#javasecurity — Public Fediverse posts

The wait is over! New JAVAPRO special edition 'JAVA Security' is out now & FREE to download! More expert insights, community voices & what you need to know.

Want the latest #JAVAPRO issues? Subscribe to our news & get every new PDF: https://javapro.io/2026/08/31/stay-updated-with-every-new-free-pdf-edition-26-8/

#JavaSecurity #CyberSecurity #SecureCoding #OWASP #SoftwareSupplyChain #SBOM #DevSecOps #JAVAPRO

CVE-2026-58062 (CRITICAL, CVSS 9.3): Bouncy Castle Java improperly validates stapled OCSP, risking cert trust. Affects =1.66, <1.85, LTS <2.73.12. Update to 1.85+ or LTS 2.73.12. Details: https://radar.offseq.com/threat/cve-2026-58062-cwe-295-improper-certificate-validation-in-legion-of-the-bouncy-castle-inc-bc-java-1fb42d02f3400e15 #OffSeq #BouncyCastle #JavaSecurity

CVE-2026-58062 (CRITICAL, CVSS 9.3): Bouncy Castle Java improperly validates stapled OCSP, risking cert trust. Affects =1.66, <1.85, LTS <2.73.12. Update to 1.85+ or LTS 2.73.12. Details: https://radar.offseq.com/threat/cve-2026-58062-cwe-295-improper-certificate-validation-in-legion-of-the-bouncy-castle-inc-bc-java-1fb42d02f3400e15 #OffSeq #BouncyCastle #JavaSecurity

CVE-2026-58062 (CRITICAL, CVSS 9.3): Bouncy Castle Java improperly validates stapled OCSP, risking cert trust. Affects =1.66, <1.85, LTS <2.73.12. Update to 1.85+ or LTS 2.73.12. Details: https://radar.offseq.com/threat/cve-2026-58062-cwe-295-improper-certificate-validation-in-legion-of-the-bouncy-castle-inc-bc-java-1fb42d02f3400e15 #OffSeq #BouncyCastle #JavaSecurity

FastJson simply opened its arms to arbitrary code like a golden retriever greeting a stranger. Godspeed, little library.

Monitor FastJson security advisories and apply patches immediately when available — assuming, of course, patches exist yet. They may not. That's what zero-day means. Read it slowly.

Reward: You've received a commemorative FastJson Memorial Candle. It has already been remotely executed.

#ZeroDay #RCE #FastJson #CyberSecurity #JavaSecurity #AchievementUnlocked (2/2)

Migrate to Fastjson2 immediately, or slap -Dfastjson.parser.safeMode=true onto your JVM settings and watch your logs for suspicious @type values like a hawk with anxiety.

Reward: Cursed Artifact removed from inventory only upon successful migration. Current stats: Defense -47, Dignity -∞.

#ZeroDay #RCE #Fastjson #JavaSecurity #CyberSecurity #PatchedOrPerish (2/2)

Security advisory: Fastjson ≤ 1.2.83 RCE (CVSS 8.1 High)

A critical remote code execution vulnerability in Alibaba Fastjson was disclosed on July 19 by Kirill Firsov (@k_firsov), with a public PoC released on July 21 (github.com/midisec/fastjson-1.2.83-gadget-rce).

The vulnerability resides in ParserConfig.checkAutoType(). Even with AutoType disabled (default), the method performs a resource probe: the @type class name has . replaced with / and is passed to ClassLoader.getResourceAsStream(). On Spring Boot FatJar deployments, the ClassLoader supports jar:http:// URL resolution, allowing an attacker to point the "resource path" to a remote server.

Exploit chain:

Attacker sends a JSON request with a crafted @type value
checkAutoType() converts it to a resource path and fetches from the remote server
Fastjson's ASM reader checks the returned bytecode for @JSONType
If found, the class is loaded and instantiated — <clinit> executes arbitrary code
No classic deserialization gadgets are involved. The AutoType blacklist is irrelevant because the resource probe uses a separate code path.

ZAST.AI's semantic analysis engine can trace the complete data flow from the untrusted @type input to the ClassLoader.getResourceAsStream() sink, identifying this resource-probe RCE pattern through static code analysis alone.

