
2. Monitor application logs for @type values referencing unusual class names, nested JAR paths, or /proc/self/fd references.
3. Watch for unexpected child processes spawned by your Java application, or new files appearing in application directories without a deployment event.

Recommended actions:

1. Inventory all Fastjson dependencies, including transitive ones pulled in by other libraries, and confirm whether versions 1.2.68–1.2.83 are present.
2. Apply the immediate mitigation: add -Dfastjson.parser.safeMode=true to your JVM startup flags, or switch to the com.alibaba:fastjson:1.2.83_noneautotype build.
3. Begin planning migration to Fastjson2, which does not share this type-resolution path and is Alibaba's stated long-term fix.

CTM360 researchers documented an evolved insurance phishing campaign, reported by The Hacker News, where attackers no longer just collect your credentials to use later. Instead, a fake insurance portal acts as a live middleman: as you type your username and password, the attacker simultaneously submits them to the real insurance site in real time, completing the login before you realise anything is wrong.

The primary entry point was fake Google Ads promoting insurance quotes and renewals.

CTM360's report does not identify a single technical control that defeats this entirely, but the most reliable protection it implies is avoiding the attack's starting point. Before entering any credentials on an insurance or financial portal, type the organisation's URL directly into your browser rather than clicking any advertisement or search result link. Check the full URL in your address bar carefully before submitting anything.

No major compliance updates today.

This week's threat landscape offers no respite: active exploitation of an unpatched Java library flaw and a sophisticated browser-based malware delivery campaign both carry significant implications for organisations subject to data protection obligations. If your team operates affected Java services, document your mitigations now — regulators will ask.