"So replacing your installations with a hardened version of Apache Commons Collections will not make your application resist this vulnerability."
Reply on news.ycombinator.com