cve-2026-16723

a critical bug in one of Java's most-used libraries had no fix. that just changed

Hackers were already exploiting Fastjson's default config for over a week before Alibaba's patch quietly showed up on a wiki page.

Priya Nair · 2h ago · 7 min