Search: “Apache httpd”

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans

Sophos found F5 BIG-IP APM malware that injects a PHP web shell into Apache's memory, evading disk scans, linked to exploited CVE-2025-53521.

Sophos's September 7 analysis describes malware tied to F5's c05d5254 activity that hooks apr_dso_load, modifies the libphp PHP module in memory, and injects a PHP web shell when Apache loads apm_css.php3, full_wt.php3 or webtop_popup_css.php3, leaving on-disk files clean. A separate installer infects /usr/sbin/httpd and umount, runs before Apache starts, disables SELinux (per ESET's related PoisonedRefresh analysis), and opens a local socket at /run/bigtlog.pipe for shell access. The activity is linked to CVE-2025-53521 in BIG-IP APM, rated 9.8 CVSS 3.1, patched in October 2025, added to CISA KEV on March 27, 2026.

The Hacker News·Sep 9, 07:36 UTC · 7d agoMalware in the wildCVE-2025-53521

72

CVE-2026-80351: Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod

Apache Camel K CVE-2026-80351 lets tenant-controlled Maven repository content execute code inside the operator pod; fixed in 2.9.3/2.10.2.

Apache disclosed a critical eval injection vulnerability (CVE-2026-80351) in Apache Camel K, where improperly neutralized directives in dynamically evaluated Maven configuration let tenant-controlled repository content reach Maven execution inside the operator pod. This can allow tenant-controlled content to influence code execution in the operator context. Affected versions are 2.0.0 before 2.9.3 and 2.10.1 before 2.10.2; fixes are available in 2.9.3 and 2.10.2.

oss-security·Sep 10, 14:06 UTC · 6d agoVulnerability 3 sourcesCVE-2026-803512

35

CVE-2026-73236: Apache Syncope: Cross-Realm authorization bypass in delegated administration

Apache Syncope CVE-2026-73236 bypasses delegated administration checks for sibling Realms sharing a name prefix.

Apache Syncope disclosed CVE-2026-73236, an important-rated incorrect authorization vulnerability. Delegated administration checks are enforced via Realm hierarchy prefix matches, so two sibling Realms whose names begin with the same string cannot be correctly distinguished, allowing delegated admins to act outside their assigned Realm. The flaw affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to fixed versions.

oss-security·Sep 14, 15:25 UTC · 1d agoVulnerability 3 sourcesCVE-2026-732361

28

Public PoC Released for Apache Superset SQL Injection Vulnerability

A public Python PoC exploit is available for CVE-2026-23980, an authenticated error-based SQL injection in Apache Superset versions before 6.0.0.

CVE-2026-23980 is a SQL injection flaw (CWE-89) in Apache Superset affecting all releases before 6.0.0, exploitable via the sqlExpression and where parameters by authenticated users with read-level access. A public repository containing a Python exploit.py proof-of-concept has been released, reducing attacker effort against exposed instances. Apache disclosed the issue on February 24, 2026 and fixed it in Superset 6.0.0. Defenders should upgrade and monitor logs for malformed queries, database errors, and unusual activity from low-privilege accounts.

Cyber Security News·updated 09:23 UTC · 6h ago·first 08:04 UTC · 7h agoExploit / PoC 2 sourcesCVE-2026-23980

45

CVE-2026-65181: Apache Impala: RCE via External Data Source Class Loading

Apache Impala CVE-2026-65181 allows remote code execution through class loading of external data sources; rated important by Apache.

Apache disclosed CVE-2026-65181, a remote code execution vulnerability in Apache Impala triggered via class loading of external data sources. The Apache Software Foundation rated the issue 'important'. The disclosure was posted to the oss-security mailing list on September 8, 2026.

oss-security·Sep 8, 21:41 UTC · 7d agoVulnerability 3 sourcesCVE-2026-65181

45

Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gateways

Sophos analyzed a stealth Linux rootkit that hides a web shell in memory on compromised F5 BIG-IP APM identity gateways, evading file-based detection.

Sophos analyzed a second-stage Linux rootkit implant found in compromised F5 BIG-IP APM environments running Apache and PHP, linked to exploitation of CVE-2025-53521, an unauthenticated RCE. The implant hooks Apache's PHP-loading process and serves modified in-memory versions of three legitimate webtop PHP files (apm_css.php3, full_wt.php3, webtop_popup_css.php3), leaving on-disk files untouched so hashes and integrity checks pass. It also establishes access via an authenticated local UNIX socket that can provide an interactive /bin/bash session. Experts warn compromised APM appliances, which handle federated SSO and terminate TLS at enterprise perimeters, could enable SSO token theft and lateral movement to trusted downstream applications.

