Smash Stories: Slaying a Silent RCE via Insecure Deserialization The Bug I Smashed During an authorized security assessment of a custom Python/Flask microservice, I discovered a chaotic, high-severity vulnerability masquerading as a harmless caching mechanism. The application was storing user session preferences in a base64-encoded cookie. The problem? The backend was deserializing this cookie using Python's inherently insecure pickle library without any integrity checks. This allowed arbit...