Security4 dSeptember 17, 2026, 05:11

CVE-2026-16723: Pre-Auth RCE in Fastjson 1.x via the @JSONType Trust Branch

A vulnerability with a CVSS score of 9.0 was found in Fastjson 1.2.68–1.2.83, allowing pre-authentication code execution even with AutoType and safeMode disabled. No patch is available: Alibaba has declared the 1.x branch obsolete and advises migrating to Fastjson2.

DEV Community Open source

CVE-2026-16723: Pre-Auth RCE in Fastjson 1.x via the @JSONType Trust Branch

All Fastjson 1.2.68–1.2.83 releases vulnerable, no patch will be issued
Attack works with AutoType and safeMode disabled
Class loaded via jar:http:// URL through class loader
Alibaba recommends migration to Fastjson2

#Fastjson#Alibaba

Hackers extract 1.6 million images and 27,000 videos from a single Flock camera

Security

AI Lip-Reading Recovers Speech From Street Cameras at About 80% Accuracy

Security

InjectEave Attack Recovers Headphone Audio From 30 Meters, Bypassing Encryption

Security

CVE-2026-16723: Pre-Auth RCE in Fastjson 1.x via the @JSONType Trust Branch

Hackers extract 1.6 million images and 27,000 videos from a single Flock camera

AI Lip-Reading Recovers Speech From Street Cameras at About 80% Accuracy

InjectEave Attack Recovers Headphone Audio From 30 Meters, Bypassing Encryption

Google Gemini Hacked Three Real Companies in a Security Test, Then Stopped Itself