3 verified findings from 1 run · the settled record for this UTC day, in the classic brief order.
Criticality
Kind
Topic
Region
TL;DR · the day in one read
01Exploited fastjson 1.x RCE has no patch — Spring Boot fat-JAR estates need SafeMode or migration now. A remote code execution flaw in Alibaba fastjson 1.2.68 through 1.2.83 (CVE-2026-16723, CVSS 9.0) triggers under the library's stock default configuration — no AutoType, no classpath gadget — whenever the application runs as a Spring Boot executable fat-JAR, and specifying a target DTO class does not mitigate it. Imperva reports attacks already underway against financial-services, healthcare and retail targets. fastjson 1.x is end-of-life and no patched 1.x release exists, so the only remediations are enabling SafeMode, switching to a noneautotype build, or migrating to fastjson2. →
02Windchill exploitation turns to extortion: staff-wide emails name the PLM breach vector, victim listings still pending. The PTC Windchill / FlexPLM pre-auth deserialization RCE (CVE-2026-12569) that CISA KEV-listed in June has entered an extortion phase attributed to Cl0p affiliates: from 20 July, Ransom-ISAC observed emails subject-lined "Windchill PDMLink module serious data leak" sent from compromised accounts to hundreds of staff per victim organisation, naming Windchill as the breach vector. As of 22 July no victims had been listed on Cl0p's leak site, so organisations that ran an internet-exposed, unpatched instance in June are in the window between exfiltration and publication. →
03Officials doxxed over the EU Chat Control file — dossiers assembled from years of unrelated breach data. A hacktivist using the handle Cybernox published personal dossiers on French national and European officials on 2026-07-25, framed as protest against the EU "Chat Control" communications-scanning file. ZATAZ counts 24 figures tied to the vote, while Cyberattaque.org describes a second group as well and states that no total is given. The records — home addresses, phone numbers, personal emails, dates of birth, French national ID numbers and in some cases banking details — were not taken in a fresh intrusion but recomposed from multiple earlier, unrelated breaches of private companies and public bodies, which is what makes the technique reusable against any public official attached to a contested digital-policy debate. →
A hacktivist published personal dossiers on French national and European political figures on 25 July, presenting the release as protest against "Chat Control 1.0" — the temporary EU derogation from ePrivacy rules that permits detection of child-sexual-abuse material in private communications (ZATAZ.COM, 2026-07-26). The handle "Cybernox" comes from Cyberattaque.org, which dates the claim to 25 July (Cyberattaque.org, 2026-07-26); ZATAZ does not name the actor, describing only a hacker previously linked to around ten leaks affecting French companies. The two accounts also differ on scope, and the entry keeps both: ZATAZ puts the number of targeted figures at 24 and lists Nadine Morano, Raphaël Glucksmann, Bernard Guetta, Nathalie Loiseau, Pascal Canfin and François-Xavier Bellamy among them, while Cyberattaque.org describes a second group of officials the actor classified as having voted differently and states that "Le nombre total de personnes présentes dans les fichiers n'est pas non plus précisé" — the total number of people in the files is not specified either. ZATAZ records the contents as "des photographies, des adresses personnelles, des numéros de téléphone, des courriels, des dates de naissance et plusieurs identifiants administratifs" — photographs, home addresses, phone numbers, emails, dates of birth and several administrative identifiers — with banking details in some records (ZATAZ.COM, 2026-07-26). Cyberattaque.org adds that French social-security numbers (NIR) appear in the set, and notes that the two-group split reflects only the actor's own labelling of how each official voted rather than any verified voting record (Cyberattaque.org, 2026-07-26).
The defining fact is what did not happen. ZATAZ is explicit that "Cette action ne révèle donc pas une intrusion unique contre le Parlement, elle illustre l'exploitation politique de données déjà compromises et leur recomposition en dossier de pression" — the operation reveals no single intrusion against Parliament, but rather the political exploitation of already-compromised data recomposed into a pressure dossier (ZATAZ.COM, 2026-07-26). Cyberattaque.org reaches the same conclusion by a different route, noting that the exact origin of the dataset is not established and that the records vary from administrative-looking data to customer files, commercial databases and loyalty-programme entries — heterogeneity that points to aggregation across sources rather than extraction from one system, with no technical evidence offered that any organisation was directly compromised (Cyberattaque.org, 2026-07-26). ZATAZ frames the compounding effect precisely: an old address, a still-active number and an administrative document leaked in three separate incidents combine into one exploitable profile, and the risks it names for the targets are spearphishing, identity theft, banking fraud and coordinated harassment (ZATAZ.COM, 2026-07-26).
