Security firms ThreatBook and Imperva report attackers targeting a critical flaw in Fastjson, Alibaba's widely used JSON library for Java. On affected Spring Boot applications, a malicious JSON request can execute code without authentication, running with the privileges of the Java process. Tracked as CVE-2026-16723 with an Alibaba-assigned score of 9.0, the confirmed chain needs Fastjson 1.2.68 through 1.2.83, a Spring Boot executable fat-JAR, a network-reachable path that feeds attacker-controlled JSON to the parser, and SafeMode left at its disabled default. Notably, the AutoType feature can stay off and no classpath gadget is required. As of July 25, Alibaba had not shipped a fixed 1.x version.
LevelBlue detailed QuimaRAT, a new Java-based remote access trojan sold as a service that runs across Windows, Linux, and macOS from the same codebase. Subscriptions range from about $150 for a month to $1,200 for lifetime access, lowering the bar for attackers to get cross-platform reach. Built around a modular design, it expands its capabilities through encrypted plugins that operators can load, update, or remove from their command server on the fly. It also uses several obfuscation techniques to keep changing how it looks to security tools without altering its behavior, so signatures based on its appearance are likely to go stale quickly.
TrustStrike Labs