Critical Fastjson 1.x Flaw Enables Unauthenticated RCE in Spring Boot Apps

·2 views

A critical vulnerability, CVE-2026-16723, has been identified in Fastjson versions 1.2.68 through 1.2.83, allowing unauthenticated remote code execution in applications deployed as Spring Boot executable fat-jars. Attackers can exploit the flaw by sending a crafted JSON payload containing an @type field, which bypasses AutoType restrictions and triggers a lookup to attacker-controlled infrastructure without requiring user interaction or login. The vulnerability was reported by SecurityWeek on July 28, 2026, with supporting advisories from Alibaba, Imperva, and ThreatBook confirming active exploitation in the wild. Successful exploitation can grant attackers OS-level or container-level code execution, potentially enabling credential theft, webshell deployment, and lateral movement. Mitigations include migrating to Fastjson 2.x, enabling SafeMode, blocking suspicious JSON at the WAF or API gateway, and enforcing least-privilege isolation for Java processes.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Flutter's FutureBuilder Widget Simplifies Displaying Async Data in UI

Flutter's build method is synchronous and cannot natively wait for asynchronous operations like API calls to complete before rendering the UI. The FutureBuilder widget addresses this limitation by accepting a Future value and rebuilding the UI as the asynchronous state changes. Developers can use its snapshot object to handle three distinct states: loading, error, and data-available, each rendering a different widget. A practical example involves a weather app that shows a loading spinner while fetching temperature data, then displays the result or an error message once the Future resolves. FutureBuilder requires only two parameters — future and builder — making it one of the more straightforward widgets in the Flutter framework.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Software Documentation Should Record Decisions, Not Just Describe Code

A recurring problem in software projects is that documentation is written too late and focuses on how code works rather than why it was built that way. Without recorded reasoning, future developers are left guessing at the intent behind architectural choices, data models, and design trade-offs. This guesswork leads to wasted effort, such as refactoring stable code or preserving complexity that no longer serves a purpose. Even well-structured, readable code cannot capture the product constraints, rejected alternatives, or uncertainties that shaped a given decision. Short decision-focused notes that explain the context behind choices are argued to be far more valuable than exhaustive technical descriptions alone.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Andrew Ng's OpenWorker Brings Local-First AI Agent to Developers via MIT License

Andrew Ng released OpenWorker in late July 2026, an MIT-licensed desktop AI agent that runs locally and connects directly to a user-chosen LLM provider using the developer's own API key. Built as a Tauri and React app over a local Python server, it takes high-level outcome instructions, breaks them into steps, and delivers finished artifacts such as drafted documents, calendar changes, or composed messages. Unlike many chat-based agents, OpenWorker classifies every tool action into one of four risk tiers and offers five permission modes, ensuring the agent pauses for human approval before executing consequential operations. The system is built on Ng's provider-agnostic aisuite library, supporting roughly 30 verified models across providers including OpenAI, Anthropic, Google, and several open-weight options. Credentials and connector tokens are stored in a local secret store, with model calls routed directly to the chosen provider, limiting cloud exposure to an optional OAuth broker for third-party app connections.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Anthropic's Jacobian Lens Repurposed to Improve LLM KV Cache Memory Management

Anthropic published a paper on July 6 introducing J-space and the Jacobian lens, tools originally designed for interpretability and alignment auditing of language models. A developer independently applied these concepts to a different problem: determining which entries in an LLM's KV cache can be safely discarded during long inference sessions. Unlike existing methods such as H2O and SnapKV, which rely on past attention history, the proposed approach uses workspace content signals computed at prefill time to predict which cached tokens will matter in future reasoning. The method was validated against three pre-registered kill gates and successfully replicated across three Qwen models — Qwen2.5-7B, Qwen3-8B, and Qwen3-4B. The implementation has been integrated into EVOKE, a KV cache memory manager built on a forked version of llama.cpp.

0 comments Read more at DEV Community