Exposed Directory Reveals Full Fastjson RCE Toolkit With SSH Persistence and C2 Channel
jedisct1 · x · 2026-10-22
Security researcher @Yusufcancakiir discovered a full exploitation toolkit for CVE-2026-16723 (Fastjson RCE) on an exposed HTTP directory, going well beyond a simple PoC:
- Complete arsenal: HTTP/WebSocket exploitation, dynamic JAR payload generation, an HTTP polling-based command channel (/CMD and /RESULT), privilege escalation checks, and SSH persistence mechanisms — with documentation covering the whole workflow
- Payload analysis: The researcher extracted and inspected p.jar (532 bytes); its Java 8 bytecode contains a @JSONType-annotated class whose static initializer invokes Runtime.exec() to run id > /tmp/pwned
- Persistence logic: The scripts write to authorizedkeys, enable PermitRootLogin, and restart sshd to establish root-level SSH backdoor access
The finding shows Fastjson deserialization exploits have been heavily weaponized, a warning sign for Java operators.
More from Safety
- NVIDIA open-sources SkillSpector after scan finds 26% of 31k agent skills vulnerable — dunkhippo33 · 2026-10-22
- AI triage rated half of real emergencies less urgent, prompting FDA risk debate — YvesMulkers · 2026-10-22
- AI agent swarms reportedly hacking half the internet, echoing OpenAI's two-month-old cyber warning — haider1 · 2026-10-22
- Unpatched PHP flaw lets attackers take over servers, leaving ~70% of the web exposed — josh_bickett · 2026-10-22
- Dan Jeffries: restricting open models leaves defenders helpless against AI attacks — Dan_Jeffries1 · 2026-10-22
- Researcher warns of mass probing of internet-exposed PLC industrial control devices — basedjensen · 2026-10-22