TL;DR
Fastjson RCE (CVE-2026-16723) under active attack with no patch available; GitLab RCE exploit published; malvertising campaigns assembling malware in-browser to evade detection. Three distinct attack vectors active today.
Executive Summary
- Fastjson 1.x (Alibaba JSON library) suffers unauthenticated RCE in Spring Boot apps; actively exploited by multiple threat actors with no vendor patch available.
- GitLab security researchers released working RCE exploit for self-managed instances on version 18.11.3 and earlier; any authenticated user pushing to a project can execute commands as git.
- SourTrade malvertising campaign constructs Windows executables in-browser memory using legitimate Bun runtime, fragmenting delivery to evade URL-based detection.
- Cl0p affiliates exploiting pre-authentication RCE in internet-exposed PTC Windchill and FlexPLM deployments in new data extortion campaign.
- Insurance and financial sector phishing has evolved to real-time account hijacking rather than credential-collection-for-later model.
Top Threats Today
1. Fastjson RCE Actively Exploited; No Patch Available
Severity: CRITICAL Affected: Technology
Security firms ThreatBook and Imperva report active attacks targeting CVE-2026-16723, a critical remote code execution vulnerability in Fastjson 1.x (Alibaba's JSON library for Java) [1]. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process [1]. The vulnerability is currently under active exploitation with no patched version available from the vendor [1].
Sources:[1] The Hacker News
Recommended Action
- Inventory all Spring Boot applications using Fastjson 1.x and isolate from untrusted network paths immediately.
- Implement strict input validation and Web Application Firewall rules to block malformed JSON requests.
- Monitor Java application logs for unexpected process execution or code evaluation attempts.
- Engage Alibaba or consult security advisories for available workarounds pending patch release.
2. GitLab RCE Exploit Published; Self-Managed Servers at Risk
Severity: HIGH Affected: Technology
Security researchers at depthfirst published working exploit code on July 24 for a GitLab vulnerability that GitLab patched six weeks earlier, on June 10 ⚠[1]. The flaw allows any authenticated user who can push to a project to run commands as git on any self-managed server running GitLab 18.11.3 or earlier that has not taken the update [1].
Sources:[1] The Hacker News
Recommended Action
- Verify all self-managed GitLab instances are updated to the patched version released June 10 or later.
- Restrict push access to trusted developers only; implement code review workflows.
- Monitor git command execution logs for unexpected process spawning or privilege escalation.
- If unpatched instances exist, segment them from production environments pending immediate upgrade.
3. SourTrade Malvertising Assembles Malware In-Browser to Evade Detection
Severity: HIGH Affected: Technology
A malvertising operation dubbed SourTrade is fragmenting Windows executable delivery, instructing victims' browsers to assemble the final malware from multiple pieces using a legitimate Bun runtime as the base [1]. A related campaign uses fake Solana, Luno, and TradingView webpages with malicious JavaScript to construct malware directly in memory [2]. This technique bypasses traditional URL-based threat detection and file-based scanning [1].
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- Deploy browser isolation or sandboxing for users accessing financial/crypto trading and payment platforms.
- Block or restrict access to known malvertising networks and ad exchanges flagged in threat intelligence feeds.
- Monitor for unexpected Bun runtime execution or JavaScript-driven process spawning on user endpoints.
- Educate users on the risks of clicking ads on forums, discussion boards, and third-party sites.
4. Cl0p Affiliates Exploit Internet-Exposed PTC Manufacturing Software
Severity: HIGH Affected: Manufacturing
Threat actors linked to the Cl0p ransomware campaign are actively exploiting unauthenticated RCE flaws in internet-exposed PTC Windchill and FlexPLM deployments as part of a new data extortion campaign [1]. Attackers chain a pre-authentication information disclosure flaw with code execution to gain initial access [1].
Sources:[1] The Hacker News
Recommended Action
- Audit all PTC Windchill and FlexPLM instances for internet exposure; move to private networks or VPN-only access.
- Apply latest security patches from PTC and enable authentication on all endpoints.
- Monitor for data exfiltration and unusual file access patterns in PTC environments.
- Review backup integrity and offline copies of critical CAD/product lifecycle data.
5. Real-Time Account Hijacking Replaces Traditional Phishing in Financial Sector
Severity: HIGH Affected: Finance
CTM360 research reveals that insurance and financial phishing campaigns have evolved from credential collection (username/password) to real-time account hijacking during the victim's active session [1]. This shift enables attackers to access accounts immediately rather than waiting for an opportune moment [1].
Sources:[1] The Hacker News
Recommended Action
- Mandate hardware security keys or push-notification MFA for all customer-facing banking portals; avoid SMS or TOTP alone.
- Implement step-up authentication for high-risk actions (fund transfer, password reset, account lockdown).
- Deploy real-time transaction monitoring and alert customers to suspicious simultaneous logins or geo-shifts.
- Train customer service teams to recognize and respond to account takeover indicators within minutes.
Today’s Action Checklist
- ☐ URGENT: Audit Spring Boot deployments for Fastjson 1.x library; segment or apply input filtering immediately pending vendor patch.
- ☐ URGENT: Verify all self-managed GitLab instances are patched to June 10, 2026 release or later.
- ☐ Implement browser isolation or sandbox environment for staff accessing cryptocurrency and trading platforms.
- ☐ Scan network for internet-exposed PTC Windchill and FlexPLM instances; move to private/VPN-only access.
- ☐ Review financial/insurance customer authentication policies; prioritize hardware security keys and step-up MFA for transactions.