chs.us — Carl Sampsonhttps://chs.us/en-uscarl.sampson@gmail.com (Carl Sampson)carl.sampson@gmail.com (Carl Sampson)Wed, 01 Jul 2026 12:00:00 +0000Hand-rolling the JNDI Reference: what the JVM actually deserializeshttps://chs.us/2026/07/jndi-reference-deserialization/Wed, 01 Jul 2026 12:00:00 +0000carl.sampson@gmail.com (Carl Sampson)https://chs.us/2026/07/jndi-reference-deserialization/How a Log4Shell-style LDAP/RMI callback returns a javax.naming.Reference, byte for byte — and two serialization bugs that only a real JVM catches.SecurityJavaDeserializationJndiLog4shellRmiLdapWebsec