Skip to content

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

ClosedPatched

Day · Nov 2, 2023

Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)

Apache ActiveMQ (Java OpenWire brokers and clients)

Follow this incident

Updates on Nov 2, 2023

  1. CISA adds CVE-2023-46604 to the KEV catalog

Summary

A deserialization flaw in ActiveMQ's Java OpenWire protocol marshaller let anyone who could reach a broker run shell commands on it. Within days of the fix, attackers were deploying HelloKitty ransomware through it.

Read the full incident →

Advisories3