--- title: GrapheneOS duress charge breaks new legal ground,... description: A US citizen faces federal charges for triggering a GrapheneOS duress wipe during a border search — the first known prosecution for using a built-in OS... canonical: https://daily.dev/posts/grapheneos-duress-charge-breaks-new-legal-ground-fastjson-1-x-rce-under-active-exploitation-nxka9siig twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GrapheneOS duress charge breaks new legal ground, Fastjson 1.x RCE under active exploitation | daily.dev og:description: A US citizen faces federal charges for triggering a GrapheneOS duress wipe during a border search — the first known prosecution for using a built-in OS... og:url: https://daily.dev/posts/grapheneos-duress-charge-breaks-new-legal-ground-fastjson-1-x-rce-under-active-exploitation-nxka9siig og:image: https://api.daily.dev/og/posts/NxKa9SIIg.png og:image:alt: GrapheneOS duress charge breaks new legal ground, Fastjson 1.x RCE under active exploitation og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GrapheneOS duress charge breaks new legal ground, Fastjson 1.x RCE under active exploitation **[Security Digest](https://daily.dev/sources/security_digest)** · 5 min read · 0 upvotes · 0 comments ## Summary A US citizen faces federal charges for triggering a GrapheneOS duress wipe during a border search — the first known prosecution for using a built-in OS security feature. Fastjson 1.2.68–1.2.83 has a CVSS 9.8 RCE with no patch for the 1.x branch and confirmed active exploitation, requiring immediate SafeMode enablement. A supply chain attack targeting Go developers hid JavaScript payloads in editor config folders of a real Go project to harvest credentials and CI/CD secrets. The msaRAT trojan routes all C2 traffic through headless Chrome sessions over Cloudflare Workers and Twilio TURN relays, making it nearly invisible to standard network monitoring. ## Content **TLDR:** A US citizen faces federal charges for triggering a GrapheneOS duress wipe during a border search — the first known prosecution for using a built-in OS security feature. Fastjson 1.2.68–1.2.83 has a CVSS 9.8 RCE with no patch for the 1.x branch and confirmed active exploitation, requiring immediate SafeMode enablement. A supply chain attack targeting Go developers hid JavaScript payloads in editor config folders of a real Go project to harvest credentials and CI/CD secrets. The msaRAT trojan routes all C2 traffic through headless Chrome sessions over Cloudflare Workers and Twilio TURN relays, making it nearly invisible to standard network monitoring. --- ## US charges developer for triggering GrapheneOS duress wipe at border search Samuel Tunick is facing federal charges for entering a GrapheneOS duress password during a border search at Atlanta's Hartsfield-Jackson airport, causing the device to wipe itself. Prosecutors are treating the OS's built-in security feature as criminal destruction of evidence — a legal theory nobody has tested before. The defense argument is straightforward: if the underlying search was unconstitutional, there was no lawful seizure to obstruct. The deeper implication is uncomfortable — using privacy-hardened software could itself be framed as evidence of criminal intent, which is exactly what's making civil liberties groups pay attention. [Read more](https://daily.dev/feed-by-ids?id=HcRPhvElS&id=HKY1TiGAj&id=qkw82NqZA) ## Fastjson CVE-2026-16723: CVSS 9.8 RCE actively exploited, no patch for 1.x branch A critical deserialization RCE in Fastjson 1.2.68–1.2.83 bypasses the autoType blacklist entirely by abusing a @JSONType annotation to trigger a class-resource lookup inside Spring Boot fat-JARs — no gadget classes required. Active exploitation is confirmed by ThreatBook and Imperva, and a public PoC exists. There is no patch for the 1.x branch. Enable SafeMode immediately via -Dfastjson.parser.safeMode=true and schedule migration to Fastjson 2.x, where SafeMode is on by default. [Read more](https://daily.dev/posts/6xgg5pLa9) ## Go ecosystem supply chain attack hides JavaScript payloads in .vscode and .claude config folders The Shai-Hulud npm worm family expanded into Go by planting malicious JavaScript inside .vscode/tasks.json and .claude/ directories of a real Go project (verana-blockchain). Opening the repo in an IDE triggers the payload automatically, harvesting credentials, cloud keys, SSH keys, and CI/CD secrets without exploiting Go's toolchain at all. The attack surface here is any developer who clones an unfamiliar repo and opens it — audit hidden config folders before opening, pin dependencies, and use short-lived scoped tokens in CI. [Read more](https://daily.dev/posts/LqbDNDaaL) ## msaRAT routes C2 through headless Chrome over Cloudflare Workers and Twilio TURN relays Cisco Talos published details on msaRAT, a Rust-based RAT used by the Chaos ransomware group that hijacks a legitimate Chrome or Edge session via CDP, injects JavaScript to bypass CSP, and routes