https://www.cnpanda.net/en/ Security research and technical writing by Panda. en Wed, 02 Sep 2026 10:46:11 GMT https://www.cnpanda.net/en/talksafe/transformer-after-ai-progress.html https://www.cnpanda.net/en/talksafe/transformer-after-ai-progress.html Wed, 02 Sep 2026 10:46:11 GMT Starting from Transformer's enduring dominance, this article examines where AI has actually advanced in recent years: scaling, data, training, MoE, FlashAttention, test-time compute, Mamba, and more. https://www.cnpanda.net/en/sec/java-security-blackhat-2002-2026.html https://www.cnpanda.net/en/sec/java-security-blackhat-2002-2026.html Thu, 27 Aug 2026 15:51:05 GMT Using representative Black Hat talks from 2002–2026 as a thread, this piece revisits how Java security research moved from the JVM sandbox and client-side exploitation to deserialization, JNDI, middleware, parsing differentials and runtime defense. https://www.cnpanda.net/en/life/1324.html https://www.cnpanda.net/en/life/1324.html Tue, 04 Aug 2026 03:06:00 GMT Several recent events made me realize just how decisively the security field has entered the AI era. They prompted this essay and some reflection on the future. The first was the shutdown of PSRC. On July 23, PSRC announced that, because of business changes, the platform would cease operations on July 30. The news left me reflective: over the past year, the pace of vulnerability discovery has accelerated dramatically. In the past, one person finding a… https://www.cnpanda.net/en/sec/react2shell-cve-2025-55182.html https://www.cnpanda.net/en/sec/react2shell-cve-2025-55182.html Mon, 08 Dec 2025 02:22:42 GMT A deep analysis of React2Shell (CVE-2025-55182): its root cause in the React Server Components Flight Reply deserializer, prototype-chain path traversal, the RCE gadget chain, and the patch. https://www.cnpanda.net/en/ctf/1301.html https://www.cnpanda.net/en/ctf/1301.html Mon, 28 Oct 2024 05:44:00 GMT 0x01 Introduction A while ago I created a misc challenge for the ByteCTF Masters competition. It grew out of my recent research into a middleware product, and I found the idea interesting enough to share the challenge-design process here. 0x02 A Small Joke Message-oriented middleware has become a key component of distributed systems and microservice architectures. Common products include ActiveMQ, Kafka, RabbitMQ, and RocketMQ… https://www.cnpanda.net/en/talksafe/1277.html https://www.cnpanda.net/en/talksafe/1277.html Mon, 28 Oct 2024 05:34:00 GMT Figure 1 uses MurphySec's JAR scanner to identify vulnerable components. Figures 2 and 3 cover unusual servlets and services worth checking in web.xml or xxxService.xml. Figure 4 is a shortcut for locating related classes, Figure 5 covers batch decompilation, and Figure 6 shows how to find route lists with keyword searches… https://www.cnpanda.net/en/sec/1227.html https://www.cnpanda.net/en/sec/1227.html Wed, 01 Mar 2023 02:20:00 GMT Dynamic SQL is one of MyBatis's most powerful features. Constructing SQL manually is painful: spaces must be preserved and the trailing comma after the final column must be removed. Dynamic SQL eliminates that work. MyBatis is generally configured in one of two ways: XML files or annotations… https://www.cnpanda.net/en/sec/1196.html https://www.cnpanda.net/en/sec/1196.html Sat, 16 Apr 2022 13:43:00 GMT First published on Tiaotiaotang: http://tttang.com/archive/1532/ This blog is a backup. 0x01 Preface If asked to assess a CMS, where would you begin? Perhaps with the familiar body of code-auditing knowledge. But if asked to assess the Spring Framework itself, where would you begin? More broadly… https://www.cnpanda.net/en/sec/1159.html https://www.cnpanda.net/en/sec/1159.html Sat, 05 Mar 2022 17:16:00 GMT 0x01 Preface On Tuesday, March 1, Spring published its Spring Cloud Gateway CVE report. CVE-2022-22947 was rated Critical. Analyses appeared Wednesday and Thursday, but work and thesis writing delayed my review. I reproduced and analyzed it over the weekend… https://www.cnpanda.net/en/sec/1183.html https://www.cnpanda.net/en/sec/1183.html Sat, 05 Mar 2022 17:05:25 GMT An article written last year but never published, now shared as both WeChat content and personal notes. Preface Since Fastjson 1.2.24's deserialization vulnerability was disclosed on March 15, 2017, it has been a major research target. Even checkAutoType did not fully stop new vulnerabilities. This article examines one through Xuanwu Lab's Black Hat