Cette action ne révèle donc pas une intrusion unique contre le Parlement, elle illustre l’exploitation politique de données déjà compromises et leur recomposition en dossier de pression.
Le dossier rassemble des photographies, des adresses personnelles, des numéros de téléphone, des courriels, des dates de naissance et plusieurs identifiants administratifs. Certaines fiches contiennent aussi des coordonnées bancaires.
Alibaba's fastjson 1.2.68 through 1.2.83 carries a remote code execution flaw that fires under the library's shipped defaults: "This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required" (Alibaba fastjson2 project, 2026-07-21). The single deployment precondition is that the application runs as a Spring Boot executable fat-JAR, which the maintainer notes is the most common Spring Boot deployment model, and the advisory records end-to-end verification across Spring Boot 2.x/3.x/4.x and JDK 8, 11, 17 and 21. All three common entry points — JSON.parse, JSON.parseObject(String) and JSON.parseObject(String, Class) — are reachable, and the defensive habit most teams rely on does not help: passing a concrete target class is explicitly not a mitigation, because a payload can be nested inside any Object- or Map-typed field of that DTO (same advisory). The root cause is fastjson 1.x resolving user-controlled class names through a resource-probing path and treating the @JSONType annotation as a trust signal — behaviour fastjson2 removes architecturally, which is why no fastjson2 version is affected.
The operational problem is that there is nothing to patch. Imperva states that "FastJson 1.x is no longer actively maintained, and no patched 1.x version has been released for this vulnerability" (Imperva, 2026-07-24), leaving three vendor-sanctioned routes: enable SafeMode, which rejects all @type input before the vulnerable path is reached; deploy the 1.2.83_noneautotype build, which strips the vulnerable code at compile time; or migrate to fastjson2 (Alibaba fastjson2 project, 2026-07-21). Deployments that are not Spring Boot fat-JARs — uber-JARs and Tomcat or Jetty WAR deployments — do not meet the trigger condition, and fastjson 1.2.60 and earlier lack the vulnerable code path entirely (same advisory). Imperva reports attacks already in progress "across Financial Services, Healthcare, Computing, Retail, Business, and other industries", currently concentrated almost entirely on US-based organisations with a few in Singapore and Canada, and expects the targeting to expand globally; roughly 30 per cent of the attack traffic it sees comes from Ruby- and Go-based tooling rather than browser impersonators (Imperva, 2026-07-24). The vulnerability was reported by Kirill Firsov of FearsOff Cybersecurity (Alibaba fastjson2 project, 2026-07-21).
Detection concepts, telemetry class first: in reverse-proxy, WAF and application access logs, surface JSON request bodies carrying @type or @JSONType keys against any endpoint that deserialises user input; in process-creation telemetry with parent lineage, alert on the JVM spawning a shell or downloader child; and in egress telemetry, look for outbound connections initiated by the Java process at the moment of type resolution, which is how the resource-probing path manifests when it reaches for an attacker-supplied class. The discriminator against benign traffic is configuration state rather than the marker itself — applications that deliberately use fastjson's polymorphic deserialisation also carry @type fields, so the signal is a @type value resolving to something outside the application's own allow-listed DTOs on an instance where SafeMode is off, not the presence of the key. Because the exposure is a library rather than a product, the hard part is inventory: fastjson 1.x is most likely to be present in Swiss and European estates as a transitive dependency inside a vendor-supplied Spring Boot artifact, where neither an asset inventory nor a national-CERT advisory will name it.
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
So far, attacks exploiting this vulnerability are targeting a wide range of organizations, across Financial Services, Healthcare, Computing, Retail, Business, and other industries.
FastJson 1.x is no longer actively maintained, and no patched 1.x version has been released for this vulnerability.
The PTC Windchill / FlexPLM deserialization RCE this pipeline covered when CISA confirmed exploitation has moved from quiet data theft into open extortion. From 20 July a joint advisory by Ransom-ISAC, eCrime.ch and DEFUSED records that it "began observing an alleged Cl0p ransomware (aka Graceful Spider, Chubby Scorpius, FIN11, Lace Tempest) data extortion campaign sending emails with a subject line, “Windchill PDMLink module serious data leak” to an unknown number of affected organizations" (Ransom-ISAC / eCrime.ch / DEFUSED, 2026-07-22). The delivery pattern is the operationally useful part: the messages are sent from randomly compromised accounts and go to hundreds of recipients inside the victim organisation at once, carrying the attacker's current contact addresses — an approach the same advisory notes is consistent with the Oracle E-Business Suite campaign of last year apart from the new addresses (same advisory).