all C2 traffic through WebRTC channels backed by Twilio TURN and Cloudflare Workers. The attacker's IP never appears in network logs, and traffic blends into normal browser activity. The tell is in the process tree: a browser launched by an installer with --headless and --remote-debugging-port flags is not normal. EDRs that don't inspect browser command-line arguments will miss this entirely. [Read more](https://daily.dev/posts/Ng8s5uSTp) --- ## Also notable - **WordPress pre-auth RCE CVE-2026-63030 patched, forced auto-updates activated:** WordPress patched wp2shell (CVE-2026-63030), a pre-auth RCE affecting versions 6.9.0–6.9.4 and 7.0.0–7.0.1 that chains a REST API batch-route confusion bug with SQL injection — no login, no plugins, no special config required — and activated forced auto-updates; verify your internet-facing installs received the patch and consider blocking the batch endpoint at the WAF layer as a backstop. [Read more](https://daily.dev/posts/pMH9adxQU) - **Cursor zero-day lets malicious git.exe auto-execute on Windows, 7 months unpatched:** Mindgard disclosed an unpatched zero-day in Cursor (7M+ active users) where a malicious git.exe in a repo root executes automatically on Windows when a developer opens the project; the same unsafe binary resolution pattern was found in GitHub Copilot CLI, Google Gemini CLI, and OpenAI Codex, while AWS Kiro patched a related issue as CVE-2026-10591. [Read more](https://daily.dev/posts/risodNpVx) - **Ill Bloom wallet vulnerability drained $3.1M from 431 wallets in a single day on May 27:** Weak RNG in older mobile wallet apps and browser extensions made BIP-39 recovery phrases mathematically guessable across Bitcoin, Ethereum, and 12+ other chains; check exposure at illbloom.org and if an address matches, generate a new wallet and move funds immediately — patching the app does not fix an already-generated phrase. [Read more](https://daily.dev/posts/X2p5EuuJc) - **FFmpeg MagicYUV heap overflow CVE-2026-8461 (CVSS 8.8) enables RCE via crafted AVI upload:** JFrog disclosed a 16-year-old heap out-of-bounds write in FFmpeg's MagicYUV decoder exploitable by delivering a 50 KB crafted AVI, MKV, or MOV file to any app using libavcodec — demonstrated as full RCE on Jellyfin and Nextcloud; upgrade to FFmpeg 9.0+ or apply the 7-line patch to libavcodec/magicyuv.c. [Read more](https://daily.dev/posts/oEQKbxaFA) - **7-Zip CVE-2026-14266 heap overflow in XZ decompression patched in version 26.02 after 5-year window:** A heap buffer overflow in 7-Zip's XZ decompression (MixCoder_Code in C/XzDec.c) existed undetected from version 21.07 (2021) through 26.01; rated CVSS 7.0, requires user interaction, no in-the-wild exploitation observed, but 7-Zip lacks auto-update so organizations must manually push 26.02 and audit embedded 7-Zip instances in third-party tools. [Read more](https://daily.dev/posts/bFYx6nVg2) ## Similar posts on daily.dev - [Fastjson 2.x Remote Code Execution Vulnerability Notice](https://daily.dev/posts/fastjson-2-x-remote-code-execution-vulnerability-notice-qj1f3nati) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber) [View this post on daily.dev](https://daily.dev/posts/grapheneos-duress-charge-breaks-new-legal-ground-fastjson-1-x-rce-under-active-exploitation-nxka9siig) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/grapheneos-duress-charge-breaks-new-legal-ground-fastjson-1-x-rce-under-active-exploitation-nxka9siig","headline":"GrapheneOS duress charge breaks new legal ground, Fastjson 1.x RCE under active exploitation","text":"A US citizen faces federal charges for triggering a GrapheneOS duress wipe during a border search — the first known prosecution for using a built-in OS security feature. Fastjson 1.2.68–1.2.83 has a CVSS 9.8 RCE with no patch for the 1.x branch and confirmed active exploitation, requiring immediate SafeMode enablement. A supply chain attack targeting Go developers hid JavaScript payloads in editor config folders of a real Go project to harvest credentials and CI/CD secrets. The msaRAT trojan routes all C2 traffic through headless Chrome sessions over Cloudflare Workers and Twilio TURN relays, making it nearly invisible to standard network monitoring.","url":"https://daily.dev/posts/grapheneos-duress-charge-breaks-new-legal-ground-fastjson-1-x-rce-under-active-exploitation-nxka9siig","datePublished":"2026-07-27T04:20:56.220Z","dateModified":"2026-07-27T04:21:18.284Z","author":{"@type":"Organization","name":"Security Digest","logo":"https://media.daily.dev/image/upload/s--m4ZKB_C0--/f_auto,q_auto/v1779959612/logos/security_digest","url":"https://daily.dev/sources/security_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/security_digest","name":"Security Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Digest","item":"https://daily.dev/sources/security_digest"},{"@type":"ListItem","position":3,"name":"GrapheneOS duress charge breaks new legal ground, Fastjson 1.x RCE under active exploitation"}]} ```