insecure deserialization 2 Insecure Deserialization: de objeto serializado a RCE 23/05/2026 RCE: Command Injection, SSTI e Upload que viram shell 12/04/2026