Waratek Q4 2026 - Update (2026-Oct-12)

Waratek has published several new website updates.

• One-Line Change to RCE: How Easily a Java Deserialization Flaw Is Introduced

  Source: Blogs
  Publication date: October 6, 2026

  This Waratek blog entry discusses how a small code change can introduce a Java deserialization remote-code-execution flaw.

  Read the full entry on the Waratek website: https://waratek.com/blogs/one-line-change-deserialization-rce/

• AI Broke the Deserialization Threat Model

  Source: Blogs
  Publication date: October 1, 2026

  This Waratek blog entry covers AI and Java deserialization gadget chains.

  Read the full entry on the Waratek website: https://waratek.com/blogs/ai-java-deserialization-gadget-chains/

• Attackers Bypass WAFs With a Single Character to Exploit Critical Oracle PeopleSoft Flaw

  Source: News
  Publication date: September 28, 2026

  This Waratek news item discusses attackers bypassing WAFs with a single character to exploit a critical Oracle PeopleSoft flaw.

  Read the full entry on the Waratek website: https://waratek.com/news/oracle-peoplesoft-waf-bypass-exploit/

• September CSPU: Patch Volume Drops Sharply, but Six Vulnerabilities Reach Maximum Severity

  Source: News
  Publication date: September 16, 2026

  This Waratek news item provides Waratek’s analysis of Oracle’s September 2026 Critical Security Patch Update.

  Read the full entry on the Waratek website: https://waratek.com/news/september-2026-oracle-cspu-analysis/