Affected: Fastjson 1.2.68 ~ 1.2.83 (1.x EOL) JDK impact: 8 (direct RCE), 17/21 (fd reuse, Linux), 25 (SSRF only)

Remediation: enable SafeMode (-Dfastjson.parser.safeMode=true) or migrate to fastjson2.

Full report: https://blog.zast.ai/vulnerability%20research/application%20security/fastjson-checkautotype-rce-en/

ZAST.AI is currently offering free assessment during the anniversary period — upload a code package to verify Fastjson RCE and other deserialization vulnerabilities without setting up a runtime environment.

https://zast.ai/anniversary?utm_source=blog&utm_medium=organic_content&utm_campaign=zast_1st_anniversary_2026&utm_content=blog_post_en

#AppSec #Fastjson #RCE #JavaSecurity #Vulnerability #fastjsonrce #fastjson0day

Semgrep is not a replacement for review. It is a cheap way to stop one bad pattern early.

I wrote a Quarkus walkthrough that builds a small document API, then blocks concatenated native queries in agent-generated Java with Semgrep, pre-commit, AGENTS.md, and CI.

https://www.the-main-thread.com/p/quarkus-semgrep-agent-security-guardrails

#Quarkus #Semgrep #JavaSecurity

Semgrep is not a replacement for review. It is a cheap way to stop one bad pattern early.

I wrote a Quarkus walkthrough that builds a small document API, then blocks concatenated native queries in agent-generated Java with Semgrep, pre-commit, AGENTS.md, and CI.

https://www.the-main-thread.com/p/quarkus-semgrep-agent-security-guardrails

#Quarkus #Semgrep #JavaSecurity

Semgrep is not a replacement for review. It is a cheap way to stop one bad pattern early.

I wrote a Quarkus walkthrough that builds a small document API, then blocks concatenated native queries in agent-generated Java with Semgrep, pre-commit, AGENTS.md, and CI.

https://www.the-main-thread.com/p/quarkus-semgrep-agent-security-guardrails

#Quarkus #Semgrep #JavaSecurity

Still treating security as something you bolt on later? #Java25 brings security into the language itself. Mihaela Gheorghe-Roman breaks down how sealed classes, records & pattern matching close entire classes of vulnerabilities. → https://javapro.io/2025/12/30/security-in-the-age-of-java-25-new-language-tools-for-safer-code/

@openjdk #JavaSecurity

Join us for this live-coding webinar tomorrow & get hands on guidance for improving authentication, authorization, and runtime validation in your Java applications!
https://www.crowdcast.io/c/modern-java-security

#Java #JavaEE #JakartaEE #JavaDeveloper #Security #JavaSecurity #PayaraCommunity @jakartaee

Axiom JDK: криптография «из коробки» и подключение ГОСТ-провайдеров

Приглашаем на

https://habr.com/ru/companies/axiomjdk/articles/968332/

#axiomjdk #java #криптография #безопасность #javasecurity #tls #вебинар #axiom_jdk #шифрование #аутентификация

Wenn hashCode(), lügt wird die #HashMap inkonsistent. Im sicherheitskritischen Bereich fatal: Lookup-Ausfall, Authorization Bypass, Resource Lock Hijack — alles möglich. @svenruppert liefert eine genaue Analyse mit interaktiver #Vaadin-Demo: https://javapro.io/de/wenn-hashcode-luegt-und-equals-hilflos-ist/

#JavaSecurity

Mutable Schlüssel in #HashMaps können zu unsichtbaren Einträgen führen. Warum hashCode()-Änderungen fatale Folgen für Lookup, Security & Konsistenz haben, zeigt @svenruppert in der interaktiven #Vaadin-Demo. Teste es: https://javapro.io/de/wenn-hashcode-luegt-und-equals-hilflos-ist/

#Vaadin #Java #JavaSecurity @Vaadin

⚠️ Androxgh0st botnet is back and evolving

🎯 Targets US universities including UC San Diego

💥 Uses RCE, JNDI, OGNL, web shells

🛡️ Patch devices now!

🔗 https://hackread.com/androxgh0st-botnet-expand-exploit-us-university-servers/

#Androxgh0st #CyberSecurity #RCE #InfoSec #JavaSecurity

⚠️ Androxgh0st botnet is back and evolving

🎯 Targets US universities including UC San Diego

💥 Uses RCE, JNDI, OGNL, web shells

🛡️ Patch devices now!

