Search: “Apache”

722 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 252 Exploit / PoC 196 Ransomware 125 Malware 53 Data breach 48 Threat actor 31 Advisory 5 Policy & legal 4 Phishing & fraud 4 Model release 2 Research 1 AI safety & security 1

SeverityAll critical 616 high 101 medium 3 low 0 info 2

Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021

Apache Log4j 2 RCE CVE-2021-44228 is actively exploited via crafted JNDI lookups; Palo Alto Unit 42 urges upgrading to Log4j 2.17.1.

Unit 42 details CVE-2021-44228, an easily exploited remote code execution flaw in Apache Log4j 2 where attacker-supplied JNDI lookups in logged user input cause payload download and execution. Massive internet-wide scanning for unpatched systems has begun, with observed follow-on activity including information stealing, Cobalt Strike delivery, and coinmining. The recommended fix is Log4j 2.17.1, which also patches CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832. Widely used Java software including Apache Struts, Solr, Druid, Flink, ElasticSearch, and Spring Boot is affected.

Palo Alto Unit 42Aug 17, 12:20 UTC · Aug 17, 2026Exploit / PoC in the wildCVE-2021-44228 CVE-2021-45046 CVE-2021-45105+3 CVEs

New Apache Struts RCE Flaw Lets Hackers Take Over Web Servers

The Hacker NewsAug 23, 18:30 UTC · Aug 23, 2018Vulnerability CVE-2018-11776 CVE-2017-5638 CVE-2017-9805

Apache Struts 2 Flaws Affect Multiple Cisco Products

The Hacker NewsSep 12, 10:51 UTC · Sep 12, 2017Data breach in the wildCVE-2017-9805 CVE-2017-5638 CVE-2017-9793+2 CVEs

CVE-2026-34486: Apache Tomcat EncryptInterceptor Fail-Open Bypass

Technical analysis shows CVE-2026-34486 is a one-line fail-open regression in Tomcat Tribes enabling unauthenticated RCE via Java deserialization.

CVE-2026-34486 is a fail-open regression in Tomcat's Tribes EncryptInterceptor, introduced while fixing the CVE-2026-29146 padding-oracle flaw; Apache rated it Important and NVD scores it 7.5 High. Decryption failures are now forwarded to an unfiltered ObjectInputStream, and public PoC repositories demonstrate unauthenticated RCE on default port 4000 when clustering, the EncryptInterceptor, a reachable receiver and deserialization gadgets are all present. Affected releases 9.0.116, 10.1.53 and 11.0.20 are fixed in 9.0.117, 10.1.54 and 11.0.21; Tomcat 8.5 is unaffected.

Web discovery (articles for new exploits & KEV entries)Sep 8, 20:09 UTC · 7d agoExploit / PoC CVE-2026-34486 CVE-2026-291461

Suspected exploitation of Apache ActiveMQ flaw CVE-2023

Security AffairsNov 2, 13:52 UTC · Nov 2, 2023Ransomware in the wildCVE-2023-46604

Critical Apache Roller flaw allows to retain unauthorized access even after a password change

Security AffairsApr 15, 14:05 UTC · Apr 15, 2025Vulnerability CVE-2025-24859 CVE-2025-30065

Expert published NMAP script for Apache CVE-2021

Security AffairsOct 9, 12:04 UTC · Oct 9, 2021Vulnerability in the wildCVE-2021-41773 CVE-2021-420131

Apache Tomcat Patches Important Remote Code Execution Flaw

The Hacker NewsOct 5, 11:16 UTC · Oct 5, 2017Vulnerability CVE-2017-12617 CVE-2017-126152

Apache Foundation rejects allegation Equifax hackers exploited CVE-2017

Security AffairsSep 11, 15:51 UTC · Sep 11, 2017Data breach in the wildCVE-2017-9805 CVE-2017-5638

Apache fixed a critical SQL Injection in Apache Traffic Control

Security AffairsDec 26, 00:43 UTC · Dec 26, 2024Vulnerability CVE-2024-45387 CVE-2020-175301

Apache fixed a source code disclosure flaw in Apache HTTP Server

Security AffairsJul 7, 17:20 UTC · Jul 7, 2024Vulnerability CVE-2024-39884

Attackers exploiting Apache ActiveMQ flaw to deliver ransomware (CVE-2023-46604)