CSO Online·Sep 10, 11:51 UTC · 6d agoMalware in the wildCVE-2025-53521

72

USN-8571-2: Apache HTTP Server regression

Ubuntu issues USN-8571-2 fixing an Apache HTTP Server regression that prevented startup when HTTP/2 proxying was enabled.

Ubuntu released USN-8571-2 to fix a regression introduced by USN-8571-1 in Apache HTTP Server. The earlier fix was incomplete due to a missing library symbol, causing Apache to fail to start when HTTP/2 proxying was enabled. The original advisory addressed CVE-2026-33007, a memory-handling flaw in mod_authn_socache allowing remote denial of service, and an HTTP response splitting vulnerability affecting multiple modules, credited to Pavel Kohout, Arkadi Vainbrand, Haruki Oyama, Merih Mengisteab, and Dawit Jeong.

Ubuntu Security Notices·updated 11:33 UTC · 3h ago·first Sep 10, 19:36 UTC · 5d agoAdvisory 13 sourcesCVE-2026-33007

28

GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends

GeoNetwork patched two chained flaws (CVE-2026-63219, CVE-2026-58400) enabling unauthenticated RCE in government geospatial metadata catalogs.

Two flaws in the open-source GeoNetwork catalog chain into unauthenticated RCE: a missing authorization check on the formatter upload endpoint (CVE-2026-63219, CVSS 8.6) and an unsafe Saxon XSLT processor configuration allowing Java execution (CVE-2026-58400, CVSS 9.1). Fixes shipped in versions 4.4.12 and 4.2.17 on July 8, 2026, with details published August 31. Ethiack fingerprinted 121 internet-exposed vulnerable deployments across 39 countries, 89% tied to government or military agencies. No exploitation in the wild or KEV listing was reported at disclosure.

The Hacker News·Sep 2, 09:18 UTC · 14d agoVulnerabilityCVE-2026-63219CVE-2026-58400CVE-2024-36401+1 CVEs

50

CVE-2026-78254: Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write

Apache Ant 1.2 before 1.10.18 ftp and scp tasks allow path traversal, letting malicious servers overwrite arbitrary files (CVE-2026-78254).

CVE-2026-78254 affects Apache Ant (org.apache.ant:ant) versions 1.2 before 1.10.18 and is rated moderate. The ftp and scp tasks download files from a remote server, and a malicious server can supply relative paths that write outside the dedicated target directory, overwriting attacker-chosen files with the permissions of the user running Ant. The issue is fixed in Apache Ant 1.10.18.

oss-security·Sep 6, 18:57 UTC · 9d agoVulnerabilityCVE-2026-782541

40

Hackers deploy Linux rootkit on F5 BIG-IP APM devices, hiding web shell in memory

Sophos analyzed a Linux rootkit, tracked as PoisonedRefresh, on hacked F5 BIG-IP APM devices hiding an in-memory web shell linked to exploited CVE-2025-53521.

Sophos and ESET analyzed an implant (named PoisonedRefresh by ESET) deployed on compromised F5 BIG-IP APM appliances, which serves enterprise, financial, government, and public sector deployments. The second-stage payload intercepts __libc_start_main, hooks Apache's APR module loader (apr_dso_load), RC4-encodes key strings, and rewrites PHP file reads in memory to embed a web shell inside legitimate scripts like apm_css.php3, full_wt.php3, and webtop_popup_css.php3, leaving on-disk files unchanged. A related installer component infects /usr/sbin/httpd, persists across BIG-IP upgrade images, modifies SELinux configuration, and deploys the payload. The malware also creates a Unix domain socket at /run/bigtlog.pipe that hands authenticated local connections to /bin/bash; F5 links the activity to CVE-2025-53521, an unauthenticated RCE in BIG-IP APM already exploited in the wild.

Help Net Security·Sep 9, 11:05 UTC · 7d agoMalware in the wildCVE-2025-535211

78

CVE-2026-73579: Apache Syncope: Non-recursive Any search could skip Realms restrictions

Apache Syncope non-recursive Any search can skip Realms restrictions, exposing objects outside an administrator's authorized realm (CVE-2026-73579).