🔗 https://hackread.com/androxgh0st-botnet-expand-exploit-us-university-servers/

#Androxgh0st #CyberSecurity #RCE #InfoSec #JavaSecurity

⚠️ Androxgh0st botnet is back and evolving

🎯 Targets US universities including UC San Diego

💥 Uses RCE, JNDI, OGNL, web shells

🛡️ Patch devices now!

🔗 https://hackread.com/androxgh0st-botnet-expand-exploit-us-university-servers/

#Androxgh0st #CyberSecurity #RCE #InfoSec #JavaSecurity

Wie entsteht aus der harmlosen #HashMap ein Sicherheitsrisiko? Ganz einfach: mutable Schlüssel + veränderte Attribute = unsichtbare Einträge. Perfekter Nährboden für Angriffe!

@svenruppert zeigt Probleme & Strategien zur Vermeidung: https://javapro.io/de/wenn-hashcode-luegt-und-equals-hilflos-ist/

#Vaadin #JavaSecurity

Mutable hashCode() in Java keys = recipe for disaster ☠️
#JavaSecurity #HashMap #Java #SecureCoding #Vaadin https://svenruppert.com/2025/06/06/if-hashcode-lies-and-equals-is-helpless/

Mutable hashCode() in Java keys = recipe for disaster ☠️
#JavaSecurity #HashMap #Java #SecureCoding #Vaadin https://svenruppert.com/2025/06/06/if-hashcode-lies-and-equals-is-helpless/

Mutable hashCode() in Java keys = recipe for disaster ☠️
#JavaSecurity #HashMap #Java #SecureCoding #Vaadin https://svenruppert.com/2025/06/06/if-hashcode-lies-and-equals-is-helpless/

#Java Cryptography Architecture (JCA) - An Overview

Provider-based crypto framework enables secure hashing, digital signatures, key management & more — all modular, extensible, and ready for real-world security needs. #JavaSecurity #Cryptography #JCA #SecureCoding

https://svenruppert.com/2025/04/03/java-cryptography-architecture-jca-an-overview/

#Java Cryptography Architecture (JCA) - An Overview

Provider-based crypto framework enables secure hashing, digital signatures, key management & more — all modular, extensible, and ready for real-world security needs. #JavaSecurity #Cryptography #JCA #SecureCoding

https://svenruppert.com/2025/04/03/java-cryptography-architecture-jca-an-overview/

#Java Cryptography Architecture (JCA) - An Overview

Provider-based crypto framework enables secure hashing, digital signatures, key management & more — all modular, extensible, and ready for real-world security needs. #JavaSecurity #Cryptography #JCA #SecureCoding

https://svenruppert.com/2025/04/03/java-cryptography-architecture-jca-an-overview/

🚀 New article: Boost your security skills with my latest guide on essential #application #security #testing! 
Explore SCA, SAST, DAST, and PenTest to protect your projects from vulnerabilities. 

#JavaSecurity #Cybersecurity #AppSec #SecurityTesting

https://ionutbalosin.com/2025/03/security-application-testing-for-java-developers

🚀 New article: Boost your security skills with my latest guide on essential #application #security #testing! 
Explore SCA, SAST, DAST, and PenTest to protect your projects from vulnerabilities. 

#JavaSecurity #Cybersecurity #AppSec #SecurityTesting

https://ionutbalosin.com/2025/03/security-application-testing-for-java-developers

🚀 New article: Boost your security skills with my latest guide on essential #application #security #testing! 
Explore SCA, SAST, DAST, and PenTest to protect your projects from vulnerabilities. 

#JavaSecurity #Cybersecurity #AppSec #SecurityTesting

https://ionutbalosin.com/2025/03/security-application-testing-for-java-developers

Java serialization was seen as magic, enabling easy data persistence without the portability issues of C. But today, it's considered 'the gift that keeps giving' for security vulnerabilities. Let's explore why & how to mitigate these risks #JavaSecurity https://debugagent.com/java-serialization-filtering-prevent-0-day-security-vulnerabilities

Java serialization was seen as magic, enabling easy data persistence without the portability issues of C. But today, it's considered 'the gift that keeps giving' for security vulnerabilities. Let's explore why & how to mitigate these risks #JavaSecurity https://debugagent.com/java-serialization-filtering-prevent-0-day-security-vulnerabilities