talk… https://www.cnpanda.net/en/talksafe/1157.html https://www.cnpanda.net/en/talksafe/1157.html Wed, 29 Dec 2021 06:38:00 GMT Preface A tweet last night attracted considerable attention in the security community. Log4j 2.17.0 has RCE!! Yet the community mostly scoffed: RCE after modifying a configuration file—is that all? So how did configuration-file RCE become fashionable? The story begins… https://www.cnpanda.net/en/sec/1131.html https://www.cnpanda.net/en/sec/1131.html Sun, 12 Dec 2021 18:57:00 GMT 0x01 Preface While following up on Log4j 2, I found several interesting details and recorded them here. 0x02 Is Log4j Never Vulnerable to JNDI Injection? First, a question: is Log4j never vulnerable to JNDI injection? No. I found an interesting exchange in a Log4j 2 pull request. Someone argued that Log4j is vulnerable… https://www.cnpanda.net/en/sec/1114.html https://www.cnpanda.net/en/sec/1114.html Sat, 11 Dec 2021 13:21:06 GMT 0x01 Preface. December 9, 2021 became a sleepless night when Apache Log4j was found vulnerable to a simple, high-impact RCE. Countless components depend on Log4j2, apart from the risks in applications themselves. A Maven Repository search for projects using log4j-core 2.14… https://www.cnpanda.net/en/sec/1063.html https://www.cnpanda.net/en/sec/1063.html Sat, 20 Nov 2021 03:15:00 GMT 0x01 Preface Some time ago I finally wrote Principles and Case Study of File Inclusion, which mentioned Thymeleaf SSTI. Yesterday Sanmeng shared a newly discovered Thymeleaf SSTI bypass CVE. Since my project code was still available, I analyzed it. 0x02 Thymeleaf SSTI Thymeleaf… https://www.cnpanda.net/en/codeaudit/1037.html https://www.cnpanda.net/en/codeaudit/1037.html Sat, 13 Nov 2021 06:49:14 GMT 0x00 Preface. I created this series because online Java code-audit material is usually fragmented and unfriendly to beginners. I am also learning Java auditing, so the series records and summarizes that process. It is intended for readers with basic Java syntax knowledge and will cover… https://www.cnpanda.net/en/talksafe/1023.html https://www.cnpanda.net/en/talksafe/1023.html Tue, 28 Sep 2021 01:09:00 GMT 0x01 Preface Every note in this series is based on Understanding JVM Bytecode in Depth by Zhang Ya and is intended only as a personal study summary. Readers studying Java security or JVM bytecode are strongly encouraged to purchase and read the official book. 0x02 Class-File Structure Java is cross-platform, although the JVM itself is platform-specific. JVM implementations hide those platform differences by compiling source code into platform-independent bytecode, so… https://www.cnpanda.net/en/life/995.html https://www.cnpanda.net/en/life/995.html Thu, 15 Jul 2021 05:54:00 GMT About this book. I finished writing it last December. The seven months from revision to publication were a long and demanding journey. The book is well suited to beginners and expands both the breadth and depth of my Java Code Auditing for Beginners article series—which is also why that series had not been updated for so long. If you want to learn Java code auditing, consider picking up a copy. Purchase link: https://item.jd.… https://www.cnpanda.net/en/sec/974.html https://www.cnpanda.net/en/sec/974.html Wed, 30 Jun 2021 04:42:00 GMT 0x01 Preface The native JDK 8u20 deserialization vulnerability is a classic and one of the most complex vulnerabilities I have analyzed. It uses substantial low-level knowledge and assumes familiarity with the deserialization process and serialized-data structure. This article reflects my own understanding; please point out any inaccuracies. 0x02 JDK 8u20 Vulnerability Principles JDK… https://www.cnpanda.net/en/sec/968.html https://www.cnpanda.net/en/sec/968.html Fri, 25 Jun 2021 11:49:24 GMT JEP 290 0x01 What Is a JEP? JDK Enhancement Proposal, abbreviated JEP, is the process for proposing JDK enhancements. The index has reached JEP 415. This article focuses on JEP 290: what it is, what it does, and known bypass approaches. 0x02 What Is JEP 290? JEP 290 is described as Filter Incoming… https://www.cnpanda.net/en/sec/928.html https://www.cnpanda.net/en/sec/928.html Sun, 13 Jun 2021 14:48:04 GMT 0x01 Preface As with the previous article, copy the demo and follow this analysis in a debugger. 