CVE-2026-73579 is an incorrect authorization vulnerability in Apache Syncope where non-recursive Any search requests are transformed in a way that skips Realms restrictions, returning objects outside the administrator's authorized realm. Affected component is syncope-core-persistence-common 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Apache rates the issue moderate severity.

oss-security·Sep 14, 15:31 UTC · 1d agoVulnerabilityCVE-2026-73579

18

CVE-2026-72524: Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables

Apache Doris authorization bypass CVE-2026-72524 lets authenticated low-privilege users read, write, or drop arbitrary tables in affected 3.1.x through 4.1.3 versions.

CVE-2026-72524 is an incorrect authorization vulnerability in Apache Doris rated important, allowing an authenticated low-privilege user to bypass privilege checks and read, write, or drop arbitrary tables. Affected versions include Apache Doris 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.3. The flaw permits access to or modification of data the user is not authorized to touch.

oss-security·Sep 14, 15:09 UTC · 2d agoVulnerabilityCVE-2026-725241

30

USN-8734-1: PHP vulnerabilities

Ubuntu issued USN-8734-1 fixing three PHP denial-of-service flaws in SOAP, metaphone() and phar handling, including CVE-2026-7262 and CVE-2026-7568.

Ubuntu security notice USN-8734-1 addresses multiple PHP vulnerabilities. CVE-2026-7262 is a NULL pointer dereference in Apache map decoding in SOAP servers with a typemap configured; CVE-2026-7568 is a signed integer overflow in metaphone() causing an out-of-bounds read; and CVE-2026-7260 involves unbounded recursion from circular symbolic links in phar archives. All issues could allow remote attackers to cause denial-of-service conditions.

Ubuntu Security Notices·Sep 7, 13:56 UTC · 9d agoAdvisoryCVE-2026-7262CVE-2026-7568CVE-2026-7260

25

CVE-2026-82617: Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns

Apache OpenNLP CVE-2026-82617: built-in EMAIL and URL regex name-finder patterns enable regular expression denial-of-service and stack exhaustion in affected releases.

CVE-2026-82617 affects Apache OpenNLP opennlp-core 3.0.0-M1 before 3.0.0-M6 and opennlp-tools 2.0.0 before 2.5.12. The DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL patterns in RegexNameFinderFactory contain ambiguous nested quantifiers. Applications using these built-in finders on attacker-controlled input can be forced into regular expression denial of service or stack exhaustion. Fixes shipped in opennlp-tools 2.5.12 and 3.0.0-M6.

oss-security·Sep 11, 19:24 UTC · 4d agoVulnerability 2 sourcesCVE-2026-826171

28

CVE-2026-73191: Apache Syncope: CAS service URL injection via Forwarded HTTP headers

Apache Syncope SRA CVE-2026-73191 enables CAS service URL injection via Forwarded HTTP headers.

Apache Syncope disclosed CVE-2026-73191, a moderate-rated open redirect vulnerability in the Syncope SRA. When the SRA is configured for CAS authentication, the target Apereo CAS service URL can be manipulated through Forwarded HTTP headers, redirecting users to an untrusted site. The flaw affects syncope-sra in versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to fixed releases.

oss-security·Sep 14, 15:21 UTC · 2d agoVulnerabilityCVE-2026-73191

18

CVE-2026-73334: Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Apache Parquet Hadoop CVE-2026-73334: a file-controlled KMS URL reaches pluggable KmsClients without host validation in parquet-java 1.12 through 1.18.0.

Apache disclosed CVE-2026-73334, a moderate issue in the org.apache.parquet.crypto.keytools package of parquet-java, versions 1.12 through 1.18.0. The package implements envelope encryption that wraps data keys via a Key Management Service. A KMS URL controlled by the Parquet file is forwarded to a pluggable KmsClient that skips host validation, which could allow crafted files to redirect KMS requests.

oss-security·Sep 8, 15:46 UTC · 7d agoVulnerabilityCVE-2026-733341

15

[remote] CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE

Exploit-DB published a PoC for CVE-2026-42167, post-authentication SQL injection in ProFTPD mod_sql leading to remote code execution.

Exploit-DB entry 52658 provides a remote exploit for CVE-2026-42167, a SQL injection in ProFTPD's mod_sql module that is reachable after authentication and can lead to remote code execution. Successful exploitation requires valid credentials on the target FTP service.

