DEF CON 34 – Gavin Zhong et al. – Python class-pollution exploitation in-the-wild against web workers

Ankit Mehta@Secvyn

•updated Aug 13, 2026•4•0•3

This rule detects suspicious process execution chains where common web application servers (gunicorn, uwsgi, celery) spawn command-line utilities (bash, sh, curl, wget, python3) containing strings indicative of Python object inspection or class pollution. This pattern is commonly associated with attempts to exploit server-side vulnerabilities for remote code execution or post-exploitation activities.