Hackers are actively exploiting a vulnerability in the FastJson open-source Java library, allowing remote code execution without user interaction or elevated privileges.

The security issue affects FastJson versions 1.2.68 through 1.2.83 and is leveraged in attacks targeting various organizations in the U.S.

The malicious activity was observed last week by the agentic security company ThreatBook, and researchers at the business protection company Imperva confirmed that it was “targeting a wide range of organizations, across Financial Services, Healthcare, Computing, Retail, Business, and other industries.”

“Attacks are currently almost entirely targeting US-based organizations, with a few attacks in Singapore and Canada, although this will likely continue to expand globally,” Imperva says.

FastJson is an open-source Java library developed by Alibaba, used for serializing Java objects to JSON, and vice versa.

The project has 25,600 stars and 6,400 forks on GitHub, and is especially prevalent in Chinese enterprise software and projects built on Alibaba’s platform.

CVE-2026-16723 was discovered by FearsOff, an offensive security company, which published a technical write-up earlier this month.

The researchers explain that the flaw stems from the library’s type-resolution logic, which performs attacker-controlled resource lookups before enforcing AutoType restrictions. This creates a path for executing code remotely in Spring Boot fat-JAR deployments.

By abusing @type processing, the researchers were able to load and execute malicious classes without AutoType enabled or requiring third-party gadget chains.

No fix available

In its security bulletin, Alibaba confirmed the critical severity of the vulnerability and warned that it is exploitable on “the most common Spring Boot deployment model.”

“The only deployment prerequisite is that the target runs as a Spring Boot executable fat-jar (i.e., launched via java -jar xxx.jar),” reads Alibaba’s security advisory.

The vendor notes that specifying a target class during deserialization does not mitigate CVE-2026-16723, as attackers can embed malicious payloads within ‘Object’ or ‘Map’ fields.

The vulnerable type-resolution logic is not present in fastjson2, which uses an allowlist-first model for polymorphic deserialization and doesn’t rely on the @JSONType annotation as a trust signal.

Also, FastJson versions 1.2.60 and earlier, and any non-fat-JAR deployments, aren’t affected either.

Developers using a version within the affected spectrum are urged to immediately enable SafeMode or switch to a non-impacted build.

Currently, there’s no fix issued for CVE-2026-16723. Imperva has also noted that FastJson 1.x is no longer actively maintained, so it’s unlikely it will receive a security update.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Firefighters in France are confronting a phenomenon never seen in the region before: fire clouds. It’s a sign of the intensity of the blazes burning—and how climate change is upping the odds that they appear.

A wave of fires has swept over France and Spain, sending hundreds of thousands fleeing. Firefighters on the frontlines are facing what a spokesperson for the French firefighter association told AFP called an “operational impossibility”—in other words, a “natural force beyond our control.”

As evidence of how out of control the wildfires in France are, look no further than the skies where the blazes have, in some cases, created their own weather. To form a fire cloud—what meteorologists call a pyrocumulonimbus or the even more metal-sounding cumulonimbus flammagenitus—you first need heat, which fires have in spades.

But just as important are dry conditions near the ground and cool, relatively moist conditions aloft in the atmosphere. As superheated smoke rises miles above the flames and into the cool atmosphere, water vapor condenses around the particles of ash to form water droplets. (Yes water vapor and water droplets are two different things.) As the air keeps rising, those water droplets eventually become ice crystals.

At this point, the smoke and water droplets have created a cloud, but unfortunately one that’s unlikely to provide much relief in the form of rain. Instead, these towering fire clouds can unleash lightning strikes that can start more fires and generate powerful downdrafts that reach the ground to fan flames further. At their worst, pyrocumulonimbus clouds can even spawn tornadoes.

Pyrocumulonimbus clouds have been documented in the US, Canada, and Australia, among a handful of other locations. But until now, there were no documented fire clouds in France. While the country is no stranger to wildfires, the size and ferocity of this summer’s blazes is well outside the normal.

Last week was France’s single most destructive week for wildfires over the past 20 years, according to data from the European Forest Fire Information System. It more than doubled the previous record during that period, which coincides with accurate satellite data. This isn’t an isolated bad week either. More than 220,000 acres have burned across the country so far, six times the annual average. That’s 61,000 acres higher than the previous yearly record.