Exploit-DB·Aug 25, 00:00 UTC · 22d agoExploit / PoCCVE-2026-421671

45

Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021

Apache Log4j 2 RCE CVE-2021-44228 is actively exploited via crafted JNDI lookups; Palo Alto Unit 42 urges upgrading to Log4j 2.17.1.

Unit 42 details CVE-2021-44228, an easily exploited remote code execution flaw in Apache Log4j 2 where attacker-supplied JNDI lookups in logged user input cause payload download and execution. Massive internet-wide scanning for unpatched systems has begun, with observed follow-on activity including information stealing, Cobalt Strike delivery, and coinmining. The recommended fix is Log4j 2.17.1, which also patches CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832. Widely used Java software including Apache Struts, Solr, Druid, Flink, ElasticSearch, and Spring Boot is affected.

Palo Alto Unit 42·Aug 17, 12:20 UTC · Aug 17, 2026Exploit / PoC in the wildCVE-2021-44228CVE-2021-45046CVE-2021-45105+3 CVEs

92

CVE-2026-57822: Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service

Apache fixed CVE-2026-57822, a deserialization flaw in ActiveMQ Artemis management messaging letting authorized clients trigger broker denial of service.

Apache disclosed a deserialization issue in message-based management request handling for Apache Artemis and Apache ActiveMQ Artemis. It affects Apache Artemis (artemis-core-client) 2.50.0 through 2.56.0 and ActiveMQ Artemis (artemis-core-client) 1.3.0 through 2.44.0. Exploitation requires an authenticated client authorized with MANAGE permission using management-via-messaging; parameter processing can trigger denial of service. Apache rates the issue as important.

oss-security·Sep 10, 00:44 UTC · 6d agoVulnerability 7 sourcesCVE-2026-57822

35

ZDI-26-590: libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI disclosed CVE-2026-19773, an unauthenticated out-of-bounds write allowing remote code execution in libwebsockets HTTP/2 HPACK parsing, rated CVSS 9.8.

The Zero Day Initiative published advisory ZDI-26-590 for an out-of-bounds write vulnerability in libwebsockets' HTTP/2 HPACK path header parsing. A remote attacker can execute arbitrary code on affected installations without authentication. The flaw is tracked as CVE-2026-19773 and carries a CVSS score of 9.8.

ZDI Published Advisories·Aug 24, 05:00 UTC · 23d agoVulnerabilityCVE-2026-19773

60

CVE-2026-54048: Apache Impala: Avro Schema URL Server-Side Request Forgery

Apache Impala CVE-2026-54048 lets crafted Avro schema URLs trigger SSRF to internal endpoints, with responses potentially leaking via error messages.

A server-side request forgery in Apache Impala 2.0.0 through 4.5.1 on all platforms can be triggered via an Avro schema URL using an http or file:/// URI on a table. An attacker can cause Impala to send GET requests to internal endpoints it can access, and responses may be exposed through parsing error messages. Users are advised to upgrade to a fixed release.

oss-security·Sep 8, 21:36 UTC · 7d agoVulnerabilityCVE-2026-540481

32

CVE-2026-34486: Apache Software Foundation Apache Tomcat

CISA added CVE-2026-34486, an actively exploited Apache Tomcat EncryptInterceptor bypass enabling unauthenticated deserialization RCE, to its KEV catalog.

CVE-2026-34486 allows bypass of Apache Tomcat's EncryptInterceptor, a flaw introduced by the fix for padding-oracle issue CVE-2026-29146 in Tribes cluster encryption. CISA added the flaw to the Known Exploited Vulnerability catalog on August 4, 2026, alongside actively exploited Langflow and N-central flaws, with remediation required under BOD 26-04 guidance. Official patches and workarounds are available, and reporting notes unauthenticated remote code execution through Java deserialization on the Tribes receiver port 4000.

Web discovery (articles for new exploits & KEV entries)·Sep 9, 04:23 UTC · 7d agoExploit / PoC in the wildCVE-2026-34486CVE-2026-291462

72

CVE-2026-68570: Apache Doris: Authorization bypass leading to unauthorized data access

Apache Doris authorization bypass CVE-2026-68570 lets authenticated users read unauthorized data, disclosing information across versions 2.0.0 through 4.1.3.

