Lesson 8 of 9 · 30m

Java Deserialization: The RCE Primitive That Won't Die

How readObject became arbitrary code execution, gadget chains, and JEP 290 filters.