Help Net SecurityNov 21, 11:29 UTC · Nov 21, 2023Ransomware in the wildCVE-2023-46604

Apache rolled out a new update in a few days to fix incomplete patch for actively exploited flaw

Security AffairsOct 8, 07:38 UTC · Oct 8, 2021Vulnerability in the wildCVE-2021-41773 CVE-2021-42013

PoC exploit code for two Apache Struts 2 flaws available online

Security AffairsAug 15, 15:53 UTC · Aug 15, 2020Exploit / PoC CVE-2019-0230 CVE-2019-0233 CVE-2017-5638

Apache Solr RCEs with public PoCs could soon be exploited

Help Net SecurityNov 25, 00:00 UTC · Nov 25, 2019Exploit / PoC CVE-2019-12409

More than 2 million Apache HTTP servers affected by CVE-2019

Security AffairsApr 5, 07:51 UTC · Apr 5, 2019Vulnerability CVE-2019-0211

Vulnerability Spotlight: Apache OpenOffice Vulnerabilities

Cisco TalosOct 26, 14:26 UTC · Oct 26, 2017Vulnerability in the wildCVE-2017-9806 CVE-2017-12607 CVE-2017-12608

PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory

Sophos details PoisonedRefresh, a fileless Linux rootkit that injects a memory-resident PHP web shell into F5 BIG-IP APM after exploitation of CVE-2025-53521.

On September 8, 2026, SophosLabs published an analysis of Linux/Agnt-IC (dubbed PoisonedRefresh by ESET) found in compromised F5 BIG-IP Access Policy Manager environments. Initial access leverages CVE-2025-53521, an unauthenticated RCE in BIG-IP APM when an access policy is configured on a virtual server; F5 confirmed exploitation and links the activity to cluster c05d5254, while Shadowserver observed 795 exposed vulnerable endpoints. A first stage hidden in a modified umount binary modifies /usr/sbin/httpd and SELinux configuration and embeds itself in BIG-IP upgrade images for persistence. The second-stage ELF intercepts __libc_start_main, hooks apr_dso_load, and injects a PHP web shell into libphp memory via mmap manipulation, leaving no disk artifacts, and exposes a /bin/bash shell via a local UNIX domain socket instead of a TCP port.

Security AffairsSep 9, 08:50 UTC · 7d agoMalware in the wildCVE-2025-53521

Researchers warn of a new critical Apache OFBiz flaw

Security AffairsAug 5, 16:42 UTC · Aug 5, 2024Exploit / PoC in the wildCVE-2024-38856 CVE-2024-32113 CVE-2023-51467

HelloKitty Ransomware Group Exploiting Apache ActiveMQ Vulnerability

The Hacker NewsNov 4, 04:55 UTC · Nov 4, 2023Ransomware in the wildCVE-2023-46604

CVE-2021-31805 RCE bug in Apache Struts was finally patched

Security AffairsApr 13, 19:32 UTC · Apr 13, 2022Vulnerability CVE-2021-31805 CVE-2020-17530

Threat Advisory: Critical Apache Log4j vulnerability being exploited in the wild

Cisco TalosDec 10, 19:37 UTC · Dec 10, 2021Exploit / PoC in the wildCVE-2021-44228 CVE-2021-45046 CVE-2021-45105+1 CVEs

New Apache Struts Zero-Day Vulnerability Being Exploited in the Wild

The Hacker NewsMar 9, 12:03 UTC · Mar 9, 2017Exploit / PoC in the wildCVE-2017-5638

CVE-2026-34486: Apache Software Foundation Apache Tomcat

CISA added CVE-2026-34486, an actively exploited Apache Tomcat EncryptInterceptor bypass enabling unauthenticated deserialization RCE, to its KEV catalog.

CVE-2026-34486 allows bypass of Apache Tomcat's EncryptInterceptor, a flaw introduced by the fix for padding-oracle issue CVE-2026-29146 in Tribes cluster encryption. CISA added the flaw to the Known Exploited Vulnerability catalog on August 4, 2026, alongside actively exploited Langflow and N-central flaws, with remediation required under BOD 26-04 guidance. Official patches and workarounds are available, and reporting notes unauthenticated remote code execution through Java deserialization on the Tribes receiver port 4000.

Web discovery (articles for new exploits & KEV entries)Sep 9, 04:23 UTC · 7d agoExploit / PoC in the wildCVE-2026-34486 CVE-2026-291462