deserialization
Safeguard articles tagged "deserialization" — guides, analysis, and best practices for software supply chain and application security.
74 articles
Apache Camel's 39 CVEs of 19 October 2026: What They Are and Which Ones Apply to You
Apache published 39 CVEs for Apache Camel on 19 October 2026, including CVE-2026-78162 (CVSS 10.0) in camel-hazelcast. All are fixed in 4.18.5, 4.22.1 and 4.23.0. The 39 grouped by bug class, the five to check first, why 4.14 won't get a fix, and a dependency-list checker.
Hazelcast CVE-2026-107726 and CVE-2026-107725: The Fix and the Scanner Gap
Hazelcast fixed a critical member memory read (CVE-2026-107726) and a Predicates API authorization bypass (CVE-2026-107725) in March and May, and disclosed them in October. What changed in the code, the configuration you still need, and why scanners miss Enterprise builds and flag fixed ones.
Pickle on the Wire: 22 Advisories Show AI Inference Engines Trusting Their Own Network
22 advisories since 2025, 18 critical: AI inference engines unpickle data from network ports. The pattern, why internal ports leak, and a host check.
Qwik CVE-2026-84994: One Request, One Thenable, and a Node Server That Exits
Qwik CVE-2026-84994 let one request crash a Node server through a deserialized thenable. The fix, a lab, and a Qwik 2 version-string trap for scanners.
Your Config Parser Is an Interpreter and the File Chooses What It Does
Configuration feels inert because it looks like data. Several formats can execute code and several loaders will by default, which makes parsing a security decision the moment the file comes from anywhere but your own repository.
Roundcube's Same-Day KEV Entries: A 9.9 Deserialization Bug and an SVG XSS Foothold
A near-maximum-severity PHP deserialization RCE and a stored XSS bug via SVG animate tags landed in CISA's KEV catalogue on the same date, describing a realistic foothold-to-RCE chain.
A Joomla Editor and a Magento Cache Warmer Both Delivered Unauthenticated RCE at 9.8
Widget Factory's JCE editor and Mirasvit's Full Page Cache Warmer reached identical maximum severity through completely different root causes — a missing permission check and a PHP deserialization flaw.
SolarWinds Web Help Desk's Deserialization Problem, Confirmed for Ransomware
Two separate deserialization RCEs and a security-control bypass in Web Help Desk, one confirmed for ransomware use, plus a denial-of-service bug in Serv-U.
SharePoint and Exchange Produce Four More Confirmed-Exploited CVEs
Beyond the five-CVE cluster covered earlier, four more SharePoint and Exchange vulnerabilities were confirmed exploited across the year — including a 2023 Exchange bug confirmed nearly three years later.
WSUS and Configuration Manager: When Patch Infrastructure Itself Needs Patching
CVE-2025-59287 in WSUS and CVE-2024-43468 in Configuration Manager both scored CVSS 9.8 — critical bugs in the very tools organizations use to distribute trust across their fleet.
PTC Windchill and FlexPLM's Deserialization RCE Is Confirmed Tied to Ransomware
CVE-2026-12569, a deserialization RCE in PTC's product lifecycle management platforms, carries CISA's confirmed ransomware campaign flag — a notable finding in specialised industrial software.
Five SharePoint CVEs in Five Weeks: The Deserialization Habit Continues
Microsoft SharePoint had five vulnerabilities confirmed exploited between July and August 2026, three of them the same root cause: deserialization of untrusted data. One carries CISA's confirmed ransomware flag.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.