Post

IFIN@ifin-intel.org

We have some breaking news. A potential RCE in Apache #Log4J 2 (yes, really) appears to have proofs-of-concept. We have the details, the initial bug report, and mitigation recommendations. We are verifying the PoCs currently. discourse.ifin.netwo... #ThreatIntel #ThreatIntel #IFIN

discourse.ifin.networkLog4j2 Allowlist Bypass Could Allow for RCELast Updated: 2026-08-26T17:05:28Z (UTC) What’s Happening A currently unconfirmed vulnerability in Apache Log4j could allow remote code execution (RCE) by bypassing the allowlist enforced by FilteredObjectInputStream (FOIS) during Java deserialization. Exploitation requires an uncommon configuration in which an application or logging service accepts serialized Log4j LogEvent objects through an FOIS-based receiver, as well as a suitable deserialization gadget on the target classpath. Unlik...