Search: “Apache”

409 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 144 Exploit / PoC 125 Ransomware 65 Malware 28 Data breach 18 Threat actor 17 Advisory 4 Policy & legal 3 Phishing & fraud 2 AI tools & infra 1 Tools 1 Model release 1

SeverityAll critical 342 high 60 medium 3 low 1 info 3

Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021

Apache Log4j 2 RCE CVE-2021-44228 is actively exploited via crafted JNDI lookups; Palo Alto Unit 42 urges upgrading to Log4j 2.17.1.

Unit 42 details CVE-2021-44228, an easily exploited remote code execution flaw in Apache Log4j 2 where attacker-supplied JNDI lookups in logged user input cause payload download and execution. Massive internet-wide scanning for unpatched systems has begun, with observed follow-on activity including information stealing, Cobalt Strike delivery, and coinmining. The recommended fix is Log4j 2.17.1, which also patches CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832. Widely used Java software including Apache Struts, Solr, Druid, Flink, ElasticSearch, and Spring Boot is affected.

Palo Alto Unit 42Aug 17, 12:20 UTC · Aug 17, 2026Exploit / PoC in the wildCVE-2021-44228 CVE-2021-45046 CVE-2021-45105+3 CVEs

Apache Struts 2 Flaws Affect Multiple Cisco Products

The Hacker NewsSep 12, 10:51 UTC · Sep 12, 2017Data breach in the wildCVE-2017-9805 CVE-2017-5638 CVE-2017-9793+2 CVEs

Suspected exploitation of Apache ActiveMQ flaw CVE-2023

Security AffairsNov 2, 13:52 UTC · Nov 2, 2023Ransomware in the wildCVE-2023-46604

Attackers exploiting Apache ActiveMQ flaw to deliver ransomware (CVE-2023-46604)

Help Net SecurityNov 21, 11:29 UTC · Nov 21, 2023Ransomware in the wildCVE-2023-46604

Apache rolled out a new update in a few days to fix incomplete patch for actively exploited flaw

Security AffairsOct 8, 07:38 UTC · Oct 8, 2021Vulnerability in the wildCVE-2021-41773 CVE-2021-42013

Vulnerability Spotlight: Apache OpenOffice Vulnerabilities

Cisco TalosOct 26, 14:26 UTC · Oct 26, 2017Vulnerability in the wildCVE-2017-9806 CVE-2017-12607 CVE-2017-12608

PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory

Sophos details PoisonedRefresh, a fileless Linux rootkit that injects a memory-resident PHP web shell into F5 BIG-IP APM after exploitation of CVE-2025-53521.

On September 8, 2026, SophosLabs published an analysis of Linux/Agnt-IC (dubbed PoisonedRefresh by ESET) found in compromised F5 BIG-IP Access Policy Manager environments. Initial access leverages CVE-2025-53521, an unauthenticated RCE in BIG-IP APM when an access policy is configured on a virtual server; F5 confirmed exploitation and links the activity to cluster c05d5254, while Shadowserver observed 795 exposed vulnerable endpoints. A first stage hidden in a modified umount binary modifies /usr/sbin/httpd and SELinux configuration and embeds itself in BIG-IP upgrade images for persistence. The second-stage ELF intercepts __libc_start_main, hooks apr_dso_load, and injects a PHP web shell into libphp memory via mmap manipulation, leaving no disk artifacts, and exposes a /bin/bash shell via a local UNIX domain socket instead of a TCP port.

Security AffairsSep 9, 08:50 UTC · 7d agoMalware in the wildCVE-2025-53521

Researchers warn of a new critical Apache OFBiz flaw

Security AffairsAug 5, 16:42 UTC · Aug 5, 2024Exploit / PoC in the wildCVE-2024-38856 CVE-2024-32113 CVE-2023-51467

HelloKitty Ransomware Group Exploiting Apache ActiveMQ Vulnerability

The Hacker NewsNov 4, 04:55 UTC · Nov 4, 2023Ransomware in the wildCVE-2023-46604

Threat Advisory: Critical Apache Log4j vulnerability being exploited in the wild

Cisco TalosDec 10, 19:37 UTC · Dec 10, 2021Exploit / PoC in the wildCVE-2021-44228 CVE-2021-45046 CVE-2021-45105+1 CVEs

New Apache Struts Zero-Day Vulnerability Being Exploited in the Wild

The Hacker NewsMar 9, 12:03 UTC · Mar 9, 2017Exploit / PoC in the wildCVE-2017-5638

CVE-2026-34486: Apache Software Foundation Apache Tomcat

CISA added CVE-2026-34486, an actively exploited Apache Tomcat EncryptInterceptor bypass enabling unauthenticated deserialization RCE, to its KEV catalog.

CVE-2026-34486 allows bypass of Apache Tomcat's EncryptInterceptor, a flaw introduced by the fix for padding-oracle issue CVE-2026-29146 in Tribes cluster encryption. CISA added the flaw to the Known Exploited Vulnerability catalog on August 4, 2026, alongside actively exploited Langflow and N-central flaws, with remediation required under BOD 26-04 guidance. Official patches and workarounds are available, and reporting notes unauthenticated remote code execution through Java deserialization on the Tribes receiver port 4000.

Web discovery (articles for new exploits & KEV entries)Sep 9, 04:23 UTC · 7d agoExploit / PoC in the wildCVE-2026-34486 CVE-2026-291462

U.S. CISA adds Microsoft .NET Framework, Apache OFBiz, and Paessler PRTG Network Monitor flaws to its Known Exploited Vulnerabilities catalog

Security AffairsFeb 5, 15:03 UTC · Feb 5, 2025Exploit / PoC in the wildCVE-2024-45195 CVE-2024-29059 CVE-2018-9276+1 CVEs