Risky Bulletin: A JSON RCE bug is about to rock the Java world

0:03This is the Risky Bulletin, prepared by Katalin Kimpanu and read by me Claire Aird. Today is the 27th of July, and this podcast episode is brought to you by Airlock Digital. In today's top story, threat actors are exploiting a vulnerability in the FastJSON Java library. Details of the bug were published on GitHub last week, and active exploitation began the following day. Exploitation doesn't require authentication and works against the library's default configuration. The bug only impacts older 1.x versions. The current 2.x releases are unaffected. The library's developer, Alibaba, hasn't released a patch yet, but it has urged developers to turn on the library's safe mode or upgrade to a newer unaffected version.

0:52In other news, OpenAI took almost a week to notice that two of its models hacked AI platform Hugging Face. The rogue model spent two full days inside Hugging Face's environment before being evicted on July 13. Open AI engineers discovered their models had escaped containment on July 16 after Hugging Face published a blog post about the hack. Meantime, US lawmakers have proposed a bill that would force AI companies to build kill switches for their most powerful models. The AI Kill Switch Act would also require companies to report security incidents to authorities. The bill was proposed after OpenAI models hacked AI platform Hugging Face.

1:37The South Korean government will change the email addresses of its diplomatic officials following a recent hack of its Diplomat Training Academy. The Ministry of Foreign Affairs is concerned that leaked addresses could be used for spearfishing attacks targeting specific diplomats. Unidentified hackers breached the Korean National Diplomatic Academy in April 2025. They remained in the system until February this year. The US has indicted a Chinese national over his role in international gift card fraud. Jin Bin-ren received stolen cards from victims through romance fraud, elder fraud, hacking and theft.

2:15He allegedly used the cards to purchase high-value electronics before shipping them to China, where they were resold for a profit. Wren ran a warehouse in Salem, New Hampshire and coordinated with other group members over WeChat. The US Justice Department is prosecuting a man for allegedly giving US Customs and Border Protection agents a duress password. When the agents used the password on Samuel Tunick's phone, the contents of the device were wiped. The phone was running Graphene OS, which includes the security feature. Tunik is an activist who opposed the construction of the so-called Cop City Campus in Atlanta.

2:54His device was seized by border agents last year when he returned to the US from travelling abroad. Cyber scam compounds are still active in Myanmar despite a public government crackdown. Criminal groups have built smaller compounds rather than using large multi-building complexes. They're also running compounds in the jungle away from large population centres. The ruling military junta made a show last year of blowing up buildings from the country's largest scam compound, KK Park. Hackers are breaching hotel Wi-Fi gateways to intercept DNS traffic and redirect victims to Microsoft 365 phishing sites.

3:34Security firm ReliaQuest first discovered compromised hotel Wi-Fi systems in June. They've been seen in India, Saudi Arabia and across multiple US cities. Researchers believe the campaign could be the work of Russian state hackers. Earlier this year, the US disrupted a Russian botnet of hacked routers that also hijacked traffic from Microsoft 365 login pages. Malicious residential proxy botnets are growing despite recent law enforcement takedowns. According to Lumen, almost 20 million IP addresses are now part of 30 residential proxy botnets. Almost half of the botnets are of Chinese origin. Many are also renting each other's infected bots as an attempt to look bigger than they actually are.

4:22A spear phishing campaign on Telegram is targeting exiled activists and dissidents in Belarus, Russia and Kazakhstan. The campaign attempts to trick targets into handing over single-use Telegram passcodes to attackers. The campaign has been traced back to at least 2024. Researchers at resident.ngo have not attributed the campaign to any threat actor. Google is rolling out a new naming scheme for threat actors. It will merge the naming schemes of Google's threat analysis group with Mandiant, which Google acquired in 2022. Chinese groups will be tracked under the codename Castle, Iranians as Ion, North Korea as Neptune and Russia as Relic.

5:04e-crime groups will be tracked as Comet, while uncategorised groups will continue to be tracked as UNC. A vulnerability in X-Charge EV charging stations can allow hackers to take over the devices. According to security firm Sailflow, the charging stations expose a misconfigured SSH service on the connector when cars are plugged in. The SSH server uses the default username of root and password of root. Attackers can exploit the bug for free recharges to cause physical damage or to move upstream in the charging operator's network. The RubyGems package repository has patched a CDN caching bug that exposed API keys to the wrong users when they were signing in.

5:49RubyGems believes 18 % of logins were affected by the leak. The team reviewed logs and found no sign of API keys being used maliciously. GitHub has added a cooldown period for its DependerBot service. DependerBot will now wait three days before opening a pull request and prompting developers to install dependency updates. The delay is meant to allow security tools time to detect malicious packages. The cooldown will not apply to security updates. DependerBot will continue to open pull requests as soon as the security fix is released in a dependency. And finally, the Signal Disappearing Messages feature will now delete call data, the feature previously only applied to text messages or media exchanged between users.

6:38And that is all for this podcast edition. Today's show was brought to you by Airlock Digital. Find them at airlockdigital.com. Thanks for your company.

6:56you