0x02 Flow Analysis In Analysis of the Serialization Process, I noted that serialization writes an object to an I/O stream. It usually begins by creating an ObjectOutputStream… https://www.cnpanda.net/en/sec/927.html https://www.cnpanda.net/en/sec/927.html Sun, 13 Jun 2021 08:48:19 GMT Why did I start this official account? Traditional blogs no longer fully meet the needs of mobile readers. People increasingly prefer to use spare moments to read on their phones, which gave me the idea of creating a mobile platform. Blogging has been a habit of mine for nearly ten years, although my earlier writing appeared under another handle. When I was learning, I was deeply grateful to the people who willingly shared their knowledge, so once I became able to share what I had learned, I did not want to hold back… https://www.cnpanda.net/en/sec/893.html https://www.cnpanda.net/en/sec/893.html Sun, 13 Jun 2021 08:16:00 GMT 0x01 Preface This article is detailed; copy the demo and follow in a debugger. 0x02 Flow Analysis Serialization writes an object to an I/O stream. It usually begins by creating ObjectOutputStream and calling its write… https://www.cnpanda.net/en/talksafe/892.html https://www.cnpanda.net/en/talksafe/892.html Thu, 10 Jun 2021 15:53:00 GMT 0. Preface This article mainly translates the Object Serialization Stream Protocol and summarizes the serialization format. 1. Overview The stream format has the following design goals: a compact structure for efficient reading; the ability to use the stream structure and format without detailed knowledge of the stream or invoking class code; and access and manipulation only through the stream… https://www.cnpanda.net/en/sec/876.html https://www.cnpanda.net/en/sec/876.html Thu, 10 Jun 2021 15:06:00 GMT 0x01 Preface The construction of the native JDK 7u21 gadget chain is a classic. After studying its structure and underlying ideas, I wrote this article as a set of notes. 0x02 Prerequisites The JDK 7u21 chain uses many fundamental Java concepts, principally Java reflection, dynamic class modification with Javassist, Java static class loading, Java dynamic proxies, and hash collisions. To make the article easier to follow, I will… https://www.cnpanda.net/en/codeaudit/863.html https://www.cnpanda.net/en/codeaudit/863.html Sun, 30 May 2021 16:59:00 GMT 0x01 Preface. WeEngine CMS quietly fixed an SQL injection vulnerability in version 2.0. No analysis of the injection point could be found online, so this article examines its exploitation. 0x02 Affected versions. Testing shows the vulnerability in v1.5.2 from the official GitLee repository and a fix in 2.0, so at least v1.5.2 is affected… https://www.cnpanda.net/en/codeaudit/827.html https://www.cnpanda.net/en/codeaudit/827.html Wed, 18 Nov 2020 08:29:00 GMT 0x00 Preface. Xu recently told me Qishi CMS had patched a problem in the global assign_resume_tpl function and asked whether it was exploitable. The official advisory points to /Application/Common/Controller/BaseController… https://www.cnpanda.net/en/sec/787.html https://www.cnpanda.net/en/sec/787.html Mon, 19 Oct 2020 02:18:00 GMT 0x01 Preface During a recent Dianfeng Geek CTF, I encountered a web challenge hinting at register_argc_argv but could not solve it. I later asked yzddmr6 and searched Chinese security research, finding little. This PHP setting seemed worth documenting. My practical experience is limited, so additions are welcome… https://www.cnpanda.net/en/codeaudit/825.html https://www.cnpanda.net/en/codeaudit/825.html Thu, 15 Oct 2020 02:36:00 GMT 0x01 Preface. Xu recently pointed out a path from a low-privilege FastAdmin backend account to a shell. This article analyzes it. Affected versions: V1.0.0.20191212 beta and earlier. 0x02 Authorization. The main difficulty is that low-privilege users cannot access shell-related features… https://www.cnpanda.net/en/codeaudit/777.html https://www.cnpanda.net/en/codeaudit/777.html Sun, 20 Sep 2020 08:51:00 GMT Affected version: V1.0.0.20200506 beta, the latest release. Requirement: the member center must be enabled in /application/config.php. Vulnerability analysis: lines 58–67 of /application/index/User.php. user_request_empty is a developer hook and can be ignored; the important part is return $thi… https://www.cnpanda.net/en/codeaudit/759.html https://www.cnpanda.net/en/codeaudit/759.html Wed, 15 Jul 2020 02:43:00 GMT 0x00 Preface. I created this series because online Java code-audit material is usually fragmented and unfriendly to beginners. I am also learning Java auditing, so the series records and summarizes that process. It is intended for readers with basic Java syntax knowledge and will cover…