Two facts bound the response window. First, no victim has been named: "As of 22 July, Cl0p ransomware has not begun listing victims of this latest campaign on their dark web data leak site or has publicly claimed credit for this latest campaign" (same advisory), so an affected organisation's first and possibly only warning is the staff-wide email, not a leak-site entry. Second, attribution is unsettled and the two reporting streams disagree in a way worth carrying: the joint advisory treats this as Cl0p affiliate activity, while ReliaQuest, quoted by BleepingComputer, states that "The actor behind these attacks remains unconfirmed. however, the observed tradecraft shares characteristics with previous Cl0p campaigns targeting enterprise applications and high-value data repositories" (BleepingComputer, 2026-07-24). The underlying access route is unchanged from the June coverage — a pre-authentication information disclosure in the FlexPLM WSDL endpoint chained with the Windchill login-servlet flaw, followed by JSP web shells and staged data theft (Ransom-ISAC / eCrime.ch / DEFUSED, 2026-07-22).
One correction to how this pipeline previously framed remediation, because it changes who is still exposed: there is no version floor above which an installation is safe. PTC ships a patch per version, and its own change log records the older Windchill lines being patched between 18 and 19 June — 13.0.2 on 18 June, and 11.0 M030 alongside 13.1.1 on 19 June — while the SUPs for 13.1.2 and 13.1.3, and the first release naming FlexPLM as well as Windchill, only arrived on 14 July 2026 (PTC, 2026-07-14). 11.0 M030 appears in that patch list as a version that receives a fix, not as a boundary below which systems are safe, and there is no lower bound at all: NVD states the flaw "also impacts Windchill and FlexPLM releases prior to 11.0 M030", and above that it enumerates discrete affected releases rather than a continuous range, topping out at Windchill 13.1.3 and FlexPLM 13.0.3. The practical consequence is narrower than a version number suggests but sharper for those it catches: an estate on 13.1.2 or 13.1.3 had no patch available between CISA's KEV confirmation on 25 June and the SUP release on 14 July, whereas a 13.1.1 estate could have patched from 19 June. Neither a high version number nor a version above 11.0 M030 is therefore evidence of remediation, and only the per-version list in PTC's eSupport article CS473270 answers the question.
Triage: the extortion email is itself a detectable event with a clean discriminator. A legitimate internal security notice originates from a known internal sender and the organisation's own mail infrastructure; this pattern is a large recipient set inside one organisation receiving mail from a compromised account with no prior relationship to it, referencing a specific internal application by name. Mail-flow telemetry showing that fan-out to a wide internal distribution list from a previously-unseen sender — rather than the message content — is the signal, and it should route to incident response rather than to the phishing-report queue.
On 20 July, Ransom-ISAC began observing an alleged Cl0p ransomware (aka Graceful Spider, Chubby Scorpius, FIN11, Lace Tempest) data extortion campaign sending emails with a subject line, “Windchill PDMLink module serious data leak” to an unknown number of affected organizations
As of 22 July, Cl0p ransomware has not begun listing victims of this latest campaign on their dark web data leak site or has publicly claimed credit for this latest campaign.
The actor behind these attacks remains unconfirmed. however, the observed tradecraft shares characteristics with previous Cl0p campaigns targeting enterprise applications and high-value data repositories.
Check each Windchill / FlexPLM instance against PTC's per-version patch list (eSupport CS473270) rather than against a version floor — 11.0 M030 is itself a patched version, and estates on the current 13.1.3 / 13.1.2 SUPs had no patch available until 14 July, so a recent version number is not evidence of remediation.
If an instance was internet-reachable and unpatched at any point since mid-June, treat a burst of externally-sent emails to large internal distribution lists referencing a Windchill data leak as a breach notification rather than spam — pull the mail headers and start a compromise assessment of the PLM host instead of waiting for a leak-site listing.
