// tag
Security incidents tagged Apache. Newest first.
› PHP
Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026 (appliance vendors such as QNAP are still preparing fixes); exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.
› Apache Tomcat patched
Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813. Added to CISA KEV on 2026-08-04.
› Apache ActiveMQ patched
Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection. Added to CISA KEV on 2026-04-16.
› Apache HTTP Server patched
Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Added to CISA KEV on 2025-05-01.
› Apache Tomcat patched
Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486. Added to CISA KEV on 2025-04-01.
› Apache OFBiz patched
Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access. Added to CISA KEV on 2025-02-04.
› Apache OFBiz patched
Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker. Added to the CISA KEV catalog on 2024-08-27.
› Apache Flink patched
Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface. Added to the CISA KEV catalog on 2024-05-23. CVE-2020-17519 was assigned before 2024; the KEV listing came in 2024.
› Apache OFBiz patched
Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution. Added to the CISA KEV catalog on 2024-08-07.
› Apache HugeGraph-Server patched
Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code. Added to the CISA KEV catalog on 2024-09-18.
› Apache Superset patched
Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions. Added to the CISA KEV catalog on 2024-01-08. CVE-2023-27524 was assigned before 2024; the KEV listing came in 2024.
› Apache ActiveMQ (Java OpenWire brokers and clients) patched
A deserialization flaw in ActiveMQ's Java OpenWire protocol marshaller let anyone who could reach a broker run shell commands on it. Within days of the fix, attackers were deploying HelloKitty ransomware through it.
› Apache RocketMQ patched
Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content. Added to CISA KEV on 2023-09-06.
› Apache Spark patched
Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled. Added to CISA KEV on 2023-03-07.
Can't patch every box today? The CrowdSec WAF has free, tentative virtual patches for both CVEs: cscli appsec-rules install crowdsecurity/vpatch-CVE-2026-109618 cscli appsec-rules install crowdsecurity/vpatch-CVE-2026-109619 A stopgap, not a fix: still update PHP.
Blog: Detecting PHP2Shell and Other PHP Vulnerabilities with ZAP PHP2Shell is the latest big “named” vulnerability. ZAP can now tell you if a site is running a vulnerable version of PHP, and it does so without sending a single extra request. t.co/9G4DtEhMM6 #php2shell
#PHP2Shell is a big one. Here are my takeaways. 1. These flaws reach back more than a decade. PHP’s maintainers identified one underlying problem in 2024, but its full impact wasn’t clear until AI-assisted research demonstrated its exploitability. What seems impractical to exploit today could easily be exploitable tomorrow as models advance. 2. Much of the web runs on PHP, and a lot of it is on versions that are out of support. Some get a source backport you must build yourself. Some get nothing. Attackers aren't hunting the servers you just patched. They're hunting the ones you forgot you own. There is going to be a very long tail on remediating these vulnerabilities, and we will see many downstream breaches over the coming months. 3. The patching window has completely collapsed. While we’ve exponentially found more vulnerabilities and exponentially created more patches, we’ve hit the sound barrier on operationally rolling them out. Even more concerning is the increase in exploitation occurring before or on the day of disclosure. When a flaw gets exploited, almost 90% of the time it’s hit on or before the day it’s disclosed. As defenders, you need to be looking at your watch, not a calendar! 4. Coordinated disclosure in open source is really hard. It runs on trust, not contracts. There were many people in the loop, and for good reason. Lots of great people doing incredible work. However, I expect leaked disclosures will be the norm, not the exception, as we move forward in the Agent-state era. The @a16z chart below says it all.
An update on PHP2Shell and the eMudhra certificate compromise. We've confirmed that Appwrite is not affected by PHP2Shell. Appwrite Cloud is also patched for eMudhra in every region. Here's what we've checked and what self-hosted users should do. 🧵
【#pixiv_inside】 PHP 8.5.12の緊急リリースに pixivはどう対応したか t.co/zYpXH9HWOy PHPにて緊急セキュリティリリースが予告され pixivも対応しました。 セキュリティアップデート公開から pixivメンテナンス明けまで約30分の対応を ビルド・デプロイ基盤も踏まえながら説明します✍️
Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) t.co/TW2zDAFV6K
+7 more on the incident pages above.