If that sounds like a familiar trend, well, it unfortunately is. Burning fossil fuels has heated the planet up, making explosive wildfires more common and destructive around the world. A 2024 study found the incidence of extreme fires globally more than doubled from 2003 to 2023. Six of the seven most extreme years have happened since 2016.

After a slight weekend reprieve as temperatures dipped, they’re expected to rocket back up above 104 degrees Fahrenheit (40 degrees Celsius) in France and 108 degrees Fahrenheit in Spain later this week. That means firefighters will have to contend with more extreme fire weather—including the possibility of clouds created by the blazes themselves.

After getting his hands on a rope driver module from the Apollo project era that had a big ‘Scrapped Module’ stamped on it, [Mike Stewart] was naturally left curious as to what exactly had failed in this module. Originally destined for the Apollo Guidance Computer, these Raytheon-manufactured modules were the pinnacle of space-grade high-tech of the 1960s, with requisite acceptance testing so as to not endanger a very expensive space mission.

The cool part here is that the acceptance documents for the module in question (B16-B17) have been scanned in and can be found on the Internet Archive. With the part itself being potted and very much inaccessible, this document helpfully lays out the expected measurements on the module’s pins, as well as schematics and mechanical drawings. Unfortunately the reasons for the rejection were not recorded, so replicating the failing test results is required to understand the reason.

A slight complication here is that the testing procedure doesn’t just involve hooking up a multimeter for some voltage and capacitance measurements. There are also temperature and voltage extremes, and vibration tolerance involved, which would be somewhat complex to test, but most of all risk damaging a historical artefact. Thus a somewhat conservative testing procedure was chosen, even if this may not reveal the actual fault.

As noted in the video, sometimes modules were also rejected because someone simply dropped it on the floor along the way. However, generally if a module was found to be faulty they would open it to diagnose said fault, with a closer look at this module indeed revealing suspicious marks in the potting compound where it was apparently opened and conceivably repaired. This also might explain why they also put the ‘For engineering use only’ on it.

With multiple of such locations visible in the potting compound, these locations were mapped to the schematics for the module, to get some idea of what may have been accessed. After this, basic testing was performed on the module, as per the acceptance testing document.

Along the way an error was detected in said document, in the form of the wrong pin number. In table 4-2 the input pin 269 was mistakenly listed as having output pin number 169 when it should have been pin 168. Pin 169 is chassis ground, so this was presumably fixed in a later version of the document.

After all the testing with just stationary, room-temperature conditions, everything appeared to check out. This means that likely this was indeed a repaired module that got subsequently used for engineering purposes rather than installed in flight-ready hardware. The only issue found was that channels were out of calibration, but whether this was an original flaw or due to the module being half a century old is hard to tell in the absence of repair logs.

Overall it’s an exciting opportunity to document another part of history, since so many of the details pertaining to these original modules and related technologies got lost or muddled over the decades.

Arista has patched a maximum-severity command injection vulnerability in on-premises VeloCloud Orchestrator deployments that is being actively exploited in attacks.

The vulnerability, tracked as CVE-2026-16812, is an unauthenticated OS command injection flaw with severity scores of 10.0, the maximum score that can be given to flaws.

VeloCloud Orchestrator, also known as VCO, is a centralized management platform used to configure, monitor, and manage VeloCloud SD-WAN deployments and associated edge devices.

According to an Arista security advisory published Monday, the vulnerability allows remote attackers to access privileged functionality that was intended only for internal use and should not be remotely accessible.

“Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator,” Arista warned.

The company says VCO is supposed to be exposed by default, with no configuration option that can prevent this exposure. Attackers only require network access to the VCO web interface, and no VCO tenant or operator credentials are needed to exploit the flaw.

Arista says CVE-2026-16812 was discovered externally and is known to be actively exploited, but has not shared when the attacks began, who is behind them, or how the vulnerability is being exploited. BleepingComputer has contacted the company with these questions.

The following VeloCloud Orchestrator on-premises versions are affected:

• VCO 5.2.x releases before 5.2.3.14
• VCO 6.1.x releases before 6.1.3.4
• VCO 6.4.x releases before 6.4.2.4
• VCO 7.0.x releases before 7.0.0.1

VeloCloud Orchestrator Hosted and Dedicated deployments were patched before the advisory was published and are not affected. VeloCloud Gateway and VeloCloud Edge products are also not vulnerable to the flaw.