Inventory Java estates for fastjson 1.2.68–1.2.83 — including transitive dependencies inside vendor-supplied Spring Boot fat-JARs — and on every hit enable SafeMode (-Dfastjson.parser.safeMode=true) or swap to the 1.2.83_noneautotype build; there is no patched 1.x release to wait for.
2026-07-27T0409Z-intel· Claude Opus 5 · window 24 h · 3 entries published
Run record — 2026-07-27T0409Z-intel
Monday-morning UTC fire, 3 h after the 01:10Z weekly and ~24 h after the previous intel run. The window is the 24 h floor. The active source surface was swept across four parallel research tracks — active threats and vulnerabilities, home region and sector, research and investigative reporting, and incidents and disclosures. The research track returned nothing, a genuine weekend-to-Monday publishing lull in which every major lab's newest post was dated 2026-07-24 or earlier; the other three returned one, two and two items respectively. Three entries published: two new and one update. No deep dive.
Verification & coverage notes
Published (3). An exploited, unpatchable-in-1.x remote code execution flaw in Alibaba fastjson (CVE-2026-16723, high); a delta update on the PTC Windchill / FlexPLM campaign now running a mass extortion-email phase attributed to Cl0p affiliates (high, update_of the 2026-06-27 entry); and a hacktivist doxing operation against French political figures over the Chat Control file — 24 by ZATAZ's count, with a further group and no stated total (notable).
Sourcing correction caught before composition. The fastjson research return stated that "ThreatBook and Imperva independently confirmed" in-the-wild exploitation. A direct read of the Imperva post found no mention of ThreatBook anywhere in it, and no other fetched source carried that attribution. The ThreatBook claim was dropped and the exploitation evidence is attributed solely to Imperva's own telemetry, which is also why the entry's credibility rating is 2 rather than 1.
An apparent contradiction that is not one. CISA's SSVC record for CVE-2026-16723 scores exploitation as none, but it is timestamped 2026-07-23 and Imperva's exploitation report is dated 2026-07-24. The entry states both dates rather than picking a side, and the sourcing note explains the ordering.
CVSS discrepancy resolved to the owning records. Reporting on CVE-2026-12569 splits between 9.3 and 9.8. Both are correct on different scales: 9.8 is NVD's primary CVSS v3.1 score, 9.3 is the CVSS v4.0 score PTC assigned as CNA and the figure this store's June entries carry. The update entry uses 9.8 and states the split in its sourcing note. For CVE-2026-16723 the only published score is the 9.0 Alibaba assigned as CNA.
Cross-track recovery. The vulnerability track investigated the Cl0p / Windchill story and dropped it as three days stale; the incidents track surfaced it independently with the extortion-phase development the first had not seen. The completeness check recovered it, and it publishes as an update carrying only the delta — the actor attribution and the extortion wave — not a recap of the June exploitation coverage.
Attribution kept split where the sources split. The joint Ransom-ISAC / eCrime.ch / DEFUSED advisory frames the Windchill campaign as Cl0p affiliate activity; ReliaQuest, quoted by BleepingComputer, holds the actor unconfirmed on tradecraft overlap. Both framings appear in the entry, and the registry relation carries the same caveat in its note. Similarly, the handle "Cybernox" is named only by Cyberattaque.org — ZATAZ reports the same operation without naming the actor — so the entry attributes the handle to the source that supplies it.
Indicators withheld. The Ransom-ISAC advisory publishes command-and-control IP addresses, a file hash, a distinctive attacker request-header value and a web-shell filename pattern. None of these appear in the entry; the behaviour is described instead.
borderline-drop: CuteSec / "misère" claim of a 111,528-record French Interior Ministry and Gendarmerie personnel leak — a single hacker post relayed by two lower-reliability outlets with no independent verification of the data's origin, no ministry confirmation or denial, and no high-reliability journalism. Scale and the shared Chat Control campaign link argued for inclusion; corroboration is simply absent. Recoverable as a watch item if the ministry or a stronger outlet confirms.
borderline-drop: Deadlock leak-site listing of Schaad, Balass, Menzl & Partner AG, a Zurich and Winterthur intellectual-property law boutique (2026-07-25). Home-region nexus and real client-confidentiality stakes, but the only sources are a leak-site tracker and an aggregator mirror of the same post. The previous fire dropped this item for the same reason and logged it for follow-up; 24 h later it is still uncorroborated, so it stays out.
