Loading story…
A HITCON wargame write-up demonstrated that disclosure of a Django application's SECRET_KEY can enable remote code execution when the application uses signed-cookie sessions backed by Python Pickle serialization. Django signs serialized cookie data with an HMAC-SHA1 value derived from the secret key, intended to prevent clients from modifying session content.
An attacker with the exposed key can generate a valid signature for a crafted cookie containing a malicious Pickle object. If the server accepts and deserializes that cookie, the payload executes in the application process, turning a configuration-secret leak into server compromise. Organizations using legacy Django signed-cookie or Pickle-based session handling should rotate exposed keys, invalidate existing sessions, and eliminate unsafe deserialization.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A “Pwn3d 500” example presented at tw.PyCon.org 2013 demonstrated that disclosure of a Django SECRET_KEY could let an attacker forge HMAC-SHA1-signed cookies containing malicious Pickle payloads, resulting in remote code execution when deserialized.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
mochazz.github.io
Open sourceblog.orange.tw
Open sourcectftime.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Critical deserialization flaws were disclosed in multiple AI and robotics components, allowing attackers to execute arbitrary code by sending crafted `pickle` payloads to exposed services. In Hugging Face’s **LeRobot** `0.4.3`, CVE-2026-25874 affects the async inference `PolicyServer`, where the `SendPolicyInstructions` and `SendObservations` gRPC handlers call `pickle.loads()` on attacker-controlled bytes before validation. The service is exposed over an insecure gRPC port with no TLS or authentication, making network-accessible deployments vulnerable to unauthenticated remote code execution; the issue was rated **CVSS 9.8** and no fix was available at disclosure. A separate flaw, CVE-2026-26210, was reported in **ktransformers**’ legacy `balance_serve` backend, where a ZeroMQ `ROUTER` socket bound on all interfaces forwards untrusted messages to worker threads that also invoke `pickle.loads()` without authentication, enabling unauthenticated remote code execution and prompting a fix PR.
Jun 29, 2026
A review of a FlappyPig-operated CTF platform found that it used Apache Shiro 1.2.4's `CookieRememberMeManager` with a hard-coded AES key. The key allowed an authorized researcher to decrypt and forge serialized RememberMe cookies, triggering unsafe Java deserialization on the server. Standard CommonsCollections gadget chains were impeded by Shiro's custom class-loading behavior, but a URLDNS payload confirmed deserialization. The researcher then used a `JRMPClient` gadget chain with a malicious JRMP listener to achieve remote command execution; the issue was disclosed to FlappyPig before the write-up was published.
Sep 3, 2026
Django issued security releases `5.2.9`, `5.1.15`, and `4.2.27` to fix **CVE-2025-64460**, a denial-of-service vulnerability in the framework's XML deserialization logic. The flaw is rooted in `django.core.serializers.xml_serializer.getInnerText()`, where specially crafted XML can trigger excessive CPU and memory consumption, allowing a remote attacker to exhaust resources and disrupt affected applications. The issue was reported by Seokchan Yoon and affects supported Django branches before those patched versions; unsupported branches including `5.0.x`, `4.1.x`, and `3.2.x` were not evaluated and may also be exposed. Red Hat classified the bug as **Important** with a CVSS v3.1 score of `7.5` and said no acceptable mitigation was available at publication, making patching the primary response. The company warned that products using Django's XML Deserializer may be affected, including **Red Hat Ansible Automation Platform**, **Red Hat OpenStack Platform**, and **OpenShift Service Mesh**, and published fixes for multiple Ansible Automation Platform releases through advisories `RHSA-2026:1249`, `RHSA-2026:1497`, and `RHSA-2026:1506`.
Aug 20, 2026