PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Log4j FilteredObjectInputStream Bypass: Pre-auth RCE via MarshalledObject

github.com | vulnerability | Critical | #rce | #public-poc | #java | #deserialization | #pre-auth | #authentication | #vulnerability | #log4j | #apache | #commons-collections | #serialization | #poc | #filteredobjectinputstream | #marshalledobject
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Pre-auth RCE on Java services deserializing LogEvent: Log4j's FOIS allowlist falls to LogEventProxy's MarshalledObject, whose .get() opens an unfiltered stream, executing hidden CC6 gadget chains.

Why it matters

This PoC demonstrates an unexpected filter-bypass gadget in Log4j 2, emphasizing the danger of unauthenticated serialized object ingestion.
Vendor
Apache
Product
Log4j 2
Affected versions
log4j-api 2.11.0–2.24.3, log4j-core 2.8.0–2.24.3
CVSS
9.8
Published
Collected

Related coverage

vulnerability · netspi.com
PHP2Shell Unauthenticated RCE on PHP: CVE-2026-109618 & CVE-2026-109619
# PHP2Shell Unauthenticated RCE on PHP: CVE-2026-109618 & CVE-2026-109619 October 21, 2026 ### Team NetSPI The PHP project has disclosed two critical vulnerabilities, CVE-2026-109618 and...
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
Critical · vulnerability · github.com
php2shell (CVE-2026-109618 / CVE-2026-109619): PHP Pre-Auth RCE PoC, Source Patch & Comprehensive Defense Guide
Provides critical stopgap mitigations, source-level patches, and multi-web-server WAF rules for teams securing PHP deployments, especially for unpatched legacy and end-of-life installations.
Critical · vulnerability · github.com
CVE-2026-8452 PoC: Citrix NetScaler pre-auth RCE detection and exploitation
This is a public pre-auth remote-code-execution PoC, and although offsets are hardcoded for a specific build, it materially lowers the exploitation barrier. NetScaler administrators should upgrade affected builds per the Citrix bulletin and restrict exposed Gateway/AAA surfaces; use the PoC only in explicitly authorized isolated environments.
Critical · vulnerability · github.com
CVE-2026-63077: JetBrains TeamCity unauthenticated RCE with public PoC and active exploitation
An unauthenticated attacker who can reach a TeamCity HTTP(S) service may execute arbitrary operating-system commands with the TeamCity server process privileges, exposing configuration and credentials, changing server state, and compromising build artifacts or downstream CI/CD pipelines. CISA KEV now confirms active exploitation. Upgrade to 2025.11.7, 2026.1.3, or later immediately; if upgrading is not possible, apply JetBrains' security patch plugin, restrict internet access, rotate exposed credentials, and investigate potentially exposed instances.
vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
Back