Nothing ruins a Tuesday quite like a researcher posting a critical zero-day on X and watching the exploitation attempts roll in before lunch. That's exactly what happened to GeoServer, the open-source mapping platform, on August 12 — and the plot twist is that we've technically been here before.

An Old Bug's Sequel Nobody Wanted

Researcher @q1uf3ng disclosed an unauthenticated SQL injection in GeoTools' jsonArrayContains function, the library underpinning GeoServer, scoring a maximum-severity 9.8 on the CVSS scale. Because it requires no login and can lead straight to remote code execution on systems using a PostGIS data store, watchTowr reported hundreds of exploitation attempts within hours, coming from a small cluster of IP addresses.

Here's the kicker: this is a regression of CVE-2023-25158, a nearly identical flaw patched back in 2023. The mitigation everyone applied three years ago — enabling prepared statements and disabling function encoding — does nothing against this version. Anyone who checked that box and moved on is not actually protected.

When "We Already Fixed That" Is a Trap

The real story here isn't the bug, it's the false sense of closure. Security fixes that quietly stop working when the underlying code shifts are one of the sneakiest categories of risk, because nobody re-tests something they consider solved. GeoServer shipped patches on August 14 (versions 3.0.1, 2.28.5, and 2.27.6), but the window between disclosure and patch was long enough for the RondoDox botnet to start scooping up vulnerable servers for its collection.

Anyone running geospatial infrastructure without an active patch-monitoring habit just got a very expensive reminder that "patched once" and "patched" are not the same sentence.

Old vulnerabilities don't stay dead — they just wait for the code around them to change.

If your team's patch strategy is "we fixed that already" rather than an ongoing process, our free developer's security checklist covers exactly how to keep that from becoming a repeat headline.

Source: The Hacker News