New Zero-day RCE Vulnerability Spring4Shell

A critical zero-day RCE (CVE-2022-22965, Spring4Shell) affecting Spring Framework on JDK9+ can be exploited when applications accept POJO parameters; exploit code can drop a web shell and execute arbitrary code with the Tomcat process privileges. The report covers the chaotic disclosure, confirmed active exploitation, available vendor patches, short-term mitigations (WAF, restricting DataBinder bindings), and detection/mitigation options via Aqua's scanning and runtime protections.