Apache News Articles

N-central's Incomplete Patch Left MSP Clients Exposed While Attackers Held Both Keys

N-able N-central vulnerability added to CISA’s Known Exploited Vulnerabilities catalog twice in one week -- covering both the original authentication bypass and its failed patch -- alongside Langflow

5 days ago

CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws

The U.S. Cybersecurity and Infrastructure Security Agency is giving federal agencies three days to mitigate vulnerabilities in IBM Langflow, N-central, and Apache Tomcat, all actively exploited.

5 days ago

CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited

CISA adds three exploited Langflow, Tomcat, and N-central flaws to KEV, while Unit 42 links one campaign to a DeepSeek-powered hacking agent.

6 days ago

Stop Your Legacy Infrastructure from Hijacking Your AI Agents

AI agents inherit risk from legacy servers, AD, IAM, and cloud storage, creating attack paths that bypass model-level security.

ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories

ThreatsDay Bulletin covers AI abuse, poisoned packages, phishing, macOS attacks, SD-WAN flaws, scams, and supply-chain threats this week.

IT, Telcos, Healthcare at Risk of HTTP/2 DDoS Attacks

The denial-of-service (DoS) exploit takes advantage of two features in HTTP/2 that were designed to save Internet bandwith.

IT Security News Hourly Summary 2026-06-04 21h : 6 posts - IT Security News

6 posts were published in the last hour 18:34 : Gartner SRM 2026 Signals a Cybersecurity Shift From Prevention to Resilience 18:34 : Imperva Customers Protected Against CVE-2026-49975 (HTTP/2 Bomb) DoS 18:34 : Cybercriminals Shift From Fake Login Pages to…Read more →

Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE

Ravie LakshmananMay 05, 2026Vulnerability / Server Security

Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE

Apache fixes CVE-2026-23918 in HTTP/2; double-free flaw enables DoS and RCE, impacting version 2.4.66 users.

Critical Apache HTTP Server Flaw Exposes Millions of Servers to RCE Attacks

The Apache Software Foundation has released a critical security update for Apache HTTP Server, patching five vulnerabilities, including a dangerous double-free flaw capable of enabling Remote Code Execution (RCE) in version 2.4.67, released on May 4, 2026.

6000+ Apache ActiveMQ Instances Vulnerable to CVE-2026-34197 Exposed Online - IT Security News

More than 6,000 internet-exposed Apache ActiveMQ instances are still vulnerable to CVE-2026-34197. This newly tracked security flaw has now been added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalog. The exposure data comes from The Shadow...

Actively exploited Apache ActiveMQ flaw impacts 6,400 servers

Nonprofit security organization Shadowserver found that over 6,400 Apache ActiveMQ servers exposed online are vulnerable to ongoing attacks exploiting a high-severity code injection vulnerability.

CISA flags Apache ActiveMQ flaw as actively exploited in attacks

CISA warned that attackers are now exploiting a high-severity Apache ActiveMQ vulnerability, which was patched earlier this month after going undetected for 13 years.

Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation

CVE-2026-34197 exploited in Apache ActiveMQ; CISA KEV listing sets April 30, 2026 patch deadline, increasing enterprise RCE risk.

Week in review: Windows zero-day exploit leaked, Patch Tuesday forecast - Help Net Security

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Cloudflare moves up its post-quantum deadline as

Claude helps researcher dig up decade-old Apache ActiveMQ RCE vulnerability (CVE-2026-34197) - IT Security News

In the latest demonstration of how AI assistants can help with bug hunting, Horizon3.ai researcher Naveen Sunkavally used Claude to unearth CVE-2026-34197, a remote code execution vulnerability in Apache ActiveMQ that’s been introduced in the codebase 13 years ago. The…Read more →

Claude helps researcher dig up decade-old Apache ActiveMQ RCE vulnerability (CVE-2026-34197) - Help Net Security

Researcher used Claude to unearth CVE-2026-34197, an Apache ActiveMQ vulnerability that's been introduced in the codebase 13 years ago.

ThreatsDay Bulletin: Hybrid P2P Botnet, 13-Year-Old Apache RCE and 18 More Stories

6:08 PM This week in cybersecurity: botnets, RCE flaws, AI-driven attacks, stealers, and more. Fast, no-fluff roundup.

13-year-old bug in ActiveMQ lets hackers remotely execute commands

Security researchers discovered a remote code execution (RCE) vulnerability in Apache ActiveMQ Classic that has gone undetected for 13 years and could be exploited to execute arbitrary commands.

Years-Old Apache Struts2 Vulnerability Downloaded 325K+ Times in the Past Week

AI-discovered Apache Struts vulnerability CVE-2025-68493 is still widely used, with over 380,000 downloads of vulnerable versions in just one week.

Critical Apache Struts 2 Vulnerability Allow Attackers to Steal Sensitive Data

XML external entity (XXE) injection flaw found in Apache Struts 2, exposing millions of applications to data theft and server compromise.

Critical Apache Struts 2 Vulnerability Allow Attackers to Steal Sensitive Data

XML external entity (XXE) injection flaw found in Apache Struts 2, exposing millions of applications to data theft and server compromise.

Apache Struts 2 Vulnerability CVE-2025-68493 Exposes Sensitive Data

Discover the critical Apache Struts 2 vulnerability CVE-2025-68493 that exposes sensitive data. Learn how to protect your applications from data breaches and Denial-of-Service attacks.

Critical Apache Struts 2 Flaw Could Let Attackers Steal Sensitive Data

A vulnerability in Apache Struts 2’s XWork component could expose sensitive data and open the door to denial‑of‑service and server‑side request forgery (SSRF).