GitLab Notebook-Diff RCE PoC, AD CS “Certighost” DC Impersonation, and Actively Exploited Fastjson 1.x RCE

Posted on by

This brief covers the trailing ~48 hours (July 24–26, 2026). Every item below was checked against its primary advisory, vendor PSIRT, original research write-up, or the CISA KEV catalog, and the disclosure or publication date was confirmed to fall within (or, for the “Still developing” section, just outside) the window.

Researchers publish working GitLab RCE chain from two five-year-old Oj memory-corruption bugs

depthfirst · July 24, 2026

depthfirst detailed — and released proof-of-concept code for — a remote code execution chain against default self-managed GitLab, built by combining two memory-safety flaws in Oj, the native-C Ruby JSON parser used by GitLab’s Jupyter notebook diff renderer. An authenticated user who can push to a project commits a crafted .ipynb file and opens its commit diff, driving repository-controlled bytes into Oj inside a Puma worker; an out-of-bounds write plus a heap-pointer disclosure are chained to hijack a callback pointer and reach system(), executing commands as the git account. The chain affects GitLab CE/EE 15.2.0 through 18.10.7, 18.11.0 through 18.11.4, and 19.0.0 through 19.0.1 (fixed in 18.10.8, 18.11.5, and 19.0.2 by upgrading to Oj 3.17.3, shipped June 10). GitLab did not file the underlying fix as a security fix, so there is no CVE or CVSS for the chain itself; the broader Oj review produced nine published advisories including CVE-2026-54502, CVE-2026-54896, and CVE-2026-54903. No in-the-wild exploitation was reported at publication.

“A normal authenticated user who could push to a project and view its commit diff could reach this path from their own project. Exploitation required no administrator privileges, CI or runner access, victim interaction, or access to another user’s project.” — Yuhang Wu, depthfirst

Source: depthfirst research · GitLab 19.0.2 patch release · The Hacker News

“Certighost” exploit lets a low-privileged AD user impersonate a Domain Controller (CVE-2026-54121)

Microsoft MSRC / independent researchers · July 24, 2026

Researchers H0j3n and Aniq Fakhrul published a working exploit for an Active Directory Certificate Services flaw they codenamed Certighost, tracked as CVE-2026-54121 (CVSS 8.8, improper authorization), which Microsoft patched on July 14. The bug lives in the AD CS enrollment “chase” fallback: an Enterprise CA follows a requester-supplied Domain Controller host over SMB and LDAP without first proving it is a real DC, letting a normal domain account obtain a certificate for a Domain Controller and authenticate as that machine via PKINIT. Because DC accounts carry directory-replication rights, the resulting Kerberos credential can retrieve the krbtgt secret through DCSync. Exploitation needs only network access and a domain account (no admin rights, no user interaction), and the full PoC is public. The flaw was not on CISA’s KEV catalog as of July 24, and no primary source reviewed reported in-the-wild exploitation.

“As of July 24, no primary source reviewed by The Hacker News reported exploitation in the wild, but the full proof-of-concept was public. That absence of reporting does not prove that exploitation has not occurred.” — The Hacker News

Source: Microsoft MSRC advisory · NVD · The Hacker News

Fastjson 1.x RCE (CVE-2026-16723) reported under active attack with no 1.x patch available

Alibaba advisory / ThreatBook / Imperva · advisory July 21, exploitation reported July 22–25, 2026

Alibaba published an advisory for CVE-2026-16723 (Alibaba-assigned CVSS 9.0), a critical RCE in the Fastjson 1.x Java JSON library affecting versions 1.2.68 through 1.2.83. In a Spring Boot executable fat-JAR application, an attacker-controlled @type value can be turned into a class-resource lookup that fetches attacker-controlled bytecode, yielding unauthenticated code execution with the privileges of the Java process; the maintainers confirmed the chain requires no AutoType enablement and no classpath gadget. ThreatBook reported capturing in-the-wild exploitation on July 22, and Imperva reported activity against U.S. financial-services, healthcare, and retail organizations. As of July 25 no fixed Fastjson 1.x artifact was available — mitigations are enabling SafeMode (-Dfastjson.parser.safeMode=true) or using the 1.2.83_noneautotype build, with migration to Fastjson2 as the long-term fix. Note: a July 23 CISA-ADP assessment marked exploitation as “none,” and the flaw was absent from CISA’s KEV catalog on July 25.

“As of July 25, Alibaba had not released a fixed Fastjson 1.x version.” — The Hacker News

Source: Alibaba advisory · NVD · The Hacker News

Still developing

Cl0p-linked actors chain unauthenticated RCE against internet-exposed PTC Windchill / FlexPLM (CVE-2026-12569)

Ransom-ISAC / PTC · July 25, 2026

A coordinated advisory from Ransom-ISAC, eCrime.ch, and DEFUSED describes a data-extortion campaign, with tradecraft attributed to Cl0p (aka FIN11 / Graceful Spider / Lace Tempest), against internet-exposed PTC Windchill and FlexPLM. Attackers chain a pre-authentication information disclosure in the FlexPLM WSDL endpoint (CVSS 7.5) with a server-side flaw in the Windchill login servlet, CVE-2026-12569 (CVSS 9.3), which CISA added to its KEV catalog in late June. Successful exploitation yields unauthenticated RCE and hex-named JSP web shells under /Windchill/login/, followed by staging and double-extortion theft of engineering and design data across manufacturing, automotive, aerospace, and retail targets.

“Attackers chain a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet, enabling unauthenticated remote code execution and deployment of hex-named JSP web shells under /Windchill/login/.” — Ransom-ISAC / eCrime.ch / DEFUSED advisory

Source: Ransom-ISAC advisory · The Hacker News

This brief covers the trailing ~48 hours (July 24–26, 2026).

Primary sources:

Leave a Reply