Java serialization was seen as magic, enabling easy data persistence without the portability issues of C. But today, it's considered 'the gift that keeps giving' for security vulnerabilities. Let's explore why & how to mitigate these risks #JavaSecurity https://debugagent.com/java-serialization-filtering-prevent-0-day-security-vulnerabilities

🔐 In the connected world, securing digital data has become a necessity. Dive into the world of symmetric encryption algorithms in #Java and learn how to keep your data safe. Check out the article here: https://buff.ly/491EJhh #CyberSecurity #JavaSecurity

🔐 In the connected world, securing digital data has become a necessity. Dive into the world of symmetric encryption algorithms in #Java and learn how to keep your data safe. Check out the article here: https://buff.ly/491EJhh #CyberSecurity #JavaSecurity

🔐 In the connected world, securing digital data has become a necessity. Dive into the world of symmetric encryption algorithms in #Java and learn how to keep your data safe. Check out the article here: https://buff.ly/491EJhh #CyberSecurity #JavaSecurity

✍️ Creating a secure Java application? This article by @snyksec covers everything you need to know about symmetric encryption algorithms in Java. Don't miss out! #JavaSecurity #Encryption 👉 https://buff.ly/45Itpnj

✍️ Creating a secure Java application? This article by @snyksec covers everything you need to know about symmetric encryption algorithms in Java. Don't miss out! #JavaSecurity #Encryption 👉 https://buff.ly/45Itpnj

✍️ Creating a secure Java application? This article by @snyksec covers everything you need to know about symmetric encryption algorithms in Java. Don't miss out! #JavaSecurity #Encryption 👉 https://buff.ly/45Itpnj

Avoid Reflective and Stored XSS attacks in your Java web app. Snyk Code can help identify vulnerabilities and pinpoint their exact location. #JavaSecurity #XSS #SnykCode https://t.co/03dKe1xBKK https://t.co/KpJxmUeGrE

Avoid Reflective and Stored XSS attacks in your Java web app. Snyk Code can help identify vulnerabilities and pinpoint their exact location. #JavaSecurity #XSS #SnykCode https://t.co/03dKe1xBKK https://t.co/KpJxmUeGrE

Avoid Reflective and Stored XSS attacks in your Java web app. Snyk Code can help identify vulnerabilities and pinpoint their exact location. #JavaSecurity #XSS #SnykCode https://t.co/03dKe1xBKK https://t.co/KpJxmUeGrE

Avoid Reflective and Stored XSS attacks in your Java web app. Snyk Code can help identify vulnerabilities and pinpoint their exact location. #JavaSecurity #XSS #SnykCode https://t.co/03dKe1xBKK https://t.co/2Elx044VvE

Avoid Reflective and Stored XSS attacks in your Java web app. Snyk Code can help identify vulnerabilities and pinpoint their exact location. #JavaSecurity #XSS #SnykCode https://t.co/03dKe1xBKK https://t.co/2Elx044VvE

Avoid Reflective and Stored XSS attacks in your Java web app. Snyk Code can help identify vulnerabilities and pinpoint their exact location. #JavaSecurity #XSS #SnykCode https://t.co/03dKe1xBKK https://t.co/2Elx044VvE

We open-source our CLI fuzzing solution for Java ☕

With CI Fuzz CLI, you can now deploy fuzz testing to uncover blind spots in your Java code.

The CLI tool can be incorporated into existing unit testing frameworks (e.g., JUnit) using three basic commands on your command line or IDE.

If you ever ran a unit test, you will be able to use CI Fuzz CLI.

Compatible with #Maven and #Gradle.

Check out the repo: https://github.com/CodeIntelligenceTesting/cifuzz

#fuzzing #javasecurity #unittesting

We open-source our CLI fuzzing solution for Java ☕

With CI Fuzz CLI, you can now deploy fuzz testing to uncover blind spots in your Java code.

The CLI tool can be incorporated into existing unit testing frameworks (e.g., JUnit) using three basic commands on your command line or IDE.

If you ever ran a unit test, you will be able to use CI Fuzz CLI.

Compatible with #Maven and #Gradle.

Check out the repo: https://github.com/CodeIntelligenceTesting/cifuzz

#fuzzing #javasecurity #unittesting