The company says the flaw is fixed in VCO versions 5.2.3.14, 6.1.3.4, and 6.4.2.4 and later. The affected software list also indicates that VCO 7.0.0.1 and later releases are not vulnerable.

Arista warns that end-of-support software versions have not been assessed to determine if they are vulnerable. Customers running unsupported release trains are advised to contact the Arista Technical Assistance Center to discuss available upgrade options.

The U.S. Cybersecurity and Infrastructure Security Agency has also added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog, confirming that the flaw is being used in attacks.

CISA has ordered U.S. federal civilian executive branch agencies to mitigate the vulnerability by Thursday, July 30, 2026, as required by Binding Operational Directive 22-01.

Indicators of compromise

While patches are being deployed, administrators should restrict access to the VCO web interface to administrative networks, monitor for connections from known malicious IP addresses, and review recent administrator activity for unusual changes.

Arista shared three IP addresses that were seen exploiting the vulnerability:

• 8.19.75.217
• 206.72.242.124
• 206.72.242.162

Administrators are advised to block these IP addresses and review their logs for previous connections. However, it is possible that devices could have been compromised from other IPs, so this list is not definitive.

Organizations should review VCO logs for signs of exploitation, including:

• Unusual web requests containing encoded characters, URL-like path components, references to local or internal services, or abnormally high request rates
• Connections from known malicious IP addresses
• Unexpected outbound HTTP or HTTPS traffic from the VCO host
• Unauthorized configuration changes or privileged maintenance activity
• Unexpected command execution, file creation, database exports, or archive files
• Suspicious access to VCO databases, configuration data, device inventories, credentials, certificates, or cryptographic keys

If compromise is suspected, organizations should preserve all logs and filesystem timestamps before remediation.

Potentially affected organizations should rotate credentials, review administrator activity, validate managed devices, and consider restoring or replacing compromised instances.

As successful exploitation can compromise both the orchestrator host and the data it manages, installing the security update may not be enough for systems that have already been breached.

Arista warns that compromising a VeloCloud Orchestrator instance could also give attackers access to VeloCloud Edge devices as well.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Peacock Premium will be included with YouTube Premium in the US at no extra cost starting in early 2027. The deal, announced on Sunday by NBCUniversal and YouTube, is Peacock’s largest wholesale distribution partnership to date and immediately expands its reach to millions of existing YouTube Premium subscribers. Peacock Premium currently costs $10.99 per month on its own. YouTube Premium recently increased to $16 per month for individuals and $27 for families.

The bundle gives YouTube Premium subscribers access to Peacock’s full catalogue: NFL Sunday Night Football, the Olympics, NBA, MLB, Premier League, WNBA, and college sports alongside series including The Office, Saturday Night Live, Law & Order: SVU, Love Island USA, and blockbuster Universal films. Subscribers can upgrade to the ad-free Peacock Premium Plus tier. Peacock Premium will also be available as a standalone add-on through YouTube Primetime Channels starting later this summer.

The partnership extends well beyond the bundle. NBCUniversal’s multi-year distribution deal with YouTube TV, the largest and fastest-growing pay TV provider in the US, is renewed. NBC Sports will produce select live sporting events for YouTube. Some live events from NBCUniversal will stream on NBC Sports’ YouTube channel. The deal also expands Universal+ and Hayu to YouTube Premium subscribers in select international markets and deepens the companies’ advertising technology collaboration through FreeWheel. Google has been rebuilding its products around AI and engagement, and bundling a major streaming service with YouTube Premium turns the subscription from an ad-removal tool into a full entertainment package.

Peacock just turned its first quarterly profit, six years after launch. The YouTube bundle accelerates its next growth phase by trading per-subscriber revenue for scale. Alphabet raised its capex guidance to $205 billion this year as it invests across AI and content, and the Peacock deal positions YouTube Premium as a competitor to Apple One and Amazon Prime’s bundled offerings. “This partnership brings NBCUniversal’s world-class content to YouTube’s unmatched scale,” said Comcast co-CEO Mike Cavanagh. For YouTube, the value is retention: subscribers who get NFL, Premier League, and The Office alongside ad-free YouTube are much harder to cancel.