CVE-2026-68570 is an incorrect authorization vulnerability in Apache Doris rated important, allowing an authenticated user to bypass privilege checks and read data they are not authorized to access. Affected versions span Apache Doris 2.0.0 through 2.1.*, 3.0.0 through 3.0.*, 4.0.0 before 4.0.8, and 4.1.0 before 4.1.4. The issue results in unauthorized disclosure of information.

oss-security·Sep 14, 15:07 UTC · 2d agoVulnerabilityCVE-2026-68570

28

ZDI-26-578: NGINX HTTP Dav Module Alias Directive Integer Underflow Remote Code Execution Vulnerability

An unauthenticated integer underflow (CVE-2026-27654, CVSS 8.1) in NGINX's HTTP Dav module alias directive enables remote code execution.

ZDI advisory ZDI-26-578 describes an integer underflow in the alias directive of the NGINX HTTP Dav module that allows remote attackers to execute arbitrary code. Authentication is not required to exploit the vulnerability. ZDI rated the issue 8.1 on CVSS and assigned CVE-2026-27654.

ZDI Published Advisories·Aug 13, 05:00 UTC · Aug 13, 2026VulnerabilityCVE-2026-27654

30

USN-8751-1: Urwid vulnerabilities

Ubuntu USN-8751-1 patches Urwid weak PRNG issue allowing local attacker possible denial of service or code execution.

Katriel Moses discovered that Urwid used a weak pseudo-random number generator. A local attacker could potentially exploit this issue to cause a denial of service or execute arbitrary code. Ubuntu has released a patch under USN-8751-1.

Ubuntu Security Notices·Sep 14, 03:34 UTC · 2d agoAdvisory1

12

[webapps] Apache Gravitino 1.2.1 - SSRF

Exploit-DB publishes a webapps SSRF proof-of-concept exploit targeting Apache Gravitino 1.2.1.

Exploit-DB entry 52641 documents a server-side request forgery (SSRF) exploit against Apache Gravitino version 1.2.1. The entry is categorized under web applications and provides a working proof of concept for the flaw.

Exploit-DB·Aug 11, 00:00 UTC · Aug 11, 2026Exploit / PoC1

25

CVE-2026-82438: Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Three CORS misconfigurations in Apache Storm 3.0.0 let malicious web pages from arbitrary origins read authenticated API responses.

CVE-2026-82438 (severity: important) affects Apache Storm Webapp (storm-webapp) versions 3.0.0 before 3.1.0. Three separate mechanisms allowed a web page on an unrelated origin to read responses served to authenticated users, including the Logviewer reflecting the request's Origin header in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials. This enables a malicious site to silently exfiltrate authenticated Storm API and log data from a victim's browser session.

oss-security·Sep 13, 14:39 UTC · 3d agoVulnerabilityCVE-2026-824381

30

USN-8749-1: CivetWeb vulnerabilities

Ubuntu USN-8749-1 patches CivetWeb URI and HTTP request parsing flaws enabling remote DoS or possible code execution.

Ubuntu Security Notice USN-8749-1 addresses two CivetWeb vulnerabilities. CVE-2025-55763 involves incorrect URI parsing that could allow a remote attacker to cause denial of service or execute arbitrary code, affecting Ubuntu 22.04 LTS and 24.04 LTS. CVE-2025-9648 involves incorrect HTTP request parsing enabling remote denial of service.

Ubuntu Security Notices·Sep 14, 01:27 UTC · 2d agoAdvisoryCVE-2025-55763CVE-2025-96481

25

Apache Syncope Vulnerabilities Allow Attackers to Execute Malicious Code and Bypass Controls

Apache Syncope fixed three flaws enabling SQL injection, Groovy sandbox escape, and JWT token theft to impersonate higher-privileged users.

Apache Syncope, an open-source identity management and access governance platform, disclosed CVE-2026-82232, a stacked-query SQL injection in the Task search sort parameter; CVE-2026-77147, a Groovy sandbox escape via malicious Command classes; and CVE-2026-73178, retrieval of signed JWT access tokens via REST enabling impersonation of more privileged users. All three flaws require administrator-level entitlements to exploit and affect Syncope 3.0, 4.0, and 4.1 releases. Fixes shipped in versions 4.0.8 and 4.1.3, with researchers Alon Galili and n0mi1k credited.

Cyber Security News·13:21 UTC · 2h agoVulnerability 3 sourcesCVE-2026-82232CVE-2026-77147CVE-2026-73178

45