Hackers are actively exploiting a critical zero-day vulnerability in FastJson, an open-source Java library developed by Alibaba, that enables remote code execution without requiring user interaction or elevated privileges. Security firms ThreatBook and Imperva confirm that the attacks are almost entirely focused on U.S.-based organizations spanning financial services,