Loading story…
Gabriel Lawrence and Chris Frohoff detailed how applications that deserialize attacker-controlled objects can be manipulated to alter state, bypass business logic, or execute arbitrary code. The issue spans Java, Python, PHP, Ruby, and JSF implementations where serialized data is accepted through cookies, tokens, caches, RPC streams, or client-side ViewState values.
Examples include tampering with Java and Python serialized cookies, abusing PHP serialized objects in Memcache, modifying JSF ViewState expression-language data, and targeting Java deserialization exposed through MyFaces ViewState and RMI Registry. The presentation demonstrated tools such as ysoserial and ViewStateMesser and recommends eliminating open-ended deserialization, allowlisting permitted classes and types, authenticating data before deserialization, hardening exposed services, and retaining session state server-side where feasible.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Gabriel Lawrence and Chris Frohoff presented “Marshalling Pickles,” a talk surveying insecure serialization and deserialization vulnerabilities, exploitation techniques and tools, and mitigations across several languages and frameworks.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Jackson applications that deserialize attacker-controlled JSON with insecure polymorphic type handling can be coerced into instantiating dangerous classes. Research tracked as **CVE-2019-12384** showed that `ch.qos.logback.core.db.DriverManagerConnectionSource` can be used as a gadget to initiate attacker-selected JDBC connections, creating server-side request forgery (SSRF) and denial-of-service exposure. Where the H2 JDBC driver is available, a crafted JDBC URL using H2's `INIT=RUNSCRIPT` capability can load a remote SQL script and escalate the condition to remote code execution. Jackson's historic reliance on a denylist of known gadget classes means newly identified gadgets may remain exploitable until blocked; organizations should avoid unsafe polymorphic/default typing for untrusted input, update Jackson and dependent Java libraries, and review applications for exposed deserialization endpoints.
Aug 28, 2026
Apache disclosed **CVE-2026-50076**, an important- to high-severity deserialization vulnerability in the Java SDK of Apache Fory that affects `org.apache.fory:fory-core` versions before `1.1.0`. The flaw lies in the Java `ReplaceResolverSerializer` replace-resolve path, where incomplete verification allows crafted Fory serialized data to bypass class registration requirements, `TypeChecker` enforcement, and `DisallowedList` protections during deserialization. If an application processes untrusted external data streams, a remote attacker can trigger classpath-present `readResolve` and `readExternal` hooks on Java/JVM systems, creating a path to unauthorized code execution on backend servers. Apache fixed the issue in version `1.1.0` by adding stricter sanitization checks before deserialization and advised users to upgrade immediately and review deployments that deserialize externally supplied data; the vulnerability was reported by Venkatraman Kumar (**r3dw0lfsec**) of Securin.
Jun 29, 2026
A critical deserialization vulnerability in **Fastjson 1.2.x** allows unauthenticated remote code execution by abusing the library’s internal type-resolution logic, bypassing traditional `autoType` blacklist and whitelist protections without requiring third-party gadget classes on the target system. Public disclosure and proof-of-concept details identified affected versions as **1.2.68 through 1.2.83** when **SafeMode** is disabled, with researchers noting that **Spring Boot fat-jar** classloading can enable attacker-controlled remote class loading over HTTP. Analysis indicates the flaw is most likely to produce full RCE on **JDK 8**, while newer JDK versions may limit impact to **SSRF** in some environments.
Jul 25, 2026