deserialization

Everything Malware Brief has reported about deserialization: 2 stories, newest first. Part of our Vulnerabilities coverage.

Vulnerabilities

Square Squash Users Face Critical RCE Risk as CVE-2026-109391 Enables Unauthenticated Code Execution

A critical vulnerability in Square Squash allows attackers to execute arbitrary code by exploiting insecure YAML processing in the symbolication API endpoint.

Oct 12, 2026

Vulnerabilities

IBM access software flaw lets attackers run code without credentials, hitting versions up to 10.0.9.2 and 11.0.3

A deserialization flaw in IBM access management software lets attackers run arbitrary code without credentials, affecting versions up to 10.0.9.2 and 11.0.3.

Oct 9, 2026