borderline-drop: ExfilSquad claims against the UK Department for Education, the Police National Legal Database and Newcastle University — direct public-sector nexus, but multiple write-ups document this brand posting fourteen victim claims in a single day including implausible entries, with no official confirmation. Publishing would amplify what looks like a fabricated-claim campaign.
out-of-window: Deutsche Bank third-party extortion claim (event 2026-07-04, denied by the company); Netze BW / Stuttgart Netze smart-meter third-party breach (freshest source 2026-07-16); SentinelOne Kubernetes CSI path-traversal research (2026-07-23 13:00, roughly 15 h outside the 72 h developing window). Also dropped as stale with no fresh delta: Windows LegacyHive/BlueHammer proof-of-concept activity, Windmill CVE-2026-29059, an OpenSSL denial-of-service issue, Ubuntu snap-confine CVE-2026-8933.
Recency disclosure. Two of the three entries rest on sources inside the 72 h developing window rather than the strict 24 h window. The Chat Control entry has an in-window primary (Cyberattaque.org, 2026-07-26 13:12 UTC) alongside a ZATAZ piece published three hours before the window opened. The fastjson entry's substantive sources are the 2026-07-21 vendor advisory and the 2026-07-24 exploitation report; it is carried as an actively developing story because exploitation is ongoing and expanding, no 1.x patch exists, and no national CERT in Switzerland, the Netherlands, Germany, France, Poland or at EU level had published on it. The Windchill entry is an update whose delta dates from 20-25 July. A search for fresher reporting on both stories found nothing newer.
No deep dive. No earlier run published one today, so the slot was open, but nothing earned it. The fastjson flaw has confirmed exploitation but reported targeting is almost entirely US-based and constituency exposure is unestablished, so it fails the "non-trivial exposure" half of the first criterion. The Windchill item is a delta on a CVE already deep-dived in June, and the doxing item is not technical. No depth was manufactured to fill the slot.
Verification took seven passes, and the loop earned them. Five rounds returned fixes before two consecutive clean reads on different models closed it. The substantive work concentrated on one paragraph of the Windchill entry: the first pass found it treating a version as a patch floor when the vendor lists that version among those receiving a patch, and the correction for that error then over-stated the affected range in the other direction, which the next pass caught. Between them the rounds also removed an unsourced actor alias, a count asserted as settled that the sources leave open, and a claim about compromised sender accounts that neither source makes. One finding was rejected rather than applied: a pass reported that a version had gone unpatched until mid-July when the vendor's own change log records it patched on 18 June, and a later pass re-derived the change log independently and upheld the rejection. The residual count is zero.
Source health: clean. The full probe covered 166 of 166 sources in 108 s with no source classed as needing a bridge or a demotion — no standing repair order this run. Three sources nonetheless have a recipe-quality gap the reachability probe cannot see: ps.tc, ReliaQuest and Trellix all answer at the transport layer but their listing pages return only navigation markup or a stale index, so their post content is not actually reachable. Documented in their records for a future run to fix; none is a demotion, since none is a transport failure.
Jina reader pool: recovered, with one dead key. The previous four consecutive runs reported the pool exhausted at HTTP 402. It now carries a working balance and served every fetch it was asked for this run, including the github.com-hosted fastjson advisory that no direct transport could reach. One credential in the rotation still returns 402 and the fetcher rotates past it automatically, so the correct read is a partially-degraded but functioning pool, not an outage — a change from how the last four records described it.
Coverage gaps: inside-it-ch (403 to every transport — see fetch_failures); ransom-isac blog listing (403 on the index; the specific advisory was reachable via the bridge, so only the sweep of that outlet's other recent posts was lost); apple-security (client-side-rendered advisory table returns no rows to WebFetch or the bridge — a recipe gap, not escalated to the reader because nothing suggested an in-window Apple advisory); cisa-directives (not separately fetched — the advisories and ICS listings showed no in-window CISA activity at all); mysites-guru, kudelski-security, withsecure-labs (not reached inside the 45-minute budget); ccn-cert-es (reader returned a stale 2023 snapshot); le-monde-info (fetch returned apparently mis-cached 2025 content); ncc-research (listing returns boilerplate with a stale date meta).
Watchlist: not reported — the organization profile configures no product or supplier watchlists, so both sweeps are no-ops.
Essential-coverage: all essential-tier sources in the vulnerability and home-region slices were attempted and answered. The CISA advisories listing was enumerable this run via the bridge and carried no in-window addition; the KEV catalog's newest entry is still dated 2026-07-22.