WAF Defense in Crisis? NSFOCUS Locks Down “Ghost Bits” Attacks in Advance

Ghost Bits is a reported end-to-end semantic inconsistency in Java character-to-byte narrowing where high-order Unicode bits are discarded on the backend, enabling attackers to submit payloads that appear harmless to front-line WAF/IDS but are restored to malicious ASCII upon execution. The report documents critical impacts across SQL injection, deserialization RCE, file upload/path traversal, and other high-risk vectors, notes public POCs and low exploitation threshold, and recommends fixes (fixed UTF‑8, input normalization, parameterized queries, code audits) while describing NSFOCUS WAF's decoding-layer detections.