Critical Pre-Auth RCE Flaw Found in Fastjson 1.x; No Patch Available

·5 views

A critical remote code execution vulnerability, tracked as CVE-2026-16723, has been disclosed in Fastjson versions 1.2.68 through 1.2.83, scoring as high as 9.8 on the CVSS scale. The flaw requires no authentication and exploits a trusted code path in the @JSONType annotation-handling branch, bypassing both AutoType and safeMode protections entirely. An attacker can host a malicious JAR file over plain HTTP and trigger execution simply by sending a crafted JSON payload to any endpoint calling JSON.parseObject(). Unlike previous Fastjson vulnerabilities, this exploit does not rely on known gadget classes or blacklisted type names, making existing defenses ineffective. Alibaba has declared Fastjson 1.x end-of-life and will not issue a patch, directing users to migrate to Fastjson2.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why classical game-tree search beats LLMs as a browser game opponent

A developer at lkforge.com has built three browser-based game AI engines using classical algorithms — minimax with alpha-beta pruning for tic-tac-toe, expectimax for 2048, and breadth-first search for Color Lines — deliberately avoiding large language models. The tic-tac-toe engine delivers a provably optimal move in roughly 0.3 milliseconds, runs entirely on-device with no server calls, and has not lost a single game across 1,200 self-play tests. The developer argues that LLMs, trained to predict text tokens rather than search game trees, can explain strategy fluently but still make losing moves, making them unsuitable for solved games with finite rule sets. By contrast, the deterministic nature of classical search allows precise performance benchmarking, such as the 2048 solver reaching the 2048 tile in 69.6% of 250 self-play games. The project frames the choice not as anti-LLM but as matching the right tool to the problem — classical search for fixed-rule board games, language models for language tasks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

IonQ and Oak Ridge Lab Use Generative AI to Automate Quantum Circuit Design

Researchers from IonQ and Oak Ridge National Laboratory have developed a generative AI method that automates the design of quantum optimization circuits, eliminating the need for time-consuming manual parameter tuning. The system uses a transformer-based model — the same architecture behind large language models — trained on examples of high-quality, near-optimal circuits from previous manual workflows. For each subproblem, the AI generates ten candidate circuits, which are then simulated and evaluated, with the best-performing one selected to contribute to the overall solution. Benchmark tests on a 100-variable problem showed that as subproblem size scaled from 4 to 12 qubits, the traditional trial-and-error approach ballooned from 34 seconds to over 11 minutes, while the AI method kept pace far more efficiently. The advancement is seen as a key step toward making hybrid quantum systems practical for larger, real-world industrial and scientific applications.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Experiment Shows External Memory Can Restore Learned Behavior After Full Brain Reset

A developer built a small recurrent neural network paired with an external memory system to test whether learned experience could survive a complete substrate reset. The experiment used a fixed cue-response task where the network had to map specific inputs to correct actions, with chance performance at 33%. Results showed that external memory alone achieved near-perfect accuracy, while plasticity alone underperformed at roughly 47%, and combining both yielded 88%. Crucially, the memory system was constrained to only bias internal network states rather than directly select actions, preserving the integrity of the test. The key finding was that externally stored experience could reinstate correct behavior in a reset network that had never independently learned the task.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Flock Safety Cameras Found to Contain Serious Security Flaws and Hardcoded Credentials

Security researcher Micah Lee has uncovered multiple vulnerabilities in Flock Safety's license plate recognition cameras, including hardcoded credentials embedded in the devices. These flaws could potentially allow unauthorized actors to gain access to the cameras or the data they collect. Flock Safety cameras are widely deployed by law enforcement agencies across the United States to monitor vehicle movements. The findings raise significant privacy and security concerns given the sensitive nature of the surveillance data these devices capture and store.

0 comments Read more at Hacker News