July 25 desk: Fastjson CVE-2026-16723, GitLab RCE PoC

No patch for CVE-2026-16723. That is the line from July 25. Fastjson 1.x under confirmed active attack, CVSS 9.0, and nothing to install.

Vulnerabilities — patch queue

Fastjson CVE-2026-16723 — CVSS 9.0, no patch — Confirmed active exploitation per ThreatBook and Imperva, 2026-07-25. Alibaba’s Fastjson library for Java, version 1.x; affected deployment is Spring Boot applications. Attack vector: a malicious JSON request in the HTTP body executes code without authentication, running with the privileges of the Java process. The confirmed chain requires no user interaction. No 1.x patch available as of writing. Mitigation path: migrate to Fastjson 2.x, which uses a different deserialization model, or block deserialization of untrusted JSON at a WAF layer. Confidence: confirmed, active exploitation, no patch.

GitLab authenticated RCE PoC — self-managed 18.11.3 — Researcher Yuhang Wu (depthfirst) published a working PoC on 2026-07-25. Any authenticated user — no administrator rights, no CI/CD runner access — can execute commands as git by committing two crafted Jupyter notebooks and requesting their diff. No victim interaction required beyond the attacker holding a valid account. Confidence: confirmed, PoC is public. Self-managed GitLab operators: watch GitLab’s security release channel for a fixed build and apply it on arrival. Source: The Hacker News.

Threat intel — active campaigns

SourTrade in-memory malware assembly — Active since at least late 2024; documented by Confiant on 2026-07-23. The campaign serves the final Windows executable as fragments; the victim’s browser reassembles them using the legitimate Bun JavaScript runtime. No complete malicious binary is served from a fixed URL — the payload exists only in browser memory until executed. Impersonation targets: TradingView, Solana, Luno. Primary targets: retail traders. Detection note: Bun is a legitimate, signed runtime; network traffic resembles normal web activity until assembly completes. Confidence: confirmed research, active campaign.

Steam ClickFix — XMRig delivery — Attackers posting fake game-fix threads in Steam discussion forums. Posts present as technical support and instruct users to run a command that downloads XMRig cryptominer. Attack surface: any user who follows instructions from a gaming forum post. Confidence: confirmed, 2026-07-25. Mitigation: no command execution from gaming forum posts.

ShinyHunters breach data → sextortion — Campaign confirmed as of 2026-07-25. Email addresses from ShinyHunters-attributed leaks used in $2,000 Bitcoin sextortion demands; personal details from breach records populate individual emails to increase perceived credibility. Attribution of the sextortion operation itself: unconfirmed — whether ShinyHunters operators are running it or a secondary buyer acquired the list is not established in current reporting. ShinyHunters-sourced breach data has now surfaced in two confirmed downstream campaign categories: corporate credential abuse (Entra SSO, Salesforce OAuth) and consumer sextortion. If your address appeared in a ShinyHunters-linked breach, treat it as a persistent exposure. Confidence: active campaign confirmed.

CTM360 — AiTM insurance phishing — CTM360 research published 2026-07-25 documents a shift from credential harvesting to real-time adversary-in-the-middle interception in insurance-sector phishing. The attacker proxies the victim’s session to the legitimate site and captures session tokens as they are issued — bypassing MFA, because the legitimate site sees a valid authenticated session. Confidence: confirmed research; active campaigns documented.

RaaS tracker

DevMan / Funky Mantis RaaS portal — PRODAFT documented a centralized affiliate platform providing payload generation, victim tracking, and earnings management in one interface. Tracked as Funky Mantis. Platform is actively maintained. Specific sector targeting: not characterized in current reporting. Confidence: confirmed via PRODAFT research, 2026-07-25.

What to watch

1. Fastjson no-patch window. CVSS 9.0, confirmed active exploitation, no patch available. Any Spring Boot application that deserializes untrusted JSON at an externally accessible endpoint is at risk now. Mitigation: WAF-layer blocking of malicious deserialization attempts or migration to Fastjson 2.x. Watch Alibaba’s security advisories for a 1.x patch. Analysis: CVE-2026-16723 meets CISA KEV criteria on current facts — confirmed exploitation, no patch, named CVE; a KEV addition is a plausible near-term outcome, unconfirmed.
2. GitLab patch window. Working PoC is public; any authenticated account on an unpatched self-managed instance is an RCE surface. Action: monitor GitLab’s security release channel and apply the patch on arrival.
3. In-browser payload assembly as a technique. SourTrade’s use of a legitimate signed runtime to assemble a final payload inside browser memory reduces static detection surface substantially. Analysis: the technique has broad applicability; whether other campaigns adopt it is unconfirmed but the evasion value is observable in the SourTrade data — it is a pattern worth tracking.

— airgap