Default Configs Break Everything Again

Developers relying on Fastjson's stock default configurations are currently having their systems handed to attackers via an unpatched critical remote code execution vulnerability. Because default settings are notoriously terrible ideas, bad actors can execute commands remotely without needing any authentication whatsoever. Shielding applications from active exploitation requires manually altering default configurations and adding strict input controls until a proper patch exists. Why anyone leaves default settings enabled in production remains one of life's great mysteries.