Microsoft said MDASH with MAI-Cyber-1-Flash received a 96 percent score on CyberGYM, a standard benchmark test. The rating is 12 points higher than Anthropic’s Mythos and also beats Google Gemini and OpenAI GPT. The new MDASH costs half as much to use as the previous MDASH offering.

The second tool Microsoft announced on Monday is named Project Perception. It too is a collection of specialized AI agents that perform red-, blue-, and green-team functions for finding vulnerabilities, investigating them to determine their risk, and taking corrective actions, respectively. Microsoft said the platform selects the models to use based on the assigned task. Considerations that go into the decision include the model’s effectiveness and the end cost to the customer. Microsoft said the decisions are shaped by “ongoing research, benchmarking and evaluation across frontier and specialized models.”

Microsoft said Project Perception is designed to perform 90 percent of tasks for lower costs than similar platforms from competitors. That means customers can turn to the more expensive alternatives only for the remaining 10 percent of tasks.

Microsoft said the new tools respond to a seismic shift in how organizations secure their networks against catastrophic hacks.

“As AI accelerates the speed and scale of cyberattacks, defenders are being asked to secure increasingly complex digital environments with approaches built for a different era,” the company said. “Security teams are often forced to piece together signals, context, and risk insights across vast amounts of data, making it harder to keep pace with emerging threats.”

With last week’s OpenAI incident evoking troubling scenes straight out of the most dystopian sci-fi novels, the tools, which are currently in preview mode, deserve a healthy dose of caution that Microsoft made no mention of. They should be closely scrutinized and evaluated before being used in production. On the other hand, there are clear risks for not adopting such tools. Balancing the risks of using AI agents versus the threat of avoiding them is a work in progress with no clear answers for now.

Apple’s iOS 26.6 update stops attackers from using iPhone Mirroring, Siri, and more to gain user data. Here’s what you need to know.

On Monday, just under a month following the arrival of the security-focused iOS 26.5.2, Apple made iOS 26.6 available to the general public. The latter includes over 75 security enhancements, 14 of which address kernel-related vulnerabilities.

10 of the now-patched kernel issues allowed apps to trigger unexpected system terminations, while others let apps access sensitive user data and write kernel memory. Apple resolved these issues through improved memory handling, memory management, state management, bounds checks, and more.

The iOS 26.6 fixes that keep your data safe

Additionally, iOS 26.6 prevents attackers from using iPhone Mirroring to access sensitive user data, as an Accessibility issue was resolved through state management improvements. Similar App Store and FrontBoard issues were resolved through improved checks and the use of HTTPS, respectively.

iOS 26.6 contains multiple fixes that protect user data.

Apple also stopped apps from accessing user information through Game Center by improving data protection. Enhanced state management was used to fix similar Managed Configuration and WorkoutKit vulnerabilities.

iOS 26.6 also removed vulnerable Siri code, resolving an information disclosure issue that gave apps access to sensitive information about the user. Entitlement checks were employed to fix an NSColorPanel issue, once again preventing apps from leaking user data.

The Contacts app received three security enhancements as well, as processing a maliciously crafted contact will no longer leak sensitive user data, thanks to the iOS 26.6 update. Additionally, apps can no longer add contacts without user authorization, thanks to validation improvements.

How iOS 26.6 stops apps from gaining root access

Apple also took security measures to ensure that attackers with physical access to locked devices can’t gain user data, as the company fixed a DriverKit and Wi-Fi issue.

iOS 26.6 prevents DOS attacks and stops apps from gaining root privileges.

iOS 26.6 also addresses a significant MediaRemote issue. The now-patched path handling vulnerability gave apps root privileges. Similarly. the iOS 26.6 update contains an Apple Books fix that prevents apps from accessing protected parts of the filesystem.

Multiple Model I/O issues were resolved as well, meaning that remote attackers can no longer cause unexpected app crashes on iOS 26.6. Three now-patched Scene I/O exploits enabled arbitrary code execution.

Apple also took measures to prevent apps from escaping their sandbox. The company did so by resolving Game Center and libc vulnerabilities with improved path validation and input validation, respectively.

Safari and WebKit fixes in iOS 26.6

Monday’s iOS update also stops apps from using a WebKit issue to escape their sandbox. In total, iOS 26.6 contains eight WebKit fixes, meant to keep your data safe while browsing the web.

iOS 26.6 contains multiple WebKit fixes.

Notably, iOS 26.6 includes a fix that stops websites from knowing the user visited a specific link. Apple also made UI improvements, as maliciously framed websites were found to spoof select UI elements.

As for the other WebKit patches, one of them prevents denial-of-service attacks, while two prevent Safari crashes on iOS 26.6. Apple similarly included fixes for mDNSResponder and Heimdal to prevent denial-of-service attacks.

Monday’s software update contains a multitude of security enhancements. As Apple’s website notes, fixes for Pro Res, WebRTC, AuthKit, the Apple Neural Engine, and more are present in iOS 26.6.Unlike other iOS releases, however, iOS 26.6 doesn’t include fixes for vulnerabilities that were used in targeted attacks.

Even so, AppleInsider recommends installing it to ensure your devices have the latest security enhancements. Unlike the iOS 27 developer betas, which may contain bugs, glitches, and performance issues, the iOS 26.6 update should be installed by all users.

On Sunday, Microsoft CEO Satya Nadella doubled down on the shocking warning he issued earlier this month to businesses that use AI, taking it a step further this time. Companies that rely wholly on the proprietary AI labs for their AI needs ultimately won’t survive, he predicts.

That’s what he said on CNN’s “Fareed Zakaria GPS.” When Zakaria asked Nadella to explain what constitutes a company sharing too much with an AI model provider, Nadella said businesses need to be wary of everything they hand over, from their data to their prompts.

Nadella called for a setup where “every time you use the model, all of the metadata around it is retained by you, so that you could use all of that to train perhaps your own weights or your own open model.” (Weights are a model’s trained parameters — essentially its brain. Nadella’s point: Companies should hold on to their own usage data so they can eventually build a model of their own.)

“Any firm that doesn’t have this control, I will claim will not remain a firm because you’ve essentially outsourced your thinking,” he added.

In short: Companies without their own models — or without a layer of AI infrastructure known as AI gateways to separate their prompts from the model itself — will be in trouble, Nadella says.

He specifically wants companies to stop relying on AI labs’ built-in coding tools, known as harnesses.(Anthropic’s Claude Code and OpenAI’s ChatGPT Codex are examples of these.)

“By keeping the harness separate from the model and the context and memory separate from the model, you absolutely can use multiple models for what they’re great at. At the same time, any one model can go away, and you can still continue to be in control of your own destiny,” Nadella said.

Mind you, Microsoft is an investor in the two largest AI labs, Anthropic and OpenAI. Coding agents are a particularly popular way for enterprises to use AI models and by all accounts are earning the model makers gobs of money.

And yet, Nadella is telling enterprises not to rely too heavily on them. Microsoft, naturally, would benefit from that warning, as its cloud business is now also selling the kind of alternative infrastructure he’s recommending.

Despite the obvious self-serving fear tactic, he’s not wrong. Enterprises are increasingly realizing that they need many model options, particularly cheaper options, and are turning to open-weight models — models whose underlying code is publicly available — that they can fine-tune and run on their own hardware. That, in turn, means they will also need ways to manage multiple models, as well as coding agents that aren’t tied to a specific model provider.

But Nadella’s observation isn’t just about runaway budgets. He anticipates that once a company has “outsourced its thinking” to a model, there’s little to stop the AI lab from eventually offering a competing service of its own. This risk grows as enterprises adopt AI agents and give them access to the innards of the company.

It’s the kind of warning that the startup industry has been shuddering about for years: What’s to stop model makers from wiping out startups by copying and competing with them?

In May, for example, when OpenAI CEO Sam Altman offered to invest in every Y Combinator startup in its latest cohort by offering them AI credits, seed investor Jason Calacanis issued a similar buyer-beware, posting: “If you take these tokens, there’s a non-zero chance that OpenAI will study exactly what your startup is doing, copy your idea and put your app into their free offering. This is the classic platform playbook — be careful, founders!” he posted.

Now Nadella is making that same case to enterprises.

One caveat: Nadella’s concern about oversharing with AI models applies only to businesses — not individuals. When Zakaria specifically asked Nadella how everyday people could protect themselves, Nadella shrugged it off, saying that sharing data is simply the price consumers pay for using a service, especially a free one.

“To some degree there’s got to be some value exchange in the consumer space where you’re getting something for free, maybe for your data. That’s sort of how the advertising business model has worked,” Nadella said.