July 27, 2026 by sig9

Hacker Wars - July 27, 2026

Your daily dose of infosec chaos

It is a patch-or-perish kind of day. A critical RCE in Fastjson is being hammered in the wild with no fix in sight, GitLab now has public exploit code for a six-week-old hole, and a new APT crew is routing its spyware through Telegram. Add in malvertising that makes your own browser assemble the malware, plus a healthcare breach hitting 1.2 million people, and it is shaping up to be a long week for anyone running Java or a DevOps pipeline.

Fastjson 1.x RCE Actively Exploited With No Patch Available

Attackers are exploiting a critical flaw (CVE-2026-16723) in Alibaba’s Fastjson library that lets a single malicious JSON request achieve unauthenticated remote code execution inside affected Spring Boot apps, running with the full privileges of the Java process. There is no patch yet, and the bug is being hammered in the wild - which means any vulnerable instance is already a liability.

What to do: Hunt for Fastjson 1.x in your Java estate immediately, block or WAF-filter suspicious JSON payloads, and prepare to patch the moment a fix drops. If you cannot wait, consider disabling autoType or moving to a hardened alternative.

GitLab RCE PoC Goes Public, Weaponizing Six-Week-Old Flaw

Working exploit code for a patched GitLab flaw is now public, letting any authenticated user who can push to a project run arbitrary commands as the git user on unpatched self-managed servers. The fix shipped six weeks ago, but plenty of instances have not taken it - and now that a proof-of-concept exists, scanning is only a matter of time.

What to do: If you run self-managed GitLab, update to 18.11.3 or later right now. Audit who has push access to your projects, and assume any low-privileged dev account is a potential foothold.

TELESHIM Malware Hijacks Telegram for C2 Against Middle East Governments

An East Asia-linked threat actor is targeting Middle East government entities with a fresh toolkit that includes the TELESHIM backdoor, which abuses Telegram as its command-and-control channel to blend in with legitimate traffic. Two companion payloads, MIXEDKEY and BINDCLOAK, round out an espionage toolset designed to stay quiet and persist.

What to do: Monitor outbound Telegram traffic from sensitive networks and endpoints, especially in government or defense sectors. Hunt for unusual process behavior and review your egress allowlists - consumer messaging apps have no business on hardened systems.

SourTrade Malvertising Makes Your Browser Build the Malware

A malvertising campaign dubbed SourTrade skips the usual “download an EXE” step entirely and instead tricks your browser into assembling the final Windows executable in memory, piece by piece, using a legitimate runtime as its base. By never serving a complete malicious file from a single URL, it dodges traditional signature-based detection almost entirely.

What to do: Tighten browser controls and ad-blocking on corporate endpoints, and rely on behavioral endpoint detection rather than file hashes. Train users that fake crypto and trading sites are a primary delivery vector for these campaigns.

MCBS Healthcare Breach Exposes 1.2 Million Individuals

The PEAR ransomware group claims to have stolen 3 TB of data from MCBS, a medical business management company, exposing personal information belonging to over 1.2 million people. Healthcare remains the most targeted sector for extortion, and once again the damage extends far beyond the balance sheet.

What to do: If you are in healthcare, assume you are a target and pressure-test your backups, segmentation, and incident response plan. Third-party risk reviews for billing and management vendors are no longer optional.

Until next time, keep your systems patched and your credentials rotated.

Brought to you by sig9 - sig9.ch | Protecting the unseen, securing the unknown

This bulletin is provided for informational purposes. Contact